Analysis
- max time kernel
118s - max time network
119s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
04/04/2024, 09:28
Behavioral task
behavioral1
Sample
b4c767ca120956a49d08ffc4bcd90bc9_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
21 signatures
150 seconds
General
- Target b4c767ca120956a49d08ffc4bcd90bc9_JaffaCakes118.exe
- Size 10.1MB
- Sample240404-lfrbjaca33
- SHA256 f2c245d1d7088a82f3ac4d23857bd0e5e7bc342781320a5f5e9c8109fcbc3fc4
- MD5 b4c767ca120956a49d08ffc4bcd90bc9
- SHA1 80aadf3d11adb5f1e007248a10e4cfcbe5be51f2
- SHA512 d8eb691c06477ea6078c698922f5415e0f1555cc92ee2ba56c5c4808d9c67855d3a7572b95199db8cc312fe29c8dc6b84e46d738a48d9d66485b5a92e9274429
- SSDEEP 98304:DBJy9DEp5+BJy9DEp5NBJy9DEp5+BJy9DEp5m:YWTW4WTWA
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 6 IoCs
resource yara_rule behavioral1/memory/2172-0-0x0000000000400000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/files/0x0007000000015cb9-3.dat family_blackmoon behavioral1/memory/2172-7-0x0000000000400000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2780-11-0x0000000000400000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2780-372-0x0000000000400000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2780-759-0x0000000000400000-0x0000000000457000-memory.dmp family_blackmoon -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe - Adds policy Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" ZhuDongFangYu.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts ZhuDongFangYu.exe - Executes dropped EXE 1 IoCs
pid Process 2780 ZhuDongFangYu.exe - Loads dropped DLL 1 IoCs
pid Process 2172 b4c767ca120956a49d08ffc4bcd90bc9_JaffaCakes118.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2172-0-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/files/0x0007000000015cb9-3.dat upx behavioral1/memory/2172-7-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2780-11-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2780-372-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2780-759-0x0000000000400000-0x0000000000457000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe - Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf ZhuDongFangYu.exe File opened for modification C:\autorun.inf ZhuDongFangYu.exe File created D:\autorun.inf ZhuDongFangYu.exe File opened for modification D:\autorun.inf ZhuDongFangYu.exe File created F:\autorun.inf ZhuDongFangYu.exe File opened for modification F:\autorun.inf ZhuDongFangYu.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\finger.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\logagent.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SecEdit.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wevtutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\migwiz\mighost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\diskraid.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cmdl32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\DisplaySwitch.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\net1.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rekeywiz.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cipher.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\icardagt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\psr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rrinstaller.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\tracerpt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe ZhuDongFangYu.exe File created C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\ditrace.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Dism.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\taskeng.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wuapp.exe ZhuDongFangYu.exe File created C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_neutral_e54666f6a3e5af91\fsquirt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sethc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dllhost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\efsui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fltMC.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ReAgentc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\subst.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\compact.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dpapimig.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\MigAutoPlay.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\NAPSTAT.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ocsetup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMEJP10\imjppdmg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cmdkey.