Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11-08-2024 03:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe
-
Size
216KB
-
MD5
88d7ba7286e1be864733a94975d846b5
-
SHA1
bf16920ca627b9673728f026e12c0c9b1d145039
-
SHA256
446403872cf36bf38635ea2e55a555e217e7fb68973bc80f1a890f560b91e46b
-
SHA512
840673ae6949f1f13626eba22108b7f39848f3cff827638e35916193097c50e253a352512fad4fd35dfb754b600592048dcdafc227e7401312b66b89aa1df152
-
SSDEEP
6144:2eUhrbA1x5PZZKnvmb7/D26g4upEoadEXUqgVWLIg7F:AA1x5PZZKnvmb7/D26GadEXUqgDg7F
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" reiux.exe -
Executes dropped EXE 1 IoCs
pid Process 2752 reiux.exe -
Loads dropped DLL 2 IoCs
pid Process 1628 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe 1628 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /g" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /Z" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /J" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /X" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /H" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /P" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /o" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /t" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /w" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /m" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /M" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /r" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /x" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /E" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /d" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /T" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /A" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /q" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /W" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /y" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /a" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /L" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /Q" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /b" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /u" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /C" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /s" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /K" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /n" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /z" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /l" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /V" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /S" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /p" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /G" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /i" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /O" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /R" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /I" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /Y" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /N" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /z" 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /f" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /U" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /v" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /D" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /c" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /j" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /h" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /F" reiux.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\reiux = "C:\\Users\\Admin\\reiux.exe /B" reiux.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reiux.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1628 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe 2752 reiux.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1628 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe 2752 reiux.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1628 wrote to memory of 2752 1628 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe 30 PID 1628 wrote to memory of 2752 1628 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe 30 PID 1628 wrote to memory of 2752 1628 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe 30 PID 1628 wrote to memory of 2752 1628 88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\88d7ba7286e1be864733a94975d846b5_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\reiux.exe"C:\Users\Admin\reiux.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2752
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD5fb194a71f62b45b9ac30de188982d100
SHA1a66b975fb2d48d6950be22988b3459dddfa28041
SHA256d3473b19a790f4cbabe27baa38d08edd278e6e22278e033d45a0891ed419b58b
SHA5125a30a7b945e796355fbc04f785da0d50d9f4adeba3a6d6f940c4b04c2a903952756f8be25a4a54ccc0f55fe2d41f3eb344062e2b3c42fb6de75487c8ebb8d7e6