Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-09-2024 08:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe
-
Size
124KB
-
MD5
fa1046c72dcdee73813acebf3fed9926
-
SHA1
deb9db098512d200f78f05997945dadbccdd9adc
-
SHA256
057281d1d5b33a0f0c43c8ca4b9da8469e70221526f5460c7f3b05f2af485244
-
SHA512
adc5f6bf3c42fbbc124f179ff386608b64d9bc09b36cf4e69fafb7651eb511c1f67e53ced62570e3d73b64eb5f0dc6ec0f7ec4933ecccc095d06a5e1f8dcdacc
-
SSDEEP
3072:aaAfUEihXRCrQKGcNqnGrD6uvIepyJS6f1qre6:ahfiGrQKGciwQJr
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ftheel.exe -
Executes dropped EXE 1 IoCs
pid Process 2316 ftheel.exe -
Loads dropped DLL 2 IoCs
pid Process 2440 fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe 2440 fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /D" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /a" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /W" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /e" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /T" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /K" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /r" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /y" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /F" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /p" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /H" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /m" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /Z" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /v" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /q" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /t" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /X" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /x" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /c" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /n" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /h" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /f" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /g" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /b" fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /J" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /U" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /d" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /z" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /P" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /O" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /N" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /A" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /E" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /Y" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /w" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /k" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /I" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /R" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /Q" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /L" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /G" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /V" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /S" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /C" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /B" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /b" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /j" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /l" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /M" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /o" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /s" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /i" ftheel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\ftheel = "C:\\Users\\Admin\\ftheel.exe /u" ftheel.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftheel.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2440 fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe 2316 ftheel.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2440 fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe 2316 ftheel.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2316 2440 fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe 30 PID 2440 wrote to memory of 2316 2440 fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe 30 PID 2440 wrote to memory of 2316 2440 fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe 30 PID 2440 wrote to memory of 2316 2440 fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa1046c72dcdee73813acebf3fed9926_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\ftheel.exe"C:\Users\Admin\ftheel.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2316
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD579e156b69312301f8c55010ca17e309e
SHA10659181b7032c74f6bed449c58a97fc9b9072212
SHA256c7e71415730097032e52cb4f23f75aae2056cb7caabdad8584b0302f9c0af044
SHA51249267e8903397d713ce07f8135675b9009dcfea7a2b3fd1aea94bd409b26a8e3e0d90c9b56ddda855d2215682151f37982b8868dcdcc4a1bc0762ae4b09a1f32