Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 02:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d3494cccedb2b283d4132c1037072ab2_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
d3494cccedb2b283d4132c1037072ab2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
d3494cccedb2b283d4132c1037072ab2_JaffaCakes118.exe
-
Size
176KB
-
MD5
d3494cccedb2b283d4132c1037072ab2
-
SHA1
24636a60c4c1aded80cfd26587ddd07f17c20e34
-
SHA256
9ba418c9ff4574a5b61cfe3f1601445db87a0d6e993b2f553d03b7a27cb43721
-
SHA512
e6394b4e3cc041118d2756e066825b3fd1b24fec3567a0b4cd0099a75aa3310d6cfea5dc633e885d9c0d283230a59913ba7ea5b492f38e6f6782fc0298cecb1e
-
SSDEEP
3072:qzpUOUP8b8RuBnI16UCceGyYyKnvmb7/D26VNr79JEx/G/OOIVLM/tAGjiBuAZdW:8RUkwuBnI16ZoGKnvmb7/D26P/9JEx/s
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d3494cccedb2b283d4132c1037072ab2_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hxrep.exe -
Executes dropped EXE 1 IoCs
pid Process 2572 hxrep.exe -
Loads dropped DLL 2 IoCs
pid Process 2396 d3494cccedb2b283d4132c1037072ab2_JaffaCakes118.exe 2396 d3494cccedb2b283d4132c1037072ab2_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /q" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /e" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /u" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /O" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /h" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /J" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /n" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /N" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /W" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /f" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /y" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /L" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /A" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /S" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /g" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /U" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /I" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /E" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /b" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /B" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /i" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /l" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /K" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /s" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /t" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /H" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /Y" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /j" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /Q" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /c" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /p" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /a" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /m" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /R" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /D" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /T" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /r" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /k" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /z" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /d" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /v" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /V" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /b" d3494cccedb2b283d4132c1037072ab2_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /P" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /C" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /o" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /G" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /X" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /F" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /M" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /Z" hxrep.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\hxrep = "C:\\Users\\Admin\\hxrep.exe /x" hxrep.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxrep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d3494cccedb2b283d4132c1037072ab2_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2396 d3494cccedb2b283d4132c1037072ab2_JaffaCakes118.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe 2572 hxrep.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2396 d3494cccedb2b283d4132c1037072ab2_JaffaCakes118.exe 2572 hxrep.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2572 2396 d3494cccedb2b283d4132c1037072ab2_JaffaCakes118.exe 30 PID 2396 wrote to memory of 2572 2396 d3494cccedb2b283d4132c1037072ab2_JaffaCakes118.exe 30 PID 2396 wrote to memory of 2572 2396 d3494cccedb2b283d4132c1037072ab2_JaffaCakes118.exe 30 PID 2396 wrote to memory of 2572 2396 d3494cccedb2b283d4132c1037072ab2_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3494cccedb2b283d4132c1037072ab2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d3494cccedb2b283d4132c1037072ab2_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\hxrep.exe"C:\Users\Admin\hxrep.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2572
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
MD53b0ab42deeef53ef09416d3c0f867881
SHA113eead0559205c9137598976ecbd3aa6949e3998
SHA256d8e3e1f442569c9541e61d29a1d231598007dbb1e029693997dc14ad708539ee
SHA5127f82e4baf493c9d61e7b9c0675c547ad1a0252588d46b9d9b7f443229e79238cada3533104f3b27eb6447ec1bbeb1966a798ba971add8d984f291a34674c3c28