Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08-09-2024 12:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d45c837903e41d734742126e207d5aab_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
d45c837903e41d734742126e207d5aab_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
d45c837903e41d734742126e207d5aab_JaffaCakes118.exe
-
Size
104KB
-
MD5
d45c837903e41d734742126e207d5aab
-
SHA1
ae927d7a2378f0e6549b25a86a6505d807655e0a
-
SHA256
76b287087874adc8cbe231f695574a33166e5437b01643f85ff897380e4d160b
-
SHA512
c9fea6bc1f22fcb3a81abb5d3577f1f60fe9b540dc6be939de40d27c3b9ca407b1f211e44d34198bb7a41f21f30e32c16b274037f3e0dcf089d20b970b80ed52
-
SSDEEP
1536:K24imNbbAJ8xxp+pofZ71TDdxqh5c2+JTlD/5QOuqXRRRyRAR/RwRzyYWkMktgFI:RmK+5+pMI7cv776qL0oDc
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" neaaye.exe -
Executes dropped EXE 1 IoCs
pid Process 2352 neaaye.exe -
Loads dropped DLL 2 IoCs
pid Process 620 d45c837903e41d734742126e207d5aab_JaffaCakes118.exe 620 d45c837903e41d734742126e207d5aab_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /O" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /t" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /Q" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /F" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /V" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /o" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /d" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /S" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /l" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /Y" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /J" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /M" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /n" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /Z" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /x" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /f" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /a" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /y" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /m" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /R" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /H" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /P" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /A" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /U" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /W" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /p" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /w" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /s" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /u" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /h" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /X" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /G" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /T" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /j" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /q" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /I" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /b" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /D" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /i" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /e" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /z" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /g" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /B" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /v" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /E" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /C" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /k" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /N" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /K" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /L" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /c" neaaye.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\neaaye = "C:\\Users\\Admin\\neaaye.exe /r" neaaye.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d45c837903e41d734742126e207d5aab_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language neaaye.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe 2352 neaaye.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 620 d45c837903e41d734742126e207d5aab_JaffaCakes118.exe 2352 neaaye.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 620 wrote to memory of 2352 620 d45c837903e41d734742126e207d5aab_JaffaCakes118.exe 30 PID 620 wrote to memory of 2352 620 d45c837903e41d734742126e207d5aab_JaffaCakes118.exe 30 PID 620 wrote to memory of 2352 620 d45c837903e41d734742126e207d5aab_JaffaCakes118.exe 30 PID 620 wrote to memory of 2352 620 d45c837903e41d734742126e207d5aab_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\d45c837903e41d734742126e207d5aab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d45c837903e41d734742126e207d5aab_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\neaaye.exe"C:\Users\Admin\neaaye.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2352
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
MD5e39c06342ea33866aee0aed952de8e99
SHA1bedb7b09af4a001ccc39fa8a9976e30190ae3bf8
SHA2563b37b6210fcc54adccc2b185a58026179db1f14038d45e41715abebec4e625e8
SHA512a7181b45e276b569c1f1cb22db49dd4e1220b131a9fed411c00bbc95db90bf35d10d56f108f6f8178c51cef36dbe89502b6741cfcf1476b9eccf4e7f40af8e3a