Analysis
-
max time kernel
149s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
04-10-2024 06:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1243606b8fd6fd0c8f953fcb63f0f732_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
1243606b8fd6fd0c8f953fcb63f0f732_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
1243606b8fd6fd0c8f953fcb63f0f732_JaffaCakes118.exe
-
Size
232KB
-
MD5
1243606b8fd6fd0c8f953fcb63f0f732
-
SHA1
35a45fb60801022c50515e5d0ee11ba5fd292f4f
-
SHA256
089d7ce9b5c1ed4f128a58f0b396c1bab60e60cddc232fbddc0535591fdc9bf1
-
SHA512
90d222df818802216d2e16a25e439c28777b1fbb33fd1011527c4f11d002567ada5b4fc0b94ae3dd47608149db2cd74ae1b0ae5a89c2501576d8b5d740fd56f7
-
SSDEEP
6144:Qh3PFKs7diixRSFBfWEqxF6snji81RUinK51jbkxkubS/:yPhJuBXVbkxJbC
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" viuaki.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1243606b8fd6fd0c8f953fcb63f0f732_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1192 viuaki.exe -
Loads dropped DLL 2 IoCs
pid Process 588 1243606b8fd6fd0c8f953fcb63f0f732_JaffaCakes118.exe 588 1243606b8fd6fd0c8f953fcb63f0f732_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /p" 1243606b8fd6fd0c8f953fcb63f0f732_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /z" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /s" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /h" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /m" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /d" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /e" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /q" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /t" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /p" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /g" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /i" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /j" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /k" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /u" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /c" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /o" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /f" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /v" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /y" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /b" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /a" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /x" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /r" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /w" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /l" viuaki.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\viuaki = "C:\\Users\\Admin\\viuaki.exe /n" viuaki.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1243606b8fd6fd0c8f953fcb63f0f732_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language viuaki.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 588 1243606b8fd6fd0c8f953fcb63f0f732_JaffaCakes118.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe 1192 viuaki.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 588 1243606b8fd6fd0c8f953fcb63f0f732_JaffaCakes118.exe 1192 viuaki.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 588 wrote to memory of 1192 588 1243606b8fd6fd0c8f953fcb63f0f732_JaffaCakes118.exe 29 PID 588 wrote to memory of 1192 588 1243606b8fd6fd0c8f953fcb63f0f732_JaffaCakes118.exe 29 PID 588 wrote to memory of 1192 588 1243606b8fd6fd0c8f953fcb63f0f732_JaffaCakes118.exe 29 PID 588 wrote to memory of 1192 588 1243606b8fd6fd0c8f953fcb63f0f732_JaffaCakes118.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1243606b8fd6fd0c8f953fcb63f0f732_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1243606b8fd6fd0c8f953fcb63f0f732_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Users\Admin\viuaki.exe"C:\Users\Admin\viuaki.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1192
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD5986e10e8bcb29e86a43c1a733d72ce47
SHA1219ea50792584bf7138694e8986d2dcae0873da7
SHA25647dd69d0376a98a0003cb56013e1a9294f367470bcc75516199a5d558cb292c4
SHA5128a5362c64d96adcbe2aa22b0de80c936911db3814719befa87724d846858a1236022911390db7a511260f8e2bb6f9653391104b174850e5075e04fe3b42652e4