Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-09-2024 07:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fe171ec6e450685dc3dbfeff07d4c5bb_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
fe171ec6e450685dc3dbfeff07d4c5bb_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
fe171ec6e450685dc3dbfeff07d4c5bb_JaffaCakes118.exe
-
Size
204KB
-
MD5
fe171ec6e450685dc3dbfeff07d4c5bb
-
SHA1
5646aed2fb5fc340f8a707cfdbf67e3eea623816
-
SHA256
76c5edae3fc7730c6e9c86a24e170a93a0fefd32e40ab4bf13c0cfafad99e0f2
-
SHA512
fb32215a57a8467997d1b49e2c85cfb0ee7b8f0ab61bf4b55d722888a911c3f1f07478f76af28e25ccb126a8b407f64df53d483dfa902911d7d6bb72ac74ccdb
-
SSDEEP
3072:jmRW82E0tQ9nLHbB9W0c1TqECzR/mkSYGrl9ymgYUWoG:CAg4QxL7B9W0c1RCzR/fSmljG
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fe171ec6e450685dc3dbfeff07d4c5bb_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" veoif.exe -
Executes dropped EXE 1 IoCs
pid Process 2012 veoif.exe -
Loads dropped DLL 2 IoCs
pid Process 2016 fe171ec6e450685dc3dbfeff07d4c5bb_JaffaCakes118.exe 2016 fe171ec6e450685dc3dbfeff07d4c5bb_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /q" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /l" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /q" fe171ec6e450685dc3dbfeff07d4c5bb_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /r" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /p" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /a" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /n" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /d" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /w" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /j" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /o" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /k" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /x" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /e" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /v" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /y" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /t" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /h" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /s" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /c" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /b" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /f" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /u" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /i" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /m" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /z" veoif.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\veoif = "C:\\Users\\Admin\\veoif.exe /g" veoif.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fe171ec6e450685dc3dbfeff07d4c5bb_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language veoif.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2016 fe171ec6e450685dc3dbfeff07d4c5bb_JaffaCakes118.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe 2012 veoif.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2016 fe171ec6e450685dc3dbfeff07d4c5bb_JaffaCakes118.exe 2012 veoif.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2012 2016 fe171ec6e450685dc3dbfeff07d4c5bb_JaffaCakes118.exe 31 PID 2016 wrote to memory of 2012 2016 fe171ec6e450685dc3dbfeff07d4c5bb_JaffaCakes118.exe 31 PID 2016 wrote to memory of 2012 2016 fe171ec6e450685dc3dbfeff07d4c5bb_JaffaCakes118.exe 31 PID 2016 wrote to memory of 2012 2016 fe171ec6e450685dc3dbfeff07d4c5bb_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe171ec6e450685dc3dbfeff07d4c5bb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fe171ec6e450685dc3dbfeff07d4c5bb_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\veoif.exe"C:\Users\Admin\veoif.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2012
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD5d2dfbc74839e0519a7b510a83f8f0e7a
SHA11d1e2f368e47ea5c61d84fe089a88c425b8cff77
SHA256e060932fd38ecb3d0ea46ab25bbd5e2e6bafacb7ee9a8700442ae2bf12b90d02
SHA512f2748b5b2a737ef16658338ea31c7905e746268362544a0c0faa125852a1b9ced6236db784819b57eae8fc83821f40c76b43162a4f9ce44719cfe308aff82836