ramnit | 5e1257a7d9d5167569f8478acea3ab7ca305094ca9f72cd546db49fe3b87a965

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2024, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
Size 121KB
Sample240401-pcbcpadh81
SHA256 5e1257a7d9d5167569f8478acea3ab7ca305094ca9f72cd546db49fe3b87a965
MD5 719ec6e9d02f6d2392506180335017db
SHA1 4d18b602f609d1236fb8b652bc7c5789e754764c
SHA512 fa76261b8fad86e744d65410e5acac59d6c18495c840765f8b40bdda2306d99ac4bc3e332d14d852b104b35fbc85aeed632937da328f6b5fbb71bc1488c64380
SSDEEP 3072:G63GIUchJGTgfB/ta4u661a9srlWr+beV+A5gBcGO+CfSMTA1:G63GASTywD6Vzr+m6J1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker evasion spyware stealer trojan upx worm

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe:*:enabled:@shell32.dll,-1"	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit

Executes dropped EXE 2 IoCs

pid	Process
4924	719ec6e9d02f6d2392506180335017db_JaffaCakes118Srv.exe
4960	DesktopLayer.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3004-0-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/files/0x0008000000023203-3.dat	upx
behavioral2/memory/4924-4-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/4924-6-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/4960-12-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/4960-19-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/4960-17-0x0000000000400000-0x0000000000436000-memory.dmp	upx
behavioral2/memory/3004-25-0x0000000000400000-0x0000000000427000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	719ec6e9d02f6d2392506180335017db_JaffaCakes118Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	719ec6e9d02f6d2392506180335017db_JaffaCakes118Srv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\px4B61.tmp	719ec6e9d02f6d2392506180335017db_JaffaCakes118Srv.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2902081676"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31097901"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31097901"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418738410"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D87B413E-F020-11EE-B3C6-C69DB2B6DED0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31097901"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2902081676"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2905675597"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
4960	DesktopLayer.exe
4960	DesktopLayer.exe
4960	DesktopLayer.exe
4960	DesktopLayer.exe
4960	DesktopLayer.exe
4960	DesktopLayer.exe
4960	DesktopLayer.exe
4960	DesktopLayer.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
Token: SeRestorePrivilege	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
Token: SeBackupPrivilege	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3288	iexplore.exe
3288	iexplore.exe
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE
4444	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 4924	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	84
PID 3004 wrote to memory of 4924	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	84
PID 3004 wrote to memory of 4924	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	84
PID 3004 wrote to memory of 640	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	5
PID 3004 wrote to memory of 640	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	5
PID 3004 wrote to memory of 640	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	5
PID 3004 wrote to memory of 640	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	5
PID 3004 wrote to memory of 640	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	5
PID 3004 wrote to memory of 640	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	5
PID 3004 wrote to memory of 696	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	7
PID 3004 wrote to memory of 696	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	7
PID 3004 wrote to memory of 696	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	7
PID 3004 wrote to memory of 696	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	7
PID 3004 wrote to memory of 696	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	7
PID 3004 wrote to memory of 696	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	7
PID 4924 wrote to memory of 4960	4924	719ec6e9d02f6d2392506180335017db_JaffaCakes118Srv.exe	85
PID 4924 wrote to memory of 4960	4924	719ec6e9d02f6d2392506180335017db_JaffaCakes118Srv.exe	85
PID 4924 wrote to memory of 4960	4924	719ec6e9d02f6d2392506180335017db_JaffaCakes118Srv.exe	85
PID 3004 wrote to memory of 804	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	8
PID 3004 wrote to memory of 804	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	8
PID 3004 wrote to memory of 804	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	8
PID 3004 wrote to memory of 804	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	8
PID 4960 wrote to memory of 3288	4960	DesktopLayer.exe	86
PID 4960 wrote to memory of 3288	4960	DesktopLayer.exe	86
PID 3004 wrote to memory of 804	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	8
PID 3004 wrote to memory of 804	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	8
PID 3004 wrote to memory of 812	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	9
PID 3004 wrote to memory of 812	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	9
PID 3004 wrote to memory of 812	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	9
PID 3004 wrote to memory of 812	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	9
PID 3004 wrote to memory of 812	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	9
PID 3004 wrote to memory of 812	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	9
PID 3004 wrote to memory of 820	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	10
PID 3004 wrote to memory of 820	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	10
PID 3004 wrote to memory of 820	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	10
PID 3004 wrote to memory of 820	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	10
PID 3004 wrote to memory of 820	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	10
PID 3004 wrote to memory of 820	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	10
PID 3004 wrote to memory of 928	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	11
PID 3004 wrote to memory of 928	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	11
PID 3004 wrote to memory of 928	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	11
PID 3004 wrote to memory of 928	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	11
PID 3004 wrote to memory of 928	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	11
PID 3004 wrote to memory of 928	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	11
PID 3004 wrote to memory of 976	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	12
PID 3004 wrote to memory of 976	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	12
PID 3004 wrote to memory of 976	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	12
PID 3004 wrote to memory of 976	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	12
PID 3004 wrote to memory of 976	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	12
PID 3004 wrote to memory of 976	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	12
PID 3004 wrote to memory of 388	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	13
PID 3004 wrote to memory of 388	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	13
PID 3004 wrote to memory of 388	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	13
PID 3004 wrote to memory of 388	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	13
PID 3004 wrote to memory of 388	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	13
PID 3004 wrote to memory of 388	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	13
PID 3004 wrote to memory of 712	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	14
PID 3004 wrote to memory of 712	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	14
PID 3004 wrote to memory of 712	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	14
PID 3004 wrote to memory of 712	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	14
PID 3004 wrote to memory of 712	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	14
PID 3004 wrote to memory of 712	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	14
PID 3004 wrote to memory of 920	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	15
PID 3004 wrote to memory of 920	3004	719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe	15

