Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 04:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0e005a2c54f68ec50c7517d2f817c86a_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
0e005a2c54f68ec50c7517d2f817c86a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
0e005a2c54f68ec50c7517d2f817c86a_JaffaCakes118.exe
-
Size
204KB
-
MD5
0e005a2c54f68ec50c7517d2f817c86a
-
SHA1
d6c1e97d1fb528ded477eaea4338b85baf43503e
-
SHA256
dc164b6d4a6060b31dae0d0fa61e338cd72ea6081a7b1989246c69515847f674
-
SHA512
d341766c3842ae822775a29e6033b6f19283f44e63c1f5cbd2a44719b746a9971b0752f44c887d562addaa60b8cdf71d389df799a42d2a4d633dd5051e0e69a3
-
SSDEEP
3072:3KqiZBXj3pZgjxp8HRfW+Ida220gN4JsBi40BuWNVYrcLwcYieNRrhomiyTfXIK:3RWxDpZgdORfWTmiDBuhTIaxu+7qT
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wiavai.exe -
Executes dropped EXE 1 IoCs
pid Process 2272 wiavai.exe -
Loads dropped DLL 2 IoCs
pid Process 1864 0e005a2c54f68ec50c7517d2f817c86a_JaffaCakes118.exe 1864 0e005a2c54f68ec50c7517d2f817c86a_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /Y" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /D" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /U" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /v" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /z" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /p" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /K" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /L" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /G" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /V" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /l" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /T" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /M" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /e" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /C" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /i" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /A" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /Q" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /b" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /c" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /d" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /J" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /W" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /h" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /E" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /H" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /S" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /t" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /N" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /Z" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /x" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /q" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /O" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /g" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /o" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /s" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /X" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /u" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /w" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /B" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /n" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /y" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /r" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /k" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /I" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /a" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /m" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /R" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /f" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /F" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /j" wiavai.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiavai = "C:\\Users\\Admin\\wiavai.exe /P" wiavai.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0e005a2c54f68ec50c7517d2f817c86a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wiavai.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe 2272 wiavai.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1864 0e005a2c54f68ec50c7517d2f817c86a_JaffaCakes118.exe 2272 wiavai.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1864 wrote to memory of 2272 1864 0e005a2c54f68ec50c7517d2f817c86a_JaffaCakes118.exe 30 PID 1864 wrote to memory of 2272 1864 0e005a2c54f68ec50c7517d2f817c86a_JaffaCakes118.exe 30 PID 1864 wrote to memory of 2272 1864 0e005a2c54f68ec50c7517d2f817c86a_JaffaCakes118.exe 30 PID 1864 wrote to memory of 2272 1864 0e005a2c54f68ec50c7517d2f817c86a_JaffaCakes118.exe 30 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29 PID 2272 wrote to memory of 1864 2272 wiavai.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e005a2c54f68ec50c7517d2f817c86a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0e005a2c54f68ec50c7517d2f817c86a_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\wiavai.exe"C:\Users\Admin\wiavai.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD53603d01bbf3030b8c2805f923ef21589
SHA12d6a54d22d50aebcfd1255c06a2a312f7efc6d9f
SHA2568ce9c6e6a434684da056ed9c97b5b0b4fc530f76fbe67992f7b0e4ad1cd691b7
SHA5121a3b16d285d9e92c6865c41e7df3c40adfade2016aa5d4ade8f757be14392f6bd565b37e9c94b4c395662b422126f052fac3aa84f4a07a4c91bc65513b49b9a1