Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/09/2024, 22:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ee8bf4756912e005f35770f9b1190415_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
ee8bf4756912e005f35770f9b1190415_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
ee8bf4756912e005f35770f9b1190415_JaffaCakes118.exe
-
Size
192KB
-
MD5
ee8bf4756912e005f35770f9b1190415
-
SHA1
a7a8343c625d780a02684dc09a2d160388685d5c
-
SHA256
437df2518f7916d4e8d0bddfbc9355a2696141da03d0a442305cb2825bd39ab4
-
SHA512
30f23b4a3aef4aecede9a0c94198fc993ac1da10730c055d803979243ca7baa6e6abddf6a75702157d5cdef8881b57dc07fca43ae7e02644b6a4edaffad8a266
-
SSDEEP
3072:FebBQpjJUhfykwxvGQHhTiZemK/fObT/bGiU7dCyUHb9rXDdcNlXvB:8NOJUARhKK/fObT/bGiUJCyMrXDdcp
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ee8bf4756912e005f35770f9b1190415_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vphoaj.exe -
Executes dropped EXE 1 IoCs
pid Process 2320 vphoaj.exe -
Loads dropped DLL 2 IoCs
pid Process 2404 ee8bf4756912e005f35770f9b1190415_JaffaCakes118.exe 2404 ee8bf4756912e005f35770f9b1190415_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /I" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /l" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /u" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /Q" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /Z" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /h" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /D" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /f" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /a" ee8bf4756912e005f35770f9b1190415_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /V" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /T" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /L" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /Y" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /n" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /R" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /O" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /x" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /S" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /i" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /B" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /b" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /e" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /o" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /z" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /m" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /P" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /t" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /d" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /j" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /F" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /U" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /N" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /M" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /s" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /y" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /H" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /a" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /W" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /v" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /J" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /g" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /E" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /w" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /X" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /r" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /q" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /k" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /c" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /A" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /G" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /p" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /C" vphoaj.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\vphoaj = "C:\\Users\\Admin\\vphoaj.exe /K" vphoaj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee8bf4756912e005f35770f9b1190415_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vphoaj.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2404 ee8bf4756912e005f35770f9b1190415_JaffaCakes118.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe 2320 vphoaj.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2404 ee8bf4756912e005f35770f9b1190415_JaffaCakes118.exe 2320 vphoaj.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2320 2404 ee8bf4756912e005f35770f9b1190415_JaffaCakes118.exe 30 PID 2404 wrote to memory of 2320 2404 ee8bf4756912e005f35770f9b1190415_JaffaCakes118.exe 30 PID 2404 wrote to memory of 2320 2404 ee8bf4756912e005f35770f9b1190415_JaffaCakes118.exe 30 PID 2404 wrote to memory of 2320 2404 ee8bf4756912e005f35770f9b1190415_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee8bf4756912e005f35770f9b1190415_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee8bf4756912e005f35770f9b1190415_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\vphoaj.exe"C:\Users\Admin\vphoaj.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2320
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD560ffe3b48c6ced9f55a68f0d51e8f37c
SHA16c8a822962e0336a82f815989abc2bda8a23e746
SHA25677f3ef9a525177b8cb376a934f30133d0604fbecd62e4e53ece85660ea630c50
SHA51258ec92523dd2ae5ecb2f15ec81faba2a42593d200c814c329135ff0a88a0b0f9d7fd6017ea7753e364534c23e63a81a20a0780c1b3e19eaabfb61b2d0cc78300