Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 15:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d4aaa92803f68fef24795b7142d06eb4_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
d4aaa92803f68fef24795b7142d06eb4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
d4aaa92803f68fef24795b7142d06eb4_JaffaCakes118.exe
-
Size
100KB
-
MD5
d4aaa92803f68fef24795b7142d06eb4
-
SHA1
e11ce01563acbb49b7ee8c5c957649d0bae66d0f
-
SHA256
215affd70a67a05c8f7211099490f42b3a7aeb82e6184d69f218a59cda7341b7
-
SHA512
8da09b6618ebec66c38b82de733c5c3b47cd61142bcb3b3931a9f2e3f77a37c6d8043be1b15e2565db853f25851933a84ed2128b118b9157d57ad31e13855121
-
SSDEEP
1536:33tGK82NTzwciMGAc4ohrPXo+73Rez8b0Sy2NIjnZMd:NwclurPX7C2Cned
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d4aaa92803f68fef24795b7142d06eb4_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" mbven.exe -
Executes dropped EXE 1 IoCs
pid Process 2812 mbven.exe -
Loads dropped DLL 2 IoCs
pid Process 2664 d4aaa92803f68fef24795b7142d06eb4_JaffaCakes118.exe 2664 d4aaa92803f68fef24795b7142d06eb4_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /m" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /o" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /Z" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /t" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /q" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /p" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /b" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /L" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /w" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /A" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /f" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /X" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /u" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /J" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /Q" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /n" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /g" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /T" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /x" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /B" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /M" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /s" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /N" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /y" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /H" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /F" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /l" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /O" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /z" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /v" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /e" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /E" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /R" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /K" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /h" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /j" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /Y" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /k" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /S" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /C" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /a" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /I" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /P" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /W" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /d" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /G" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /i" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /U" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /L" d4aaa92803f68fef24795b7142d06eb4_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /D" mbven.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\mbven = "C:\\Users\\Admin\\mbven.exe /c" mbven.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d4aaa92803f68fef24795b7142d06eb4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mbven.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2664 d4aaa92803f68fef24795b7142d06eb4_JaffaCakes118.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe 2812 mbven.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2664 d4aaa92803f68fef24795b7142d06eb4_JaffaCakes118.exe 2812 mbven.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2812 2664 d4aaa92803f68fef24795b7142d06eb4_JaffaCakes118.exe 30 PID 2664 wrote to memory of 2812 2664 d4aaa92803f68fef24795b7142d06eb4_JaffaCakes118.exe 30 PID 2664 wrote to memory of 2812 2664 d4aaa92803f68fef24795b7142d06eb4_JaffaCakes118.exe 30 PID 2664 wrote to memory of 2812 2664 d4aaa92803f68fef24795b7142d06eb4_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4aaa92803f68fef24795b7142d06eb4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d4aaa92803f68fef24795b7142d06eb4_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\mbven.exe"C:\Users\Admin\mbven.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2812
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5ab0083fa394402b797cef50eaaee540e
SHA19fb8766f398075b55d6d398dda715b7b9b79c9d8
SHA2569aebcc0a278d132bdc22a92e2386a96860055df27538bd8733a3d6c4f2936388
SHA51260573d6eb1c4468b9d6f43bbdfd387911ea2bc3f7c0ad13342ad7219d828b8d66b46926f2bdbd10d64a2741b56f51436246ea0e1fec3a2044c04865bf26f26ae