Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/09/2024, 05:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe
-
Size
152KB
-
MD5
ecf872145315b86a86d93f98ab852f9c
-
SHA1
efe194472d4cb773d0001c2f04daffa6ee79486a
-
SHA256
f0ec15220164af0d0eec9b4fd1044ae4592e32746071275bd94c99b1ccc58d89
-
SHA512
5985c212f6e279a9b3549e335d8433b961dce3771e73c6d38c0aa96423d8591915e89bfc8468a8d3f93c650fb686cfaa4c14bd4a2cb459af72357985998fa84d
-
SSDEEP
3072:15EGIHCzwrCaHHvhtbz0wXtV2eZDEUXni7fo7KSif8xWM33r3k1jTCZX+E5j4oQ:MG+CzwrCW/0AHa8nuo7KSif8xWM33r3B
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" goeib.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1616 goeib.exe -
Loads dropped DLL 2 IoCs
pid Process 2368 ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe 2368 ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /Y" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /y" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /S" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /l" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /r" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /H" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /j" ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /q" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /B" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /s" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /k" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /j" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /P" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /E" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /p" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /I" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /A" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /D" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /u" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /G" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /F" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /c" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /f" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /g" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /v" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /X" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /x" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /N" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /m" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /O" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /U" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /K" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /V" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /t" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /M" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /o" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /R" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /i" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /b" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /e" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /z" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /Z" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /d" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /J" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /C" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /Q" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /n" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /L" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /a" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /w" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /T" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /h" goeib.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\goeib = "C:\\Users\\Admin\\goeib.exe /W" goeib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language goeib.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2368 ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe 1616 goeib.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2368 ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe 1616 goeib.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1616 2368 ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe 30 PID 2368 wrote to memory of 1616 2368 ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe 30 PID 2368 wrote to memory of 1616 2368 ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe 30 PID 2368 wrote to memory of 1616 2368 ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ecf872145315b86a86d93f98ab852f9c_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\goeib.exe"C:\Users\Admin\goeib.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1616
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
MD5b82a42a581c0a04cbc4b4cd1f20b46e7
SHA17f16bef57dc01eb88c68bcb68085ae0a13d10547
SHA2560b8becd3b0fb5177ba1a80052b7d260af791111c7abadc7ee2cd2c0252c88c8a
SHA51261bec1dd13c8702c7130d537715df752bc5d7768272f06d8373bbcac49fdb991f16503f26b5d1c4b4093e765bb5e820e6070b21d910904964055932136584712