Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 08:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
baeecd8dbb85e8404551174d331d9d5c_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
baeecd8dbb85e8404551174d331d9d5c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
baeecd8dbb85e8404551174d331d9d5c_JaffaCakes118.exe
-
Size
312KB
-
MD5
baeecd8dbb85e8404551174d331d9d5c
-
SHA1
d8c27362371a5e4cd5b37761b79ecbac42704e19
-
SHA256
1169d496a7c757a2d55dc9246a0cc98ab82b28c41a5c390d994491892e3b128e
-
SHA512
c4710fe85d866f73734f9640be76c7901cf9c1b0d030d0ea3de52387d55b7ed59ba39b35df103dd9df1cca68258394f3815e7201ce4e3a065df874d36c1962d6
-
SSDEEP
6144:1KxLfWxJYw4xusHwsY0sQeDWuPxnyXX7:oLfWxJIAsQsY0qR
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" baeecd8dbb85e8404551174d331d9d5c_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xuanuo.exe -
Executes dropped EXE 1 IoCs
pid Process 2632 xuanuo.exe -
Loads dropped DLL 2 IoCs
pid Process 2756 baeecd8dbb85e8404551174d331d9d5c_JaffaCakes118.exe 2756 baeecd8dbb85e8404551174d331d9d5c_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /c" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /t" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /p" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /e" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /g" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /l" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /q" baeecd8dbb85e8404551174d331d9d5c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /q" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /a" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /m" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /s" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /f" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /z" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /r" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /b" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /w" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /u" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /o" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /v" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /j" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /h" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /d" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /i" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /k" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /n" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /x" xuanuo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuanuo = "C:\\Users\\Admin\\xuanuo.exe /y" xuanuo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language baeecd8dbb85e8404551174d331d9d5c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xuanuo.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2756 baeecd8dbb85e8404551174d331d9d5c_JaffaCakes118.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe 2632 xuanuo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2756 baeecd8dbb85e8404551174d331d9d5c_JaffaCakes118.exe 2632 xuanuo.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2632 2756 baeecd8dbb85e8404551174d331d9d5c_JaffaCakes118.exe 31 PID 2756 wrote to memory of 2632 2756 baeecd8dbb85e8404551174d331d9d5c_JaffaCakes118.exe 31 PID 2756 wrote to memory of 2632 2756 baeecd8dbb85e8404551174d331d9d5c_JaffaCakes118.exe 31 PID 2756 wrote to memory of 2632 2756 baeecd8dbb85e8404551174d331d9d5c_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\baeecd8dbb85e8404551174d331d9d5c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\baeecd8dbb85e8404551174d331d9d5c_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\xuanuo.exe"C:\Users\Admin\xuanuo.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2632
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312KB
MD59ce8d43d4b77154f6949942aada42397
SHA1d9e49dfbf212621aa216e7ee8c05dd553511f52e
SHA256cef93427be35039f0f5493bc0ffdc0edd1faf767c2bd796fe9fa4abf4d415c57
SHA5122914c30115291a4973d837674370ef40e8a60951a2b5a484b4660f7f8fcd05b16cd493267e4ee8885384069b542268cbf1b16f54a49aa16543031e1d0e358214