Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/08/2024, 03:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84a50d8353f84b1d42b48f082047c680_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
84a50d8353f84b1d42b48f082047c680_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
84a50d8353f84b1d42b48f082047c680_JaffaCakes118.exe
-
Size
128KB
-
MD5
84a50d8353f84b1d42b48f082047c680
-
SHA1
c0e356c35cdf254c05213456e4d63b2a81b40f67
-
SHA256
17f95a8ff8da0d92237d0ee9475bea522ad4981311004926fbe1569c5393768f
-
SHA512
0b85373583d6b6d31d33bcc2f102c724eb925d384d898e4c38a6ce106bcedabfe404cb27e35590e915434eb9c875e83417e2b03256e6c546e8068dde4de86079
-
SSDEEP
3072:yrccplToPac4lUKjxcnz/Lj3UtDzkknldlTlIvLS:yIcplToSUacnz/Lj3U9wOlGD
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 84a50d8353f84b1d42b48f082047c680_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rnyiec.exe -
Executes dropped EXE 1 IoCs
pid Process 2748 rnyiec.exe -
Loads dropped DLL 2 IoCs
pid Process 2432 84a50d8353f84b1d42b48f082047c680_JaffaCakes118.exe 2432 84a50d8353f84b1d42b48f082047c680_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /e" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /q" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /f" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /U" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /k" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /c" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /Q" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /P" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /I" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /A" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /S" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /d" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /r" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /x" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /b" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /G" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /V" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /j" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /E" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /D" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /C" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /T" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /Y" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /B" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /X" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /v" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /p" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /y" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /t" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /a" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /R" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /O" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /C" 84a50d8353f84b1d42b48f082047c680_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /h" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /i" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /m" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /H" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /M" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /g" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /o" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /N" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /z" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /F" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /Z" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /K" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /J" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /L" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /n" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /s" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /u" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /l" rnyiec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rnyiec = "C:\\Users\\Admin\\rnyiec.exe /W" rnyiec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84a50d8353f84b1d42b48f082047c680_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnyiec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2432 84a50d8353f84b1d42b48f082047c680_JaffaCakes118.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe 2748 rnyiec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2432 84a50d8353f84b1d42b48f082047c680_JaffaCakes118.exe 2748 rnyiec.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2432 wrote to memory of 2748 2432 84a50d8353f84b1d42b48f082047c680_JaffaCakes118.exe 30 PID 2432 wrote to memory of 2748 2432 84a50d8353f84b1d42b48f082047c680_JaffaCakes118.exe 30 PID 2432 wrote to memory of 2748 2432 84a50d8353f84b1d42b48f082047c680_JaffaCakes118.exe 30 PID 2432 wrote to memory of 2748 2432 84a50d8353f84b1d42b48f082047c680_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\84a50d8353f84b1d42b48f082047c680_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\84a50d8353f84b1d42b48f082047c680_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\rnyiec.exe"C:\Users\Admin\rnyiec.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD566284835b5679516a7b904409d41343b
SHA131e27e599d8cfcf5110ead09cb8e38f9f38244d1
SHA2566b67b4a342e29db913f90a408ec0641cee33272258634d64649feebbdca28da6
SHA51259a89a10085be3e8e34f543b40e526696966e2bd1b00342743e264c2687b2070a6b93883ebe93467bd7e7171ff74f3d481c49d3c34bf2a36c5b0162dc57d3689