Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 23:02
Static task
static1
Behavioral task
behavioral1
Sample
761a2fcb9f87b2379232ad74d1645888_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
761a2fcb9f87b2379232ad74d1645888_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
761a2fcb9f87b2379232ad74d1645888_JaffaCakes118.exe
-
Size
240KB
-
MD5
761a2fcb9f87b2379232ad74d1645888
-
SHA1
c71bdef4115556d722e9ab127f9fcfc6b880fae0
-
SHA256
a925f17bd2c931faed427344395c8a502f1caa7208dcf42aac05e39a406f9e23
-
SHA512
c4a148f2cb8ea6fa89d36706b83f27e6297cc5a3e5e95f1e93ab0d1aedae9fafc367cd7c29ec7d53c51ce7821b76ac46baab2d2ea6a146bea331b039a878f80d
-
SSDEEP
6144:wUX3dwqsNwemAB0EqxF6snji81RUinKchhymSQ:DdQQJsx
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 761a2fcb9f87b2379232ad74d1645888_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yaituej.exe -
Executes dropped EXE 1 IoCs
pid Process 2556 yaituej.exe -
Loads dropped DLL 2 IoCs
pid Process 2936 761a2fcb9f87b2379232ad74d1645888_JaffaCakes118.exe 2936 761a2fcb9f87b2379232ad74d1645888_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /n" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /y" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /c" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /e" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /h" 761a2fcb9f87b2379232ad74d1645888_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /u" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /a" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /l" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /o" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /z" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /s" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /t" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /m" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /f" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /r" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /d" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /g" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /b" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /p" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /v" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /x" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /q" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /h" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /j" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /w" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /i" yaituej.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaituej = "C:\\Users\\Admin\\yaituej.exe /k" yaituej.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 761a2fcb9f87b2379232ad74d1645888_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yaituej.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2936 761a2fcb9f87b2379232ad74d1645888_JaffaCakes118.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe 2556 yaituej.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2936 761a2fcb9f87b2379232ad74d1645888_JaffaCakes118.exe 2556 yaituej.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2556 2936 761a2fcb9f87b2379232ad74d1645888_JaffaCakes118.exe 30 PID 2936 wrote to memory of 2556 2936 761a2fcb9f87b2379232ad74d1645888_JaffaCakes118.exe 30 PID 2936 wrote to memory of 2556 2936 761a2fcb9f87b2379232ad74d1645888_JaffaCakes118.exe 30 PID 2936 wrote to memory of 2556 2936 761a2fcb9f87b2379232ad74d1645888_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\761a2fcb9f87b2379232ad74d1645888_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\761a2fcb9f87b2379232ad74d1645888_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\yaituej.exe"C:\Users\Admin\yaituej.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2556
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD59be170577790f83cca759c18e33e7830
SHA1dd449ecce762ff0f8eb3f7f4518087bd36528195
SHA2562b95e1137146550d9e4fd6fe84013ec20b3d81c4074048037f11341f179df41a
SHA5127226677346eb02901fa6739dde9904c2515171c86b3601a6187edd8b6f31f6367c8904e4cacbb6e7fa5161befeb9df2e8b5775ab66ad35e9a1e6eaeb22cbeb8c