Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23-07-2024 10:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe
-
Size
148KB
-
MD5
674c9c3ab659c4eead1f503ae186f0ad
-
SHA1
9ab5881b142d73709318f1fd5fcc1ada88f4ee82
-
SHA256
242749bb831e7f859b93bbe902fcb91ffb04a8db97a210d54a9bd8f1174036a4
-
SHA512
518d8cd9c06cb6157763a7cf95293283f28fc8216efe514409203148077b25eb462fd393b954ca667e82fee5ca31c59eb5a96165cf531c7aa3040b01328d54d9
-
SSDEEP
3072:gdo+kgRs59j/pvkqBBac+RAGq1bg7Yfgst6OzOS79pgRZkhQJAOA29E5j4oQC6:OoBbj/pvkqBBac+RAGq1bZHtrzOS77kI
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" txzeuq.exe -
Executes dropped EXE 1 IoCs
pid Process 296 txzeuq.exe -
Loads dropped DLL 2 IoCs
pid Process 1940 674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe 1940 674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /T" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /A" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /k" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /L" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /u" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /Q" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /N" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /s" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /Z" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /v" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /E" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /S" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /y" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /P" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /V" 674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /W" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /D" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /w" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /p" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /V" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /X" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /h" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /g" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /q" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /Y" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /B" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /d" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /i" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /j" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /x" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /C" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /H" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /e" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /b" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /O" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /I" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /l" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /M" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /a" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /U" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /c" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /R" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /z" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /o" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /m" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /r" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /F" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /J" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /f" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /K" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /t" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /G" txzeuq.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\txzeuq = "C:\\Users\\Admin\\txzeuq.exe /n" txzeuq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1940 674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe 296 txzeuq.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1940 674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe 296 txzeuq.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1940 wrote to memory of 296 1940 674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe 30 PID 1940 wrote to memory of 296 1940 674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe 30 PID 1940 wrote to memory of 296 1940 674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe 30 PID 1940 wrote to memory of 296 1940 674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\674c9c3ab659c4eead1f503ae186f0ad_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\txzeuq.exe"C:\Users\Admin\txzeuq.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:296
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
MD50aaf000df250fd3e08ea80764cd659c5
SHA121877d2e31ef212b27c1700ca256741dbd78cc3b
SHA2568aa18d7f3026cd08ad1ae122450928c4c8eb08e12f4006a92b4bedde4006514f
SHA51284a60dce4e2427de309160d6b1058699c6677e27ceaa440eea099c5fece71e820d3b74a9b6189fe52917c31ef69b36c40ab78867f6185c6a00b42c46aa84cb70