Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 23:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b57c80ff87fa88dd8454c0d5e919aaf9_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
b57c80ff87fa88dd8454c0d5e919aaf9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
b57c80ff87fa88dd8454c0d5e919aaf9_JaffaCakes118.exe
-
Size
48KB
-
MD5
b57c80ff87fa88dd8454c0d5e919aaf9
-
SHA1
fe1d2d9a9f576650f10c9900aabf89359bc550e4
-
SHA256
2ddcc75480dbf27d773a5636ac288dd281a3046636f5a4bd5143ccab2840dfdc
-
SHA512
43b0f38010386dfdccc81d03842c4c372bbd388b34c1395115aafa1e5d3ed2f2f9cf356008ed87d845e830940a5846f70beccf8ee0da80d8a4a440557d65652b
-
SSDEEP
768:QijipFA13weNFSmOEgIY6I+Tnc/9/8IZnS0R0TYWfHenHLqHCTHgpQO08:FOA1geNFSvEvI+Tnsx5S0REQO08
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lwrioy.exe -
Executes dropped EXE 1 IoCs
pid Process 2836 lwrioy.exe -
Loads dropped DLL 2 IoCs
pid Process 2272 b57c80ff87fa88dd8454c0d5e919aaf9_JaffaCakes118.exe 2272 b57c80ff87fa88dd8454c0d5e919aaf9_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\lwrioy = "C:\\Users\\Admin\\lwrioy.exe" lwrioy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lwrioy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b57c80ff87fa88dd8454c0d5e919aaf9_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe 2836 lwrioy.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2272 b57c80ff87fa88dd8454c0d5e919aaf9_JaffaCakes118.exe 2836 lwrioy.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2836 2272 b57c80ff87fa88dd8454c0d5e919aaf9_JaffaCakes118.exe 30 PID 2272 wrote to memory of 2836 2272 b57c80ff87fa88dd8454c0d5e919aaf9_JaffaCakes118.exe 30 PID 2272 wrote to memory of 2836 2272 b57c80ff87fa88dd8454c0d5e919aaf9_JaffaCakes118.exe 30 PID 2272 wrote to memory of 2836 2272 b57c80ff87fa88dd8454c0d5e919aaf9_JaffaCakes118.exe 30 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29 PID 2836 wrote to memory of 2272 2836 lwrioy.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\b57c80ff87fa88dd8454c0d5e919aaf9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b57c80ff87fa88dd8454c0d5e919aaf9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\lwrioy.exe"C:\Users\Admin\lwrioy.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5b892db5c45dffa970d7ec5d1ccbd9e1e
SHA1c1f193c4b03cc9196f61842a28a6bb3bbb378263
SHA256e7b3b123f2691ca95ea4e7b128369def43a8189932cd326787186e875ab552ce
SHA512eacbddaeb12fa243d5b812324da3d5382a479b8d8501990eb1b377d1c7ac0ff3b0396c28986a4803e02040f6dd9c9c637e5de56cce63a0666268a85f3200f554