Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 21:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7150a5df3f3c7f58e96fe93ec8c569f6_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
7150a5df3f3c7f58e96fe93ec8c569f6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
7150a5df3f3c7f58e96fe93ec8c569f6_JaffaCakes118.exe
-
Size
132KB
-
MD5
7150a5df3f3c7f58e96fe93ec8c569f6
-
SHA1
a8d7f9523abf620a2de3a1a38ee3540372c47ec9
-
SHA256
2ba720cc7592ee8605777c6820d025219b0c8b67cb044917a34bba504df5aba0
-
SHA512
b2aed2b82b899bfb1f62b8280f552793f8822557b93997691e5475b9fe22cb83497f158431dffc12c56b25e91b5c0570fbf7d31d1ba0f4cba7a8eb45004f3c6e
-
SSDEEP
3072:w3k/ZPrdVfWM8RM/8KmwBErXXFefQmD8ampjIiltHj:f/tX8/KmwBEjXFeos8aCUiHD
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 7150a5df3f3c7f58e96fe93ec8c569f6_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" raaco.exe -
Executes dropped EXE 1 IoCs
pid Process 2744 raaco.exe -
Loads dropped DLL 2 IoCs
pid Process 2708 7150a5df3f3c7f58e96fe93ec8c569f6_JaffaCakes118.exe 2708 7150a5df3f3c7f58e96fe93ec8c569f6_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /T" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /d" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /B" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /K" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /Y" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /D" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /u" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /v" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /H" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /M" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /t" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /s" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /e" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /q" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /P" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /m" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /o" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /J" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /M" 7150a5df3f3c7f58e96fe93ec8c569f6_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /n" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /N" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /E" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /c" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /r" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /g" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /O" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /R" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /i" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /f" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /C" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /G" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /F" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /a" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /Z" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /y" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /U" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /p" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /I" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /x" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /S" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /b" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /j" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /A" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /h" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /W" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /V" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /X" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /z" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /k" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /l" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /L" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /w" raaco.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\raaco = "C:\\Users\\Admin\\raaco.exe /Q" raaco.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language raaco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7150a5df3f3c7f58e96fe93ec8c569f6_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2708 7150a5df3f3c7f58e96fe93ec8c569f6_JaffaCakes118.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe 2744 raaco.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2708 7150a5df3f3c7f58e96fe93ec8c569f6_JaffaCakes118.exe 2744 raaco.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2744 2708 7150a5df3f3c7f58e96fe93ec8c569f6_JaffaCakes118.exe 30 PID 2708 wrote to memory of 2744 2708 7150a5df3f3c7f58e96fe93ec8c569f6_JaffaCakes118.exe 30 PID 2708 wrote to memory of 2744 2708 7150a5df3f3c7f58e96fe93ec8c569f6_JaffaCakes118.exe 30 PID 2708 wrote to memory of 2744 2708 7150a5df3f3c7f58e96fe93ec8c569f6_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\7150a5df3f3c7f58e96fe93ec8c569f6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7150a5df3f3c7f58e96fe93ec8c569f6_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\raaco.exe"C:\Users\Admin\raaco.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD5bad0290ac950a0e48a891a2a621f7405
SHA1b808130dba83e593478469157e061b02baf87f03
SHA256f5e94c787279ab362e98b21b50dd97de9ebc8ccd39372b2b120a550bedff2b10
SHA512787ac7637350a13b61c602efc795ec77e3cb8a160ac3b606d671c2dcc81fd97e7cb719f87b5212654b47f4574aaedf560f12c5b7b82ea08ee15fec3076dbfc9e