Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-09-2024 19:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e9d8a4df70e7573d170e7ea4a2c1e444_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
e9d8a4df70e7573d170e7ea4a2c1e444_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
e9d8a4df70e7573d170e7ea4a2c1e444_JaffaCakes118.exe
-
Size
152KB
-
MD5
e9d8a4df70e7573d170e7ea4a2c1e444
-
SHA1
cb26f1f2773278758ef0b876a41a59b5b9fc4d31
-
SHA256
f9d5f74c144b33ee119e872309171322eb9eb11b6d476199bfd99713d09b0248
-
SHA512
2451eb3411b20082a502384df7098390bbe5eb49bd374481140c61391050d5f1df5b3dca4a630dcc02ff5e18b17bff2463aa61c95b96b35b49e365b2149e8d35
-
SSDEEP
3072:8mlJPTYhjIRw+7MxJUbaxI3zQyzLBuT+Fol:E+7Mxa0yz2l
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" e9d8a4df70e7573d170e7ea4a2c1e444_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" boeigiw.exe -
Executes dropped EXE 1 IoCs
pid Process 2564 boeigiw.exe -
Loads dropped DLL 2 IoCs
pid Process 2736 e9d8a4df70e7573d170e7ea4a2c1e444_JaffaCakes118.exe 2736 e9d8a4df70e7573d170e7ea4a2c1e444_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /q" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /I" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /H" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /r" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /u" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /p" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /f" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /l" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /y" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /K" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /B" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /a" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /i" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /o" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /J" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /F" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /m" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /T" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /n" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /E" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /U" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /P" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /b" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /D" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /Z" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /Q" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /A" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /k" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /X" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /c" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /C" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /v" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /s" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /M" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /L" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /O" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /h" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /e" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /w" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /x" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /V" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /G" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /g" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /W" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /j" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /b" e9d8a4df70e7573d170e7ea4a2c1e444_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /z" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /S" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /N" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /R" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /Y" boeigiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\boeigiw = "C:\\Users\\Admin\\boeigiw.exe /d" boeigiw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language boeigiw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e9d8a4df70e7573d170e7ea4a2c1e444_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2736 e9d8a4df70e7573d170e7ea4a2c1e444_JaffaCakes118.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe 2564 boeigiw.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2736 e9d8a4df70e7573d170e7ea4a2c1e444_JaffaCakes118.exe 2564 boeigiw.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2736 wrote to memory of 2564 2736 e9d8a4df70e7573d170e7ea4a2c1e444_JaffaCakes118.exe 28 PID 2736 wrote to memory of 2564 2736 e9d8a4df70e7573d170e7ea4a2c1e444_JaffaCakes118.exe 28 PID 2736 wrote to memory of 2564 2736 e9d8a4df70e7573d170e7ea4a2c1e444_JaffaCakes118.exe 28 PID 2736 wrote to memory of 2564 2736 e9d8a4df70e7573d170e7ea4a2c1e444_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9d8a4df70e7573d170e7ea4a2c1e444_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e9d8a4df70e7573d170e7ea4a2c1e444_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\boeigiw.exe"C:\Users\Admin\boeigiw.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
MD5eae02b637e491a5dff99cbc76b000c07
SHA17e6be9617c564d84865566e461bb66679fea2aad
SHA25670f129a68ecb504780d65f555a7dd61aca76c6287193346fac2222b19fd20bf5
SHA5122305adfca4d0c7555f5d13cca4ad66ec1572e92cf6f4214e9f4325c317db4d46b6f8bd683afa559aefab314b1331be22ee3553e9e4fd59384ae9d1246047cb54