Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
05-10-2024 02:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
15d9ac33ef3cc8b0a1056c736a24fda0_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
15d9ac33ef3cc8b0a1056c736a24fda0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
15d9ac33ef3cc8b0a1056c736a24fda0_JaffaCakes118.exe
-
Size
288KB
-
MD5
15d9ac33ef3cc8b0a1056c736a24fda0
-
SHA1
9d691783e39f7aa428c3935ba1c69c31d25afbc0
-
SHA256
bf895b4b509594d7107163f10c0f160b80d8f1cbe926649006545badc3afa8b6
-
SHA512
ace19614144c3bf7dedb3a99af2cab8328a698bcdc42566cdf9dca575393a0ed65f578c3a66b1d75e11169e50b757710cf5e368f16d2e093106f7a0bcb65095e
-
SSDEEP
6144:UWyi1vbGuOdn9Z/QmO6Ckobf3fGCmahGutEU:l1vbGuYnXQmO6Ckobf3fGCmah8U
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 15d9ac33ef3cc8b0a1056c736a24fda0_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vmcuof.exe -
Executes dropped EXE 1 IoCs
pid Process 2160 vmcuof.exe -
Loads dropped DLL 2 IoCs
pid Process 1520 15d9ac33ef3cc8b0a1056c736a24fda0_JaffaCakes118.exe 1520 15d9ac33ef3cc8b0a1056c736a24fda0_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /T" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /y" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /i" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /x" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /B" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /s" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /Q" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /n" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /L" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /P" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /u" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /N" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /I" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /Y" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /t" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /M" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /v" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /a" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /O" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /p" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /H" 15d9ac33ef3cc8b0a1056c736a24fda0_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /g" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /C" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /j" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /w" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /E" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /G" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /R" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /F" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /Z" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /k" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /H" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /r" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /K" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /V" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /o" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /D" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /A" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /U" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /S" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /J" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /d" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /q" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /f" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /b" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /c" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /m" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /z" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /h" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /W" vmcuof.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\vmcuof = "C:\\Users\\Admin\\vmcuof.exe /X" vmcuof.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15d9ac33ef3cc8b0a1056c736a24fda0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vmcuof.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1520 15d9ac33ef3cc8b0a1056c736a24fda0_JaffaCakes118.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe 2160 vmcuof.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1520 15d9ac33ef3cc8b0a1056c736a24fda0_JaffaCakes118.exe 2160 vmcuof.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1520 wrote to memory of 2160 1520 15d9ac33ef3cc8b0a1056c736a24fda0_JaffaCakes118.exe 30 PID 1520 wrote to memory of 2160 1520 15d9ac33ef3cc8b0a1056c736a24fda0_JaffaCakes118.exe 30 PID 1520 wrote to memory of 2160 1520 15d9ac33ef3cc8b0a1056c736a24fda0_JaffaCakes118.exe 30 PID 1520 wrote to memory of 2160 1520 15d9ac33ef3cc8b0a1056c736a24fda0_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\15d9ac33ef3cc8b0a1056c736a24fda0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\15d9ac33ef3cc8b0a1056c736a24fda0_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\vmcuof.exe"C:\Users\Admin\vmcuof.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2160
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288KB
MD5fef69096398f0ef4034bbaf9ebc52ff7
SHA18505a0ee46fd361404295b5271abbf7621954e49
SHA256fdc809b1cf59d66a7f2771dc4a73d52fd05e89255553b0dd9e09d400b1a416be
SHA512019508659d76a4c325e4f7095c8fe29a502e3ea57029c27297583b8d214f1df34584ccdbea95a78b7fcbcdec74f6e96d4aa7dbb9dcd83c9603db522b92e9ee7f