Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25-08-2024 01:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe
-
Size
156KB
-
MD5
bfd3defede8466d96d406e57cb6a1da8
-
SHA1
3776ff7292276ce1f2077239afd6bcac07f0b649
-
SHA256
9fdaca6686fc5a06bffe629900ef0a79bd0eb5e5da2126d5b6df6c7bf1cca61f
-
SHA512
08d1868bde3589b616c2127369c7305647fc05fb088116bd958b49451bf2aee85f3873ea6cee7951be09faf360a109c9be6f5224ff471ab43662374c756a44de
-
SSDEEP
3072:kUf172L2wmM39vJhjmRMKGOMztubDqrmhX1yjdLiXE5j4oQJ:Bt22wmMtRfXZm1gpZd
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" duijau.exe -
Executes dropped EXE 1 IoCs
pid Process 2948 duijau.exe -
Loads dropped DLL 2 IoCs
pid Process 1052 bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe 1052 bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /F" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /a" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /x" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /I" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /Q" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /z" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /C" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /e" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /W" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /X" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /J" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /K" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /Z" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /b" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /o" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /s" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /D" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /T" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /g" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /r" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /U" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /G" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /R" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /l" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /w" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /P" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /f" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /N" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /q" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /k" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /L" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /M" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /O" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /n" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /A" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /p" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /h" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /d" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /i" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /j" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /V" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /c" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /m" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /E" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /v" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /u" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /y" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /Z" bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /B" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /H" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /t" duijau.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\duijau = "C:\\Users\\Admin\\duijau.exe /S" duijau.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language duijau.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1052 bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe 2948 duijau.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1052 bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe 2948 duijau.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1052 wrote to memory of 2948 1052 bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe 30 PID 1052 wrote to memory of 2948 1052 bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe 30 PID 1052 wrote to memory of 2948 1052 bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe 30 PID 1052 wrote to memory of 2948 1052 bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bfd3defede8466d96d406e57cb6a1da8_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\duijau.exe"C:\Users\Admin\duijau.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2948
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD58a96ef35cb23ca211cd84588ed1cc0c8
SHA158cc1151abc550e50df6069a5f471b35b37ed4ac
SHA256bc80defbee2ba30d0d9a8c4f2fa82ae99c2e5c32d750d3db88e8915e3a8b86be
SHA512bad87e7ae5e31a3be1f6948a646a672bbe8006794d9aa112447c59e6ff9106c1a082ded637ab936edf657808a4668558c379582a5eaf5d419352fe19b8d93c6e