454a93f9001bdcd5882032621ad317f4f02cfe010c09c25211bcaeb623b08847

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
Size

432KB
MD5

f43e5d9af312cbf4b6fe54c8493e0461
SHA1

a134b90b4a6ef9316679711ef273da410a7c8a19
SHA256

454a93f9001bdcd5882032621ad317f4f02cfe010c09c25211bcaeb623b08847
SHA512

0240c72ea13fa520eb4b030d7f977732707962607459c4677d187eea21a9fad506b8fd18a57ccdd2889b6393de73486c9336128e948fcea457c5ec5bbacc58e6
SSDEEP

6144:OJRFTYCpsu2v3BeRUyqinBazIVDNPHRCHMi9KQsa7WOwofXbCQ:Wh8v8UknBasVDN5Cl9tJ73XX

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Drivers\Dbgv.sys	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\DBGV\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Dbgv.sys"	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\DBGV\ImagePath = "\\??\\C:\\Windows\\system32\\Drivers\\Dbgv.sys"	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\T:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\H:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\K:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\M:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\N:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\O:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\P:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\V:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\X:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\G:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\J:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\Q:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\R:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\E:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\S:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\U:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\W:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\Y:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\Z:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened (read-only)	\??\I:	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\ieetwcollector.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\dllhost.ivr	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\searchindexer.ivr	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\svchost.ivr	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\msiexec.ivr	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\ui0detect.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\klist.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaws.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\program files\google\chrome\Application\106.0.5249.119\elevation_service.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\program files (x86)\google\update\googleupdate.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\keytool.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jabswitch.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\ehome\ehsched.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{C54298CB-B91D-4BF9-9742-BAC33CBE202B}.crmlog	dllhost.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	\??\c:\windows\ehome\ehrecvr.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{C54298CB-B91D-4BF9-9742-BAC33CBE202B}.crmlog	dllhost.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	SearchIndexer.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
2696	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
2696	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2696	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2696	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2696	f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
Token: SeRestorePrivilege	2668	msiexec.exe
Token: SeTakeOwnershipPrivilege	2668	msiexec.exe
Token: SeSecurityPrivilege	2668	msiexec.exe
Token: SeManageVolumePrivilege	2360	SearchIndexer.exe
Token: 33	2360	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2360	SearchIndexer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2424	SearchProtocolHost.exe
2424	SearchProtocolHost.exe
2424	SearchProtocolHost.exe
2424	SearchProtocolHost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2424	2360	SearchIndexer.exe	31
PID 2360 wrote to memory of 2424	2360	SearchIndexer.exe	31
PID 2360 wrote to memory of 2424	2360	SearchIndexer.exe	31
PID 2360 wrote to memory of 2600	2360	SearchIndexer.exe	32
PID 2360 wrote to memory of 2600	2360	SearchIndexer.exe	32
PID 2360 wrote to memory of 2600	2360	SearchIndexer.exe	32
PID 2360 wrote to memory of 1264	2360	SearchIndexer.exe	35
PID 2360 wrote to memory of 1264	2360	SearchIndexer.exe	35
PID 2360 wrote to memory of 1264	2360	SearchIndexer.exe	35

C:\Users\Admin\AppData\Local\Temp\f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f43e5d9af312cbf4b6fe54c8493e0461_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Drops file in Windows directory
PID:2900

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2668

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-330940541-141609230-1670313778-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2424
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
  2⤵
  PID:2600
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
  2⤵
  PID:1264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

Filesize
1024KB

MD5
e4e8bd22f7cb41cb482ed6d096f5454a

SHA1
fd9e9fbb155380f3cebd918891f934e7e2b9939f

SHA256
4e7e364eb559c776fce47c248d882a8f06d7dacc08355e2254d1893c742042e7

SHA512
a7e93e1d162fe82c3ee30d315777bee259ea8bf362fe6309b18a5c7b28bd311fbcefb14442b1618e8d75e37faf03ac9542b1969c15b503aa589e128ee9b4d93a

Download Submit
memory/2360-19-0x00000000029D0000-0x00000000029E0000-memory.dmp

Filesize
64KB

Download
memory/2360-35-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/2360-58-0x0000000003E70000-0x0000000003E78000-memory.dmp

Filesize
32KB

Download
memory/2360-64-0x0000000003F10000-0x0000000003F11000-memory.dmp

Filesize
4KB

Download
memory/2360-70-0x0000000003E70000-0x0000000003E78000-memory.dmp

Filesize
32KB

Download
memory/2360-72-0x0000000003E20000-0x0000000003E21000-memory.dmp

Filesize
4KB

Download
memory/2360-81-0x0000000003ED0000-0x0000000003ED8000-memory.dmp

Filesize
32KB

Download
memory/2696-0-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads