Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 06:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
167554ebe9d66c003e43df5749619837_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
167554ebe9d66c003e43df5749619837_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
167554ebe9d66c003e43df5749619837_JaffaCakes118.exe
-
Size
224KB
-
MD5
167554ebe9d66c003e43df5749619837
-
SHA1
40b5442c08998df04a837e8dff167b4ee87e6884
-
SHA256
39b36a41519131433cbadc3f7ad5e3f983f8b356af3b613e1a9b07242aedc891
-
SHA512
ac4c8be60b298f88586143464c03c3dafc3a99aded900335dc7488b71207eca09f8533fb2aad4f35d78ac533af10389f9156c652b52d5c1baccc780329642f8a
-
SSDEEP
6144:p5zFwzWQ2Gh9zDBXgtXV8WS0ij/LdjthuWKnvmb7/D26f7zEUg7Ac1z14:3Fw1h9nBXgtF8WhIDdjthuWKnvmb7/DT
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 167554ebe9d66c003e43df5749619837_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vobus.exe -
Executes dropped EXE 1 IoCs
pid Process 1632 vobus.exe -
Loads dropped DLL 2 IoCs
pid Process 2984 167554ebe9d66c003e43df5749619837_JaffaCakes118.exe 2984 167554ebe9d66c003e43df5749619837_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /b" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /q" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /j" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /x" 167554ebe9d66c003e43df5749619837_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /r" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /U" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /H" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /D" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /t" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /i" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /M" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /R" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /I" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /X" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /f" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /h" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /g" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /Z" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /J" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /S" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /L" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /v" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /n" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /z" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /o" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /d" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /O" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /w" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /W" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /V" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /k" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /a" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /Q" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /m" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /l" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /F" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /P" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /y" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /C" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /x" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /E" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /Y" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /s" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /T" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /A" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /u" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /K" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /c" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /e" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /N" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /p" vobus.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\vobus = "C:\\Users\\Admin\\vobus.exe /B" vobus.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 167554ebe9d66c003e43df5749619837_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vobus.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2984 167554ebe9d66c003e43df5749619837_JaffaCakes118.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe 1632 vobus.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2984 167554ebe9d66c003e43df5749619837_JaffaCakes118.exe 1632 vobus.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2984 wrote to memory of 1632 2984 167554ebe9d66c003e43df5749619837_JaffaCakes118.exe 30 PID 2984 wrote to memory of 1632 2984 167554ebe9d66c003e43df5749619837_JaffaCakes118.exe 30 PID 2984 wrote to memory of 1632 2984 167554ebe9d66c003e43df5749619837_JaffaCakes118.exe 30 PID 2984 wrote to memory of 1632 2984 167554ebe9d66c003e43df5749619837_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\167554ebe9d66c003e43df5749619837_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\167554ebe9d66c003e43df5749619837_JaffaCakes118.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\vobus.exe"C:\Users\Admin\vobus.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1632
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD53d72ec7e3180bf61fe7cb02622b66cd9
SHA1ee842b7d6a2db4a734700fa37760c680862d0c8c
SHA256dcf546e27a31972b3dfeb98b5b18c19d416c86be649c3e6bf38c4d5977e3f269
SHA51233cbf1459790a39a51dd25f804202f5ef3ae0bf52f209e9fa12fcf715d9f5e7a98827f1890d161622ad3c6202beacc29bf927269db735dbe27a400367a0c3737