Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
29-08-2024 09:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c88fb89b8455a826739f53e99059beca_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
c88fb89b8455a826739f53e99059beca_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
c88fb89b8455a826739f53e99059beca_JaffaCakes118.exe
-
Size
264KB
-
MD5
c88fb89b8455a826739f53e99059beca
-
SHA1
f05a067c69c0ccae9446c0a286840c588702b467
-
SHA256
6fa4adb8d33792be154e743cdf5b14a02ff839763b740a027e6926998164e1e7
-
SHA512
726e4fd76836b03c8ba78d377a6005ea7aa89b3b76e199a9b64874a3159468df73ccaf4cfead45a4fc7bd35b39d3e90598c709587efe0d8509407ecd2d0f98f6
-
SSDEEP
3072:1wwQcqsO9Gl2IDyG2pfr4GNLzECcKIvMBSYWunCvPQiwhjXH1hkaBx5/lvnjLYad:awQ3sO9C9Ic6OLynWunzXH1l9r3
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" c88fb89b8455a826739f53e99059beca_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lvhait.exe -
Executes dropped EXE 1 IoCs
pid Process 2688 lvhait.exe -
Loads dropped DLL 2 IoCs
pid Process 2360 c88fb89b8455a826739f53e99059beca_JaffaCakes118.exe 2360 c88fb89b8455a826739f53e99059beca_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /p" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /E" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /C" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /x" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /u" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /i" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /D" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /J" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /s" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /a" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /k" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /K" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /f" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /o" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /n" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /Q" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /G" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /F" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /b" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /q" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /X" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /g" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /l" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /V" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /U" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /H" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /R" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /v" c88fb89b8455a826739f53e99059beca_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /T" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /P" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /j" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /N" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /v" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /Y" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /O" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /t" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /I" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /S" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /B" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /e" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /c" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /m" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /A" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /y" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /W" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /w" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /h" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /z" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /Z" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /L" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /r" lvhait.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\lvhait = "C:\\Users\\Admin\\lvhait.exe /M" lvhait.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvhait.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c88fb89b8455a826739f53e99059beca_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2360 c88fb89b8455a826739f53e99059beca_JaffaCakes118.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe 2688 lvhait.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2360 c88fb89b8455a826739f53e99059beca_JaffaCakes118.exe 2688 lvhait.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2688 2360 c88fb89b8455a826739f53e99059beca_JaffaCakes118.exe 30 PID 2360 wrote to memory of 2688 2360 c88fb89b8455a826739f53e99059beca_JaffaCakes118.exe 30 PID 2360 wrote to memory of 2688 2360 c88fb89b8455a826739f53e99059beca_JaffaCakes118.exe 30 PID 2360 wrote to memory of 2688 2360 c88fb89b8455a826739f53e99059beca_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\c88fb89b8455a826739f53e99059beca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c88fb89b8455a826739f53e99059beca_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\lvhait.exe"C:\Users\Admin\lvhait.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5629f7ce4caf69380a479a97f4e28dd9f
SHA1fde9c8c3573a538ad67029a258b19271e1edefc6
SHA25689d0e6c8a627a22690868a13c1a557d2fcfe5b11a4e388e4f2fdc57f837a57b3
SHA5129bd0fa8c03b78710f22ec67b777420fcfaae48f134d6702281fd17f10feda72c6c6d89cadadd7cac5654fb2ab9857b9100fefa1286684fc0dd085c302e4c2c62