Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 20:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5d9b359d584c849575415500836ea35c_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5d9b359d584c849575415500836ea35c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
5d9b359d584c849575415500836ea35c_JaffaCakes118.exe
-
Size
156KB
-
MD5
5d9b359d584c849575415500836ea35c
-
SHA1
d570b436374ea6228df11c247adf4425d6f7aa67
-
SHA256
42c55675d0d42376758ae4d43e8b9ed4e08e422101ea55bf83abf6e2e864b8ed
-
SHA512
cba40c79c73dfd35991990493bd41aaa3ecb529ff4e8e599b0070ecf3a1370fb9d14a426037160f06ce8106b17d249a717f8f676dec62a90c6ddc939af5304f2
-
SSDEEP
3072:8K3gJd1dYt+Vvu/5gEsSy8dH0pLaATo4ti6YcmE5j4oQ:X2SqvuTD0pLa2o4FY4d
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 5d9b359d584c849575415500836ea35c_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ceujuf.exe -
Executes dropped EXE 1 IoCs
pid Process 2816 ceujuf.exe -
Loads dropped DLL 2 IoCs
pid Process 2416 5d9b359d584c849575415500836ea35c_JaffaCakes118.exe 2416 5d9b359d584c849575415500836ea35c_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /N" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /Y" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /m" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /X" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /d" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /H" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /B" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /q" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /t" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /F" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /a" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /b" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /n" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /v" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /z" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /Z" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /V" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /c" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /o" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /T" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /M" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /A" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /I" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /s" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /O" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /f" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /R" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /y" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /x" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /P" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /e" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /g" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /t" 5d9b359d584c849575415500836ea35c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /Q" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /w" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /C" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /L" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /G" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /E" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /J" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /h" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /i" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /j" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /D" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /u" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /l" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /k" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /W" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /S" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /U" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /p" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /r" ceujuf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\ceujuf = "C:\\Users\\Admin\\ceujuf.exe /K" ceujuf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2416 5d9b359d584c849575415500836ea35c_JaffaCakes118.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe 2816 ceujuf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2416 5d9b359d584c849575415500836ea35c_JaffaCakes118.exe 2816 ceujuf.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2816 2416 5d9b359d584c849575415500836ea35c_JaffaCakes118.exe 30 PID 2416 wrote to memory of 2816 2416 5d9b359d584c849575415500836ea35c_JaffaCakes118.exe 30 PID 2416 wrote to memory of 2816 2416 5d9b359d584c849575415500836ea35c_JaffaCakes118.exe 30 PID 2416 wrote to memory of 2816 2416 5d9b359d584c849575415500836ea35c_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d9b359d584c849575415500836ea35c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d9b359d584c849575415500836ea35c_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\ceujuf.exe"C:\Users\Admin\ceujuf.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD54b7d4c92f99eedf7487af0cc46f2a83b
SHA1d1e45b70dace650deaa9a50530cdead0b657dbd6
SHA25689da6c88b015e3010900b3f9f9369aa919e2b65781726e604100a163845c0c16
SHA51220a33bbb3dc05624ce3af6023fdb91730fa264d075cbf1183c1efa8b17528c2baa9a5eb42f69a48b3a88d3b38ec8207083aadafc024bd6aeb1087bf3c5190ab0