Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 13:12
Behavioral task
behavioral1
Sample
f811242287736b95bc2a2d5da50a4009_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f811242287736b95bc2a2d5da50a4009_JaffaCakes118.exe
-
Size
10.9MB
-
MD5
f811242287736b95bc2a2d5da50a4009
-
SHA1
fe7cf455dd03acd24bdefb7ddf495f0a4194e02d
-
SHA256
b00c0a64eccc3701e4d5e9114eb931e125f7407cf0f5f6cc18b32765b1c5ce52
-
SHA512
97981e9513de1ded5ea01dc121ad852204619555f9f200916a9f23c851ead07aa00fdee6ad9ca47d7779f536ddb483c82e3e731983d6b188752942cac38adcf7
-
SSDEEP
196608:YWMWPCzNA7rlvRz1rrFBV6tpjuj6gYPKHCKsg:YjujUtYj6gYPYp
Malware Config
Signatures
-
Detect Blackmoon payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2660-0-0x0000000000400000-0x0000000000457000-memory.dmp family_blackmoon \Windows\360\360Safe\deepscan\ZhuDongFangYu.exe family_blackmoon behavioral1/memory/2660-4-0x0000000002700000-0x0000000002757000-memory.dmp family_blackmoon behavioral1/memory/2052-8-0x0000000000400000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2660-9-0x0000000000400000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2052-233-0x0000000000400000-0x0000000000457000-memory.dmp family_blackmoon -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Adds policy Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" ZhuDongFangYu.exe -
Drops file in Drivers directory 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts ZhuDongFangYu.exe -
Executes dropped EXE 1 IoCs
Processes:
ZhuDongFangYu.exepid process 2052 ZhuDongFangYu.exe -
Loads dropped DLL 1 IoCs
Processes:
f811242287736b95bc2a2d5da50a4009_JaffaCakes118.exepid process 2660 f811242287736b95bc2a2d5da50a4009_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2660-0-0x0000000000400000-0x0000000000457000-memory.dmp upx \Windows\360\360Safe\deepscan\ZhuDongFangYu.exe upx behavioral1/memory/2660-4-0x0000000002700000-0x0000000002757000-memory.dmp upx behavioral1/memory/2052-8-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2660-9-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/2052-233-0x0000000000400000-0x0000000000457000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ZhuDongFangYu = "C:\\Windows\\360\\360Safe\\deepscan\\ZhuDongFangYu.exe" ZhuDongFangYu.exe -
Processes:
ZhuDongFangYu.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe -
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\autorun.inf ZhuDongFangYu.exe File created D:\autorun.inf ZhuDongFangYu.exe File opened for modification D:\autorun.inf ZhuDongFangYu.exe File created F:\autorun.inf ZhuDongFangYu.exe File opened for modification F:\autorun.inf ZhuDongFangYu.exe File created C:\autorun.inf ZhuDongFangYu.exe -
Drops file in System32 directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\SysWOW64\schtasks.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\taskeng.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\TSTheme.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\winver.exe ZhuDongFangYu.exe File created C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\xlog.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\autoconv.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ndadmin.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ntoskrnl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\whoami.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wuapp.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPMGR.EXE ZhuDongFangYu.exe File created C:\Windows\SysWOW64\help.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\compact.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\replace.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\unregmp2.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\autofmt.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cliconfg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\eventvwr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\notepad.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\vssadmin.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\winrshost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\bitsadmin.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\migwiz\MigSetup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\migwiz\mighost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\hh.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\msiexec.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\rasautou.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\reg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\typeperf.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe ZhuDongFangYu.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\BrmfRsmg.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fontview.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\makecab.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\migwiz\migwiz.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dxdiag.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\com\comrepl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ntkrnlpa.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dvdupgrd.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\icacls.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\lodctr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ReAgentc.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\verifier.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\DeviceProperties.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\fsutil.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\printui.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\sdiagnhost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\taskkill.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wsmprovhost.