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:640
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:812
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:388

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:696

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:820
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2996
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3848
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3944
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4012
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:692
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:532
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2212
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:4296
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:1912
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:1144
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1116
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2832
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:4484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1320
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1980

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2740

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3456

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3536
- C:\Users\Admin\AppData\Local\Temp\719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\719ec6e9d02f6d2392506180335017db_JaffaCakes118.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Users\Admin\AppData\Local\Temp\719ec6e9d02f6d2392506180335017db_JaffaCakes118Srv.exe
    C:\Users\Admin\AppData\Local\Temp\719ec6e9d02f6d2392506180335017db_JaffaCakes118Srv.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Program Files (x86)\Microsoft\DesktopLayer.exe
      "C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4960
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:3288
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3288 CREDAT:17410 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2648

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:2548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 471B
SHA256 4f39a1a0197eb87da6e8a84fe29c0a8af15811eb536b68559d642731fa718906
MD5 a213071b1c7fc99a7c7d5c4d8af1c3c0
SHA1 9291388853f004f02af1f520e1d8d9190032d43b
SHA512 a73bd6fd0e3bb9f3a169fb43b0423a290f6c4c94f56d9cebd427125a65f950b7eb64e37114151a59e213a339edc6eea71062e1d5c943ab0fdb6d19c9453f803d
MD5 SHA1 SHA512

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 404B
SHA256 4891a82a65e60cc084776cfa40db2e4c98e88d8f968c31a2dee2d72cdcc4d970
MD5 b1f6f89ab79f4e4a721916f28ab18e04
SHA1 643f857245f6a4fa086246776a6e42459d7d15ca
SHA512 d9cd2ee4be075fc03820d37e0f1060bd748e8f57dc67d3c2d519ea4f404d0565d0b8ea196c8876687e7480f1e6c66f690e5298b35b837b63d71efb8d476bf73a
MD5 SHA1 SHA512

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PICZ11Q6\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

719ec6e9d02f6d2392506180335017db_JaffaCakes118Srv.exe

Path C:\Users\Admin\AppData\Local\Temp\719ec6e9d02f6d2392506180335017db_JaffaCakes118Srv.exe
Size 84KB
SHA256 60b9314940039281b6bb2216330400cf2b12d2125326ba2e69f251fb049409b2
MD5 69dc6baf34bc7dc2197cfc6d15bc0a83
SHA1 193e9f44ce7e10fff6691ae05eb0a7c391698b25
SHA512 c430d975aafafe90e97942b6fb54084c9985e50454320a33ab3b458ff2eac6b6c907e14ae105be8b0926222cd3298b62356d81b796128e620406b33fffc6a40c
SSDEEP 1536:B+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzEr7Iysp19R:0ROzoTq0+RO7IwnYXNsJR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3004-57-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/3004-0-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/3004-24-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/3004-25-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/3004-23-0x0000000076F33000-0x0000000076F34000-memory.dmp

Download

memory/3004-20-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/3004-22-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Download

memory/3004-21-0x0000000076F32000-0x0000000076F33000-memory.dmp

Download

memory/4924-7-0x0000000000490000-0x000000000049F000-memory.dmp

Download

memory/4924-6-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4924-4-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4960-12-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4960-16-0x0000000076F32000-0x0000000076F33000-memory.dmp

Download

memory/4960-13-0x0000000000490000-0x000000000049F000-memory.dmp

Download

memory/4960-17-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4960-18-0x0000000076F32000-0x0000000076F33000-memory.dmp

Download

memory/4960-19-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4960-15-0x0000000000580000-0x0000000000581000-memory.dmp

Download