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\proquota.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ARP.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\forfiles.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cttunesvr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\clip.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\credwiz.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\eventcreate.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\hh.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mountvol.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\userinit.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\doskey.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\findstr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\net.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ROUTE.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sdbinst.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\write.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPDSVR.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dcomcnfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\format.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\label.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\where.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dfrgui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\extrac32.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\iscsicpl.exe ZhuDongFangYu.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\updater.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\clock.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\currency.html ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\settings.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Shades of Blue.htm ZhuDongFangYu.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\settings.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\README.HTM ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\weather.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\clock.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\picturePuzzle.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\settings.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\CURRENCY.HTM ZhuDongFangYu.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\settings.html ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPreviewTemplate.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\WMPSideShowGadget.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\slideShow.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\settings.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\RSSFeeds.html ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBrowserUpgrade.html ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\settings.html ZhuDongFangYu.exe File created C:\Program Files\Internet Explorer\iexplore.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\sidebar.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\settings.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE ZhuDongFangYu.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\weather.html ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe ZhuDongFangYu.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\fveupdate.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..executionprevention_31bf3856ad364e35_6.1.7600.16385_none_25d85b4a3e4a7709\SystemPropertiesDataExecutionPrevention.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-getmac_31bf3856ad364e35_6.1.7600.16385_none_0bd4ecde034ea7da\getmac.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-mountvol_31bf3856ad364e35_6.1.7600.16385_none_b22fcf90b2c6e173\mountvol.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5956204d6dda4df5\picturePuzzle.html ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\tree.com ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\401-3.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\403-8.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_6.1.7601.17514_none_38a043f2b45f9ad2\msconfig.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_6.1.7601.17514_none_6f4ef219dd693ca6\WPDShextAutoplay.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\403-8.htm ZhuDongFangYu.exe File created C:\Windows\twunk_16.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-icacls_31bf3856ad364e35_6.1.7600.16385_none_328af534074dc6cc\icacls.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-installer-executable_31bf3856ad364e35_6.1.7601.17514_none_4b88deb7e45bfbb0\msiexec.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..-calendar.