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\cttune.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\srdelayed.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wiaacmgr.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\more.com ZhuDongFangYu.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\logman.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\ntprint.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\find.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\bthudtask.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dccw.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\driverquery.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\dvdplay.exe ZhuDongFangYu.exe File created C:\Windows\SysWOW64\mountvol.exe ZhuDongFangYu.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE ZhuDongFangYu.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE ZhuDongFangYu.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe ZhuDongFangYu.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Media Player\wmpenc.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Mail\WinMail.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe ZhuDongFangYu.exe File created C:\Program Files\DVD Maker\DVDMaker.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe ZhuDongFangYu.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\7-Zip\7zG.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE ZhuDongFangYu.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe ZhuDongFangYu.exe File created C:\Program Files\Windows Mail\wabmig.exe ZhuDongFangYu.exe File created C:\Program Files (x86)\Windows Sidebar\sidebar.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe ZhuDongFangYu.exe File created C:\Program Files\Internet Explorer\iexplore.exe ZhuDongFangYu.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe ZhuDongFangYu.exe -
Drops file in Windows directory 64 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process File created C:\Windows\winsxs\x86_microsoft-windows-i..eoptionalcomponents_31bf3856ad364e35_11.2.9600.16428_none_87f259ebb3f177fa\ConfigureIEOptionalComponents.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_6.1.7600.16385_none_243595ae2cf3193f\TsWpfWrp.exe ZhuDongFangYu.exe File created C:\Windows\ehome\ehshell.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_6.1.7600.16385_none_cb9353551bbd8ed8\DevicePairingWizard.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_6.1.7600.16385_none_63df9c242588e5fc\rekeywiz.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-mcglidhost_31bf3856ad364e35_6.1.7600.16385_none_05a2b72417ec1c6a\mcGlidHost.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_6.1.7601.17514_none_4d76defd6af4a83e\mobsync.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_6.1.7600.16385_none_851e6308c5b62529\msg.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_4b57445488ba33fd\IMJPUEX.EXE ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-adminservice_31bf3856ad364e35_6.1.7600.16385_none_b65cdbcf116dd7c5\WMSvc.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-regsvr32_31bf3856ad364e35_6.1.7600.16385_none_d44c0ef849349ed9\regsvr32.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-ddodiag_31bf3856ad364e35_6.1.7600.16385_none_362ce835fe42421b\ddodiag.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..-setieinstalleddate_31bf3856ad364e35_8.0.7600.16385_none_23079f05995ee912\SetIEInstalledDate.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-verclsid_31bf3856ad364e35_6.1.7600.16385_none_bbbd275974c7e191\verclsid.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-inkwatson_31bf3856ad364e35_6.1.7600.16385_none_644c1a991aac9ffb\InkWatson.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_6.1.7601.17514_none_fed8c13f0d90a8cf\WinMgmt.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-diantz_31bf3856ad364e35_6.1.7600.16385_none_a69c6a8f23f521f3\diantz.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bootconfig_31bf3856ad364e35_6.1.7600.16385_none_680b6eb133f91b1b\bootcfg.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-corruptedfilerecovery_31bf3856ad364e35_6.1.7600.16385_none_e3aea9874278550c\cofire.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_6.1.7601.17514_none_412fcd2afecdc412\mqbkup.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-setup-component_31bf3856ad364e35_6.1.7601.17514_none_905283bdc3e1d2d8\Setup.exe ZhuDongFangYu.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config.comments ZhuDongFangYu.exe File created C:\Windows\ehome\wow\ehexthost32.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_infocard_b77a5c561934e089_6.1.7601.17514_none_583a8c60c0b305a1\infocard.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.2.9600.16428_none_a827c83273877b14\ie4uinit.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-xpsreachviewer_31bf3856ad364e35_6.1.7600.16385_none_7110452767e88835\xpsrchvw.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-pdm-configuration_31bf3856ad364e35_11.2.9600.16428_none_d6876629731ce419\PDMSetup.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_6.1.7601.17514_none_0228c5fb7b680376\SMConfigInstaller.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.1.7600.16385_none_81d82fe9c216eb89\pcaui.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_052696aea98bcefc\PING.EXE ZhuDongFangYu.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..erinboxgames-spades_31bf3856ad364e35_6.1.7600.16385_none_6fa6d7361acba514\shvlzm.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_6.1.7600.16385_none_9d299157e03ce00f\klist.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7600.16385_none_cd7aeeff1897d018_unlodctr.exe_69df45bb ZhuDongFangYu.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-smss_31bf3856ad364e35_6.1.7600.16385_none_082f99a432e2a661_smss.exe_d7209c3a ZhuDongFangYu.exe File created C:\Windows\winsxs\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_6.1.7600.16385_none_61573ee0c2c4be2b\wecutil.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-iecleanup_31bf3856ad364e35_11.2.9600.16428_none_a03d6846a99c1c87\iecleanup.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-snmp-trap-service_31bf3856ad364e35_6.1.7600.16385_none_2b7ff0845918e12f\snmptrap.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_8.0.7600.16385_none_7f0c7a3c17077fce\wextract.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\relog.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_0b66cb34258c936f\poqexec.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_wpf-xamlviewer_31bf3856ad364e35_6.1.7601.17514_none_b43451f0938c6cd0\XamlViewer_v0300.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_ca4e9bcdcac7feed_ntoskrnl.exe_0fb0ab79 ZhuDongFangYu.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad_unlodctr.exe_69df45bb ZhuDongFangYu.exe File created C:\Windows\winsxs\wow64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_c8df7823424473a1\netbtugc.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-cleanmgr_31bf3856ad364e35_6.1.7600.16385_none_6d1a8c84bedf66a4\cleanmgr.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_a907fb2af12e5dc6\PING.EXE ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17514_none_b94cbfa183466a89\winresume.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_cb604f1aa758e6b6\IMJPDSVR.EXE ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_be8acdd10de3b1a6\netbtugc.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.1.7601.17514_none_288b7acec3a75696\wsmprovhost.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-errorreportingfaults_31bf3856ad364e35_6.1.7601.17514_none_720e868d9b0b6a44\WerFault.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_8.0.7601.17514_none_44aa873ff9136c27\RegisterIEPKEYs.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.17514_none_c75e9c99a36a285a\winresume.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\find.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_6bcef05d7f04260a\rasautou.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-vault_31bf3856ad364e35_6.1.7600.16385_none_4d5e025e54ba15f8\VaultSysUi.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7601.17514_none_a0cf62efee3228a3\wab.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-directx-directplay8_31bf3856ad364e35_6.1.7601.17514_none_7addf2001d014646\dpnsvr.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-security-secedit_31bf3856ad364e35_6.1.7600.16385_none_aebd843e13122315\SecEdit.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_02aa6dd4294b8d5f\shutdown.exe ZhuDongFangYu.exe File created C:\Windows\ehome\MediaCenterWebLauncher.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sigverif_31bf3856ad364e35_6.1.7600.16385_none_178e7604150fa952\sigverif.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_6.1.7600.16385_none_1ddd261c4e350476\upnpcont.exe ZhuDongFangYu.exe File created C:\Windows\winsxs\x86_microsoft-windows-clip_31bf3856ad364e35_6.1.7600.16385_none_a7b238407d550501\clip.exe ZhuDongFangYu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
f811242287736b95bc2a2d5da50a4009_JaffaCakes118.exeZhuDongFangYu.exedescription pid process Token: SeDebugPrivilege 2660 f811242287736b95bc2a2d5da50a4009_JaffaCakes118.exe Token: SeDebugPrivilege 2052 ZhuDongFangYu.exe Token: 33 2052 ZhuDongFangYu.exe Token: SeIncBasePriorityPrivilege 2052 ZhuDongFangYu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f811242287736b95bc2a2d5da50a4009_JaffaCakes118.exeZhuDongFangYu.exepid process 2660 f811242287736b95bc2a2d5da50a4009_JaffaCakes118.exe 2052 ZhuDongFangYu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
f811242287736b95bc2a2d5da50a4009_JaffaCakes118.exedescription pid process target process PID 2660 wrote to memory of 2052 2660 f811242287736b95bc2a2d5da50a4009_JaffaCakes118.exe ZhuDongFangYu.exe PID 2660 wrote to memory of 2052 2660 f811242287736b95bc2a2d5da50a4009_JaffaCakes118.exe ZhuDongFangYu.exe PID 2660 wrote to memory of 2052 2660 f811242287736b95bc2a2d5da50a4009_JaffaCakes118.exe ZhuDongFangYu.exe PID 2660 wrote to memory of 2052 2660 f811242287736b95bc2a2d5da50a4009_JaffaCakes118.exe ZhuDongFangYu.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
ZhuDongFangYu.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system ZhuDongFangYu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ZhuDongFangYu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ZhuDongFangYu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f811242287736b95bc2a2d5da50a4009_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f811242287736b95bc2a2d5da50a4009_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"C:\Windows\360\360Safe\deepscan\ZhuDongFangYu.exe"2⤵
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\360\360Safe\deepscan\ZhuDongFangYu.exeFilesize
10.9MB
MD5f811242287736b95bc2a2d5da50a4009
SHA1fe7cf455dd03acd24bdefb7ddf495f0a4194e02d
SHA256b00c0a64eccc3701e4d5e9114eb931e125f7407cf0f5f6cc18b32765b1c5ce52
SHA51297981e9513de1ded5ea01dc121ad852204619555f9f200916a9f23c851ead07aa00fdee6ad9ca47d7779f536ddb483c82e3e731983d6b188752942cac38adcf7
-
memory/2052-8-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2052-233-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2660-0-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2660-4-0x0000000002700000-0x0000000002757000-memory.dmpFilesize
348KB
-
memory/2660-9-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB