Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 21:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd43b41ba8f7d9d19a11f3119cb02831_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
bd43b41ba8f7d9d19a11f3119cb02831_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
bd43b41ba8f7d9d19a11f3119cb02831_JaffaCakes118.exe
-
Size
296KB
-
MD5
bd43b41ba8f7d9d19a11f3119cb02831
-
SHA1
bed9e760aad4d4e70366b22ef8575da2658e4e70
-
SHA256
4024432aeb47c9710db176209288e6926d2473569f2479b197c588dd82902eb3
-
SHA512
4e907e2650317d6b0f8a13f697d3745022073b43a1c89a9d7dc2d791f3bd80071a47689b1858b0c9aa95383e881ecba20772a12e739967d3d1b22dd3bba3158a
-
SSDEEP
3072:Ie6eHDjzh7sAFEouHwbBAW4hXNzcd6HFfak/K4jaU3bxT2Hb:I9cjz/FEouH+BAi4HFfAgLpg
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bd43b41ba8f7d9d19a11f3119cb02831_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cfgaid.exe -
Executes dropped EXE 1 IoCs
pid Process 2784 cfgaid.exe -
Loads dropped DLL 2 IoCs
pid Process 2296 bd43b41ba8f7d9d19a11f3119cb02831_JaffaCakes118.exe 2296 bd43b41ba8f7d9d19a11f3119cb02831_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /h" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /z" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /R" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /P" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /W" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /I" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /s" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /X" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /k" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /J" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /V" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /K" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /r" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /u" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /F" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /i" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /D" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /Q" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /U" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /n" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /T" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /o" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /B" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /M" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /E" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /x" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /G" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /b" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /Y" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /w" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /y" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /j" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /f" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /d" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /O" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /e" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /L" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /t" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /g" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /C" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /v" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /l" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /m" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /a" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /p" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /H" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /c" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /A" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /q" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /z" bd43b41ba8f7d9d19a11f3119cb02831_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /N" cfgaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\cfgaid = "C:\\Users\\Admin\\cfgaid.exe /Z" cfgaid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd43b41ba8f7d9d19a11f3119cb02831_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cfgaid.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2296 bd43b41ba8f7d9d19a11f3119cb02831_JaffaCakes118.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe 2784 cfgaid.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2296 bd43b41ba8f7d9d19a11f3119cb02831_JaffaCakes118.exe 2784 cfgaid.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2784 2296 bd43b41ba8f7d9d19a11f3119cb02831_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2784 2296 bd43b41ba8f7d9d19a11f3119cb02831_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2784 2296 bd43b41ba8f7d9d19a11f3119cb02831_JaffaCakes118.exe 30 PID 2296 wrote to memory of 2784 2296 bd43b41ba8f7d9d19a11f3119cb02831_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd43b41ba8f7d9d19a11f3119cb02831_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd43b41ba8f7d9d19a11f3119cb02831_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\cfgaid.exe"C:\Users\Admin\cfgaid.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2784
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
MD5708119efe6a65453cfecb4c72407dfde
SHA126c4a6a18825203d124eaef2c3af7bfb32e6c4ae
SHA256ed4ed58092aed5838cce01681d513a2a2b83a1e9f88768cf43520f8ff9657ebe
SHA5129123cf1c85157f7d23eee0b63db980d67eee66d92c0e7169fbe2d64f0ae677114b25c48c40a3b7803fb230917a5714719e847447c97a9041de49b83fa7a9bcb9