Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 08:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cf190e0665164c14ee6d90fd58f0c932_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
cf190e0665164c14ee6d90fd58f0c932_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
cf190e0665164c14ee6d90fd58f0c932_JaffaCakes118.exe
-
Size
336KB
-
MD5
cf190e0665164c14ee6d90fd58f0c932
-
SHA1
d31fcf9675cc5d17f3a05eab8fd9923f604707b3
-
SHA256
4acc5ec31557960785c31a501ad7ac54b9f421668281a39db09a6bea4372e6ed
-
SHA512
dfbb3252b4abed672e603683a0169d64accafadccba37438645d8101062f1a419fed84a2746a94b395c1fcce1e35f585304d2e35d07cf56633f5b9ed2fa4c1bd
-
SSDEEP
3072:4pmfpBtQGCltUWrEpmpXzKmpXzR84nDVkj4C2lXRWMvaTv/0qAdf564HVCE5j4oQ:48fpYGCleWBpDC2dRITv/HAf5N5d
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cf190e0665164c14ee6d90fd58f0c932_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" keeaji.exe -
Executes dropped EXE 1 IoCs
pid Process 2596 keeaji.exe -
Loads dropped DLL 2 IoCs
pid Process 2908 cf190e0665164c14ee6d90fd58f0c932_JaffaCakes118.exe 2908 cf190e0665164c14ee6d90fd58f0c932_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /v" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /X" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /b" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /u" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /E" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /c" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /D" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /U" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /z" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /e" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /P" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /V" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /H" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /G" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /f" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /s" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /Q" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /l" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /K" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /M" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /S" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /Z" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /I" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /T" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /x" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /O" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /a" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /C" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /t" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /A" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /Y" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /y" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /F" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /k" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /p" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /W" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /w" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /i" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /r" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /d" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /J" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /L" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /o" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /B" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /p" cf190e0665164c14ee6d90fd58f0c932_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /j" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /n" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /h" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /q" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /R" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /m" keeaji.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeaji = "C:\\Users\\Admin\\keeaji.exe /g" keeaji.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf190e0665164c14ee6d90fd58f0c932_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language keeaji.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2908 cf190e0665164c14ee6d90fd58f0c932_JaffaCakes118.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe 2596 keeaji.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2908 cf190e0665164c14ee6d90fd58f0c932_JaffaCakes118.exe 2596 keeaji.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2596 2908 cf190e0665164c14ee6d90fd58f0c932_JaffaCakes118.exe 30 PID 2908 wrote to memory of 2596 2908 cf190e0665164c14ee6d90fd58f0c932_JaffaCakes118.exe 30 PID 2908 wrote to memory of 2596 2908 cf190e0665164c14ee6d90fd58f0c932_JaffaCakes118.exe 30 PID 2908 wrote to memory of 2596 2908 cf190e0665164c14ee6d90fd58f0c932_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf190e0665164c14ee6d90fd58f0c932_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cf190e0665164c14ee6d90fd58f0c932_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\keeaji.exe"C:\Users\Admin\keeaji.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2596
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
336KB
MD5f2c4a7135221b108c55616997dacd7a9
SHA159ee1e24df23853143c7647d13d5d5b2d66f0199
SHA256ee72f03c0521fc520d84abdb88effa148bf7658ce943607472c85a1e69681ec7
SHA5129ca8023f7ed215bb2380d92e6c4c59bf467cfee39f2d5fe5246d65963432b9d1527f419953bfff2deeacc09a220068cea007f83b921269a39e9cefdf85b00445