Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
01/08/2024, 21:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
81c6b75d4fc8796475a30a9c95cd59d1_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
81c6b75d4fc8796475a30a9c95cd59d1_JaffaCakes118.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
81c6b75d4fc8796475a30a9c95cd59d1_JaffaCakes118.exe
-
Size
96KB
-
MD5
81c6b75d4fc8796475a30a9c95cd59d1
-
SHA1
4338a2300f6203abe3615293836449e6a3d78711
-
SHA256
f76f51857fe8a20e9e815acb45fe2baeca418c1bacbc8bc28937b97b64c3bf72
-
SHA512
2d97779d1525f05f145dc94be199fefeb80de3845c521ac46f0388113058d88b194974becef9aa3e69c8a36553a7ee7cc3fccfc2d2e1b000b7ff891f7d3933b5
-
SSDEEP
1536:hSQBHUf6cO/hty/kGulSc16l6u+NMMl/KlYv1Tq5ThF/NIjnZEh:v3hYwlu8CFF/Cn6h
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 81c6b75d4fc8796475a30a9c95cd59d1_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sokaz.exe -
Executes dropped EXE 1 IoCs
pid Process 2472 sokaz.exe -
Loads dropped DLL 2 IoCs
pid Process 2388 81c6b75d4fc8796475a30a9c95cd59d1_JaffaCakes118.exe 2388 81c6b75d4fc8796475a30a9c95cd59d1_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /w" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /d" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /K" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /N" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /z" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /e" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /a" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /A" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /F" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /s" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /R" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /T" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /y" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /Y" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /f" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /D" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /g" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /r" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /O" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /u" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /M" 81c6b75d4fc8796475a30a9c95cd59d1_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /P" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /i" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /k" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /S" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /H" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /I" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /C" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /Z" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /p" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /t" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /j" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /o" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /h" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /V" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /Q" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /v" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /l" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /B" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /c" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /x" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /n" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /q" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /M" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /E" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /m" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /G" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /W" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /L" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /U" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /b" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /J" sokaz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\sokaz = "C:\\Users\\Admin\\sokaz.exe /X" sokaz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81c6b75d4fc8796475a30a9c95cd59d1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sokaz.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2388 81c6b75d4fc8796475a30a9c95cd59d1_JaffaCakes118.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe 2472 sokaz.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2388 81c6b75d4fc8796475a30a9c95cd59d1_JaffaCakes118.exe 2472 sokaz.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2472 2388 81c6b75d4fc8796475a30a9c95cd59d1_JaffaCakes118.exe 29 PID 2388 wrote to memory of 2472 2388 81c6b75d4fc8796475a30a9c95cd59d1_JaffaCakes118.exe 29 PID 2388 wrote to memory of 2472 2388 81c6b75d4fc8796475a30a9c95cd59d1_JaffaCakes118.exe 29 PID 2388 wrote to memory of 2472 2388 81c6b75d4fc8796475a30a9c95cd59d1_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\81c6b75d4fc8796475a30a9c95cd59d1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\81c6b75d4fc8796475a30a9c95cd59d1_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\sokaz.exe"C:\Users\Admin\sokaz.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD51c355410aa780d0a9561bccf68314c0f
SHA10a62c31e9a80b237cb70a0263252c7b00d0ea243
SHA256fbd5e799e5afa4a12331b5cf4995f40fb2d51e1fd9675c1b94afa7074a9a2a3f
SHA512b50d7d4fc9b15dbbaabadae0c6e24d63c79abe4c30e79f5ea9d89491e358aa038276e125fb378cfa413b08da9f1352d41eae43722c1584d73d153a7df16cfb4e