c7278ed1ccdbc7bc293e42fce62344e7781dcc9cc8e2dc43f1952e37aec8e65d

Analysis

max time kernel
150s
max time network
52s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d162219755a40ef11be1dca18745998a_JaffaCakes118.exe
Size

100KB
MD5

d162219755a40ef11be1dca18745998a
SHA1

afcdc29779c85b8ea2eb6b4b2b4ddb34b4b4dceb
SHA256

c7278ed1ccdbc7bc293e42fce62344e7781dcc9cc8e2dc43f1952e37aec8e65d
SHA512

e194c5934e66a3e941d4796fce7e3b49569912d7aebc5efd28e8f2c66f83c64cb05a80fd85e2ee8d9f97a7b04d41c1eb2c07cdcfb74bdb186c6ee2f9e7ed386c
SSDEEP

1536:vRtG782NTzw+MGAc4ohrPXo+73Rez8b0Sy2NIjnZMd:ywhurPX7C2Cned

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	saomaut.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	d162219755a40ef11be1dca18745998a_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2760	saomaut.exe

Loads dropped DLL 2 IoCs

pid	Process
1620	d162219755a40ef11be1dca18745998a_JaffaCakes118.exe
1620	d162219755a40ef11be1dca18745998a_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /A"	d162219755a40ef11be1dca18745998a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /g"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /h"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /l"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /a"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /i"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /N"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /R"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /W"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /C"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /q"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /D"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /w"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /S"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /x"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /e"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /U"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /P"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /G"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /z"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /Q"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /p"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /o"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /F"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /K"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /b"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /J"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /Z"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /c"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /t"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /r"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /T"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /Y"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /X"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /B"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /M"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /v"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /u"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /E"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /m"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /f"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /O"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /V"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /A"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /j"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /H"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /d"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /L"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /s"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /I"	saomaut.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\saomaut = "C:\\Users\\Admin\\saomaut.exe /k"	saomaut.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d162219755a40ef11be1dca18745998a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	saomaut.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1620	d162219755a40ef11be1dca18745998a_JaffaCakes118.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe
2760	saomaut.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1620	d162219755a40ef11be1dca18745998a_JaffaCakes118.exe
2760	saomaut.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2760	1620	d162219755a40ef11be1dca18745998a_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2760	1620	d162219755a40ef11be1dca18745998a_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2760	1620	d162219755a40ef11be1dca18745998a_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2760	1620	d162219755a40ef11be1dca18745998a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\d162219755a40ef11be1dca18745998a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d162219755a40ef11be1dca18745998a_JaffaCakes118.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\saomaut.exe
  "C:\Users\Admin\saomaut.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\saomaut.exe

Filesize
100KB

MD5
730752a308ad832b4f1086114110af75

SHA1
4e291675d87e7ebbeffd703977c4600abba089a6

SHA256
ab74809b604768ad63dce17daa918807c7bf49978d0d0438324225817b622a97

SHA512
1361e1c8f05941cc2dd49bf0e38c273d8af0e765d1f2111ff27ab59ba6462bf57e23b8eaf3b89ad467d240fef755e8f2437ec192d860abd04237b821913d267d

Download Submit