Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 22:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe
-
Size
97KB
-
MD5
fb568481fb808dcbea29f7a12e124bc9
-
SHA1
489bc6b83f86e3233be44d17d2c02674aba20884
-
SHA256
f4c88afedcd39ddc4fffc9de1da87a17da6bdd4af6332f9eace560ad4f7f9cbf
-
SHA512
d39bbce5d891b78c79dc48e14bc174a4d842a4763dbc69849341e7e5571bec244554d5a351b22d9e5fdc6bf03ec49d375f40a8252116cc6ebcc81db22411be7a
-
SSDEEP
1536:5v/MoORizUPliPsm/gL16ZpQGh6MgHN+PhuLGR/11TvbRMoOJ:R/xOMUMPsgQvTMY+PhGGR/11TlxOJ
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\o4272827.exe\"" fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\j6272822.exe" qm4623.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\j6272822.exe" fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\o4272827.exe\"" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\j6272822.exe" m4623.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\j6272822.exe" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\j6272822.exe" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\o4272827.exe\"" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\o4272827.exe\"" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\j6272822.exe" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\o4272827.exe\"" qm4623.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\o4272827.exe\"" m4623.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\o4272827.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\j6272822.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\o4272827.exe\"" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\j6272822.exe" csrss.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" lsass.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" qm4623.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" m4623.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" services.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" m4623.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" services.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lsass.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qm4623.exe -
Adds policy Run key to start application 2 TTPs 18 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\f1464Adm = "\"C:\\Users\\Admin\\AppData\\Local\\dv692700x\\yesbron.com\"" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\f1464Adm = "\"C:\\Users\\Admin\\AppData\\Local\\dv692700x\\yesbron.com\"" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\N4308c = "\"C:\\Windows\\_default27282.pif\"" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\f1464Adm = "\"C:\\Users\\Admin\\AppData\\Local\\dv692700x\\yesbron.com\"" qm4623.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\f1464Adm = "\"C:\\Users\\Admin\\AppData\\Local\\dv692700x\\yesbron.com\"" m4623.exe Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\N4308c = "\"C:\\Windows\\_default27282.pif\"" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\f1464Adm = "\"C:\\Users\\Admin\\AppData\\Local\\dv692700x\\yesbron.com\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\N4308c = "\"C:\\Windows\\_default27282.pif\"" qm4623.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\N4308c = "\"C:\\Windows\\_default27282.pif\"" m4623.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\f1464Adm = "\"C:\\Users\\Admin\\AppData\\Local\\dv692700x\\yesbron.com\"" fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\N4308c = "\"C:\\Windows\\_default27282.pif\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\N4308c = "\"C:\\Windows\\_default27282.pif\"" services.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\f1464Adm = "\"C:\\Users\\Admin\\AppData\\Local\\dv692700x\\yesbron.com\"" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\N4308c = "\"C:\\Windows\\_default27282.pif\"" lsass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\f1464Adm = "\"C:\\Users\\Admin\\AppData\\Local\\dv692700x\\yesbron.com\"" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\N4308c = "\"C:\\Windows\\_default27282.pif\"" fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe -
Disables RegEdit via registry modification 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" services.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lsass.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" qm4623.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" m4623.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts csrss.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation smss.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation lsass.exe Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe -
Executes dropped EXE 7 IoCs
pid Process 1960 smss.exe 3356 winlogon.exe 3952 services.exe 2184 csrss.exe 3164 lsass.exe 1396 qm4623.exe 2404 m4623.exe -
Adds Run key to start application 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1464Adm = "\"C:\\Windows\\system32\\s4827\\zh59927084y.exe\"" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N4308c = "\"C:\\Windows\\j6272822.exe\"" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1464Adm = "\"C:\\Windows\\system32\\s4827\\zh59927084y.exe\"" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N4308c = "\"C:\\Windows\\j6272822.exe\"" qm4623.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1464Adm = "\"C:\\Windows\\system32\\s4827\\zh59927084y.exe\"" services.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1464Adm = "\"C:\\Windows\\system32\\s4827\\zh59927084y.exe\"" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N4308c = "\"C:\\Windows\\j6272822.exe\"" lsass.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1464Adm = "\"C:\\Windows\\system32\\s4827\\zh59927084y.exe\"" qm4623.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1464Adm = "\"C:\\Windows\\system32\\s4827\\zh59927084y.exe\"" m4623.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N4308c = "\"C:\\Windows\\j6272822.exe\"" m4623.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1464Adm = "\"C:\\Windows\\system32\\s4827\\zh59927084y.exe\"" fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N4308c = "\"C:\\Windows\\j6272822.exe\"" fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1464Adm = "\"C:\\Windows\\system32\\s4827\\zh59927084y.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N4308c = "\"C:\\Windows\\j6272822.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N4308c = "\"C:\\Windows\\j6272822.exe\"" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N4308c = "\"C:\\Windows\\j6272822.exe\"" csrss.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: lsass.exe File opened (read-only) \??\X: lsass.exe File opened (read-only) \??\Z: lsass.exe File opened (read-only) \??\E: lsass.exe File opened (read-only) \??\G: lsass.exe File opened (read-only) \??\J: lsass.exe File opened (read-only) \??\P: lsass.exe File opened (read-only) \??\R: lsass.exe File opened (read-only) \??\I: lsass.exe File opened (read-only) \??\N: lsass.exe File opened (read-only) \??\Q: lsass.exe File opened (read-only) \??\T: lsass.exe File opened (read-only) \??\V: lsass.exe File opened (read-only) \??\H: lsass.exe File opened (read-only) \??\L: lsass.exe File opened (read-only) \??\M: lsass.exe File opened (read-only) \??\U: lsass.exe File opened (read-only) \??\Y: lsass.exe File opened (read-only) \??\K: lsass.exe File opened (read-only) \??\O: lsass.exe File opened (read-only) \??\W: lsass.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\s4827\smss.exe qm4623.exe File opened for modification C:\Windows\SysWOW64\s4827\smss.exe m4623.exe File opened for modification C:\Windows\SysWOW64\s4827 fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe File created C:\Windows\SysWOW64\c_27282k.com fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\c_27282k.com winlogon.exe File opened for modification C:\Windows\SysWOW64\c_27282k.com csrss.exe File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exe qm4623.exe File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exe m4623.exe File created C:\Windows\SysWOW64\s4827\smss.exe fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe File created C:\Windows\SysWOW64\s4827\smss.exe smss.exe File opened for modification C:\Windows\SysWOW64\s4827 winlogon.exe File opened for modification C:\Windows\SysWOW64\s4827\smss.exe services.exe File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exe services.exe File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exe lsass.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll m4623.exe File opened for modification C:\Windows\SysWOW64\s4827\smss.exe fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\s4827 smss.exe File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exe smss.exe File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll smss.exe File created C:\Windows\SysWOW64\s4827\zh59927084y.exemsatr.bin smss.exe File opened for modification C:\Windows\SysWOW64\c_27282k.com services.exe File opened for modification C:\Windows\