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dd95cd2390bb17bc\calendar.html ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-taskhost_31bf3856ad364e35_6.1.7601.18010_none_86608c5a70f925bc\taskhost.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\404-11.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\msil_ieexec_b03f5f7f11d50a3a_6.1.7600.16385_none_53678ee8c3f93f6b\IEExec.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-tpm-adminsnapin_31bf3856ad364e35_6.1.7600.16385_none_77536d124094b997\TpmInit.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\501.htm ZhuDongFangYu.exe File created C:\Windows\assembly\GAC_MSIL\ehexthost\6.1.0.0__31bf3856ad364e35\ehexthost.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-scripting_31bf3856ad364e35_6.1.7600.16385_none_a45d44bd1a0af822\cscript.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wlan-extension_31bf3856ad364e35_6.1.7600.16385_none_55d820d53d0a8fa3\wlanext.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404.htm ZhuDongFangYu.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rundll32_31bf3856ad364e35_6.1.7600.16385_none_33fa4336c49b998b\rundll32.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..eoptionalcomponents_31bf3856ad364e35_8.0.7601.17514_none_1e7b93842c84c912\ConfigureIEOptionalComponents.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\500-13.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_6.1.7601.17514_none_c3b917fd89d834f3\LogonUI.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_6.1.7601.17514_none_2d1a84c49beb2055\wiaacmgr.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_netfx-clrgc_b03f5f7f11d50a3a_6.1.7601.17514_none_ad7a390fa131c970\clrgc.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\502.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_6.1.7600.16385_none_5e9e78a6dd413413\sapisvr.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-forfiles_31bf3856ad364e35_6.1.7600.16385_none_54f9c5c33edc5fbb\forfiles.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\404-10.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-19.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_6.1.7601.17514_none_f8852afc12f84e8e\nltest.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_17330d9420bf24e8_expand.exe_f43b24c8 ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-eudcedit_31bf3856ad364e35_6.1.7601.17514_none_5b9fee911dc04044\eudcedit.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\500-14.htm ZhuDongFangYu.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-servicepackcoordinator_31bf3856ad364e35_6.1.7601.17514_none_92e727843e307e1b\spreview.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-openfiles_31bf3856ad364e35_6.1.7600.16385_none_e6fcbd244bb7bf74\openfiles.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_6.1.7600.16385_none_e6af0acbde467b7b\aspnet_regiis.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_en-us_92dafd34e62c3942\settings.html ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\401.htm ZhuDongFangYu.exe File created C:\Windows\ehome\mcupdate.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_6.1.7601.17514_none_736d5be520319b24\tzupd.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_6.1.7600.16385_none_b4e9027a5234f127\xwizard.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_es-es_7fa92a4e1adcf67f\clock.html ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\500.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\chgport.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_6.1.7600.16385_none_b45109ec45a678fc\WFServicesReg.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_d18028273214fa77\SearchProtocolHost.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-setup-support_31bf3856ad364e35_8.0.7601.17514_none_e292664733bd5af6\ie4uinit.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-6.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_6bcef05d7f04260a\rasautou.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_6.1.7600.16385_none_33f05b889d506d0a\wbemtest.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_subsystem-for-unix-based-applications_31bf3856ad364e35_6.1.7601.17514_none_d20e5d35068f261a\posix.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_6.1.7601.17514_none_3899b0ad2bb77a86_iscsicli.exe_20e14d4f ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_658ca9e7eb14c76c\settings.html ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\403-12.htm ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\500-14.htm ZhuDongFangYu.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2172 b4c767ca120956a49d08ffc4bcd90bc9_JaffaCakes118.exe Token: SeDebugPrivilege 2780 ZhuDongFangYu.exe Token: 33 2780 ZhuDongFangYu.exe Token: SeIncBasePriorityPrivilege 2780 ZhuDongFangYu.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2172 b4c767ca120956a49d08ffc4bcd90bc9_JaffaCakes118.exe 2780 ZhuDongFangYu.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2780 2172 b4c767ca120956a49d08ffc4bcd90bc9_JaffaCakes118.exe 28 PID 2172 wrote to memory of 2780 2172 b4c767ca120956a49d08ffc4bcd90bc9_JaffaCakes118.exe 28 PID 2172 wrote to memory of 2780 2172 b4c767ca120956a49d08ffc4bcd90bc9_JaffaCakes118.exe 28 PID 2172 wrote to memory of 2780 2172 b4c767ca120956a49d08ffc4bcd90bc9_JaffaCakes118.exe 28 - System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system ZhuDongFangYu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ZhuDongFangYu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4c767ca120956a49d08ffc4bcd90bc9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4c767ca120956a49d08ffc4bcd90bc9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2780
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html
- Size 16KB
- SHA256 aa21cb6b8fd8ee6e90ecc5b858dbcbecd3a97efa1f58145a26e619c2ab457bb5
- MD5 17f3bbed916ce900652433f2593ff684
- SHA1 85d4fbf534aa8acd759a489d31e06ac27677f3a7
- SHA512 81a01663f9d577882d82744d063af5fd570ee2d98cd5f6995f3f5aedaa99b45b215ef0e081056001026f45fe79ce811bef5979ce8973df8527b1920ad2215bdf
- SSDEEP 384:26ipihOh2GN/qyuotZ1JlqoGRWLcTzX8XPWuvPWu0:TipihOtYDotVyWITSuuvuu0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html
- Size 6KB
- SHA256 3cc5fa1f9ed7884a08539190a1670bbe64b0e64d1d585d4c1befcf7f91960682
- MD5 24bed74a2a49536d75ebfd9c87d105eb
- SHA1 ec830db2834d33dd61437ccf330ca2ad6b73e377
- SHA512 a29b8c9f0a3f354e36c805b3956f637a9024ba3df8085c20f148ee4e550603191725e40d0c784192022b637227b06d831cc83a3790cc372e94431d5685545265
- SSDEEP 192:12O0rK4aoOWCGsh2NdbqX4tdM12dNLHPWuvPWu0:12i4aoDC/h3mDPWuvPWu0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html
- Size 12KB
- SHA256 442c6bfe7c011e24f8c0bb1c0584b96cf804eb7198d4aacffa4c5f6769ff4215
- MD5 33f73419b8fc156a8a5e0eee311a2639
- SHA1 7ebd3842e080ed34f4675eea740c3e90d8db7bc2
- SHA512 1f9e3a64bfc78cea57f4d9fce2ff4f9adfbe7526ef10e40eaa7cd9b8109cfa124b306f6d3be5e1a777bb604dc2c497623aa9298f580cd7e9a6e3bb9818e819ad
- SSDEEP 192:zMd9c90b89tOcOHdTaxtYz/Nf41E1HlxgNc9cu5HfabuFPWu0:gd9o049YTaoz/t41EcR8/aCFPWu0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html
- Size 8KB
- SHA256 fd516ab385f8dabba0da1377f5dfdc0dbdefdd224d823313eff24e8fb00c6217
- MD5 ffbe89b376301d5a5e1602502f3a049e
- SHA1 4fd73b0508a04073411bfb0af9f1e77a2009850a
- SHA512 25807dacb22621f69dfc9b85464e566a11b6f417632c9d2dac92b5112a8495aacc5edb2938e5515a59843fe79f25b5c65a280b41fb9b0c27bfce2b4da48cfa02
- SSDEEP 192:BKd0PKSgaKbWKG7Mh2NdbqXu60oCNKzsYck5DWMbr+y6dmrM0ZqkPWu0:BKd1aKSKYMhgKIYf4I+y6d0vZrPWu0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html
- Size 14KB
- SHA256 aa696a838bb49ef4a6c83890ffa39424a471a84bcbc57ae86867b1f9bba3994f
- MD5 138687bae4d5ae5ecd9f49d4603846b6
- SHA1 b9bd64f7c2f3a00ac7ad28d21d0f589e881eb5b5
- SHA512 c6b0b2a25e95a082695e658eb9086d67e2d517aed8adcb625e2b81a29887b4ae31d26cc99738703516ea9072773e06f8871b8775706aeec705f227a68fb7efa6
- SSDEEP 384:j7zP6lAytymySpmmJdvUKM1/S/EF6jzpVxfPWuvPWu0:H76lAytymyiVJdA/S/EFqPZuuvuu0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html
- Size 16KB
- SHA256 b8dd69bd1f86b0f1889122b8376ea78d44f0f0689945858f247975f7f72ef86c
- MD5 b8723baac78bf9c17d116fe9b25c81b2
- SHA1 7b04a048a42f9611afde747a57694574de887783
- SHA512 1293a9aa28b83d6912ce041db03c8ebbe3aacceadf35d8cb59827abdaedefaac868ea77452bb34730073ed3b5c9679cf73d969cc3f9bd9be207a7a306db8c46e
- SSDEEP 384:iZyzXytymy7yNbyCk3ySpmmJdvUKM1/S/EF6jzpVxfPWuvPWu0:I+Xytymy7yNyCk3yiVJdA/S/EFqPZuuy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\vcredist2010_x86.log.html
- Size 81KB
- SHA256 f64621800f09c0b2b60cc718ebe0433e1733ac848db02f40e76af728da0808f9
- MD5 ef76b467d0006c242fac66f4ed04cd94
- SHA1 8929eff440a9da95f0fd32ab5164033a5e40a90f
- SHA512 fbdc037900f4da45ee87f45bfa59378e9e2be220c4bb336523dbf51c5804658e278be2fc88e9f8bc106e23f9dd5ea11cedd68c77ff281c544364c6b4f865ba40
- SSDEEP 768:fdsOTLyUFJFEWUxFzv9PgQpT61yi2uuvuu0:fdsWyUr+WUxpvCQ9Qv
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\360\360Safe\deepscan\ZhuDongFangYu.exe
- Size 10.1MB
- SHA256 f2c245d1d7088a82f3ac4d23857bd0e5e7bc342781320a5f5e9c8109fcbc3fc4
- MD5 b4c767ca120956a49d08ffc4bcd90bc9
- SHA1 80aadf3d11adb5f1e007248a10e4cfcbe5be51f2
- SHA512 d8eb691c06477ea6078c698922f5415e0f1555cc92ee2ba56c5c4808d9c67855d3a7572b95199db8cc312fe29c8dc6b84e46d738a48d9d66485b5a92e9274429
- SSDEEP 98304:DBJy9DEp5+BJy9DEp5NBJy9DEp5+BJy9DEp5m:YWTW4WTWA
- MD5 SHA1 SHA512 SSDEEP