Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 03:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1602842571b7c5071dcd4120cb77c081_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
1602842571b7c5071dcd4120cb77c081_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
1602842571b7c5071dcd4120cb77c081_JaffaCakes118.exe
-
Size
168KB
-
MD5
1602842571b7c5071dcd4120cb77c081
-
SHA1
4178ce375eedf3f1f0fa48fc8551c487f090d1a6
-
SHA256
dafa8da24f04911f0e74a33fd450de8884a524d6a213681d2ba97489c8610f70
-
SHA512
f9566e310fb528b58fa9fa0ad4302ed1d25b30ad3118236f0ae745e375b58e81cdc440a8b0ad4cea1fbc58f4dfde71c69a7d7f25ec7aa35546c21efc96da1cea
-
SSDEEP
768:qxq1gh/Fe/1mJva/lmqtu9XRyVk8EycBPDcPBPVODxIRUCInwNfVehh1:qFS17dcBPDcPBPMDXwNfVg1
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" trkow.exe -
Executes dropped EXE 1 IoCs
pid Process 2508 trkow.exe -
Loads dropped DLL 2 IoCs
pid Process 1928 1602842571b7c5071dcd4120cb77c081_JaffaCakes118.exe 1928 1602842571b7c5071dcd4120cb77c081_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /x" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /V" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /F" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /w" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /y" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /M" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /A" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /l" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /d" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /q" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /v" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /s" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /P" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /K" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /k" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /J" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /h" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /E" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /i" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /Q" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /u" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /g" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /Z" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /U" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /O" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /c" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /I" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /o" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /W" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /r" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /C" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /S" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /T" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /e" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /t" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /n" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /N" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /D" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /p" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /z" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /L" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /a" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /H" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /B" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /b" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /R" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /Y" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /X" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /G" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /f" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /m" trkow.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\trkow = "C:\\Users\\Admin\\trkow.exe /j" trkow.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1602842571b7c5071dcd4120cb77c081_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trkow.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe 2508 trkow.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1928 1602842571b7c5071dcd4120cb77c081_JaffaCakes118.exe 2508 trkow.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1928 wrote to memory of 2508 1928 1602842571b7c5071dcd4120cb77c081_JaffaCakes118.exe 30 PID 1928 wrote to memory of 2508 1928 1602842571b7c5071dcd4120cb77c081_JaffaCakes118.exe 30 PID 1928 wrote to memory of 2508 1928 1602842571b7c5071dcd4120cb77c081_JaffaCakes118.exe 30 PID 1928 wrote to memory of 2508 1928 1602842571b7c5071dcd4120cb77c081_JaffaCakes118.exe 30 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29 PID 2508 wrote to memory of 1928 2508 trkow.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1602842571b7c5071dcd4120cb77c081_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1602842571b7c5071dcd4120cb77c081_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\trkow.exe"C:\Users\Admin\trkow.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5055c1e0acd3dd0cc8d45be1429900f32
SHA1accfa2b8155d110de4f1c743d13f7407b6b2e67a
SHA256da7a7eeaa39ddeedcc02f5a418ffdde7d414cc832d1dfd4c27a818b7e0e70c28
SHA512892d224883910b5d14a18bc006a4f8fb9e6a7670e353d51ecca6a406d0ae9f4f7f66f4d7be64100b3dc4839830a15ad94f04da318c5e3c2bb5594fb8fdb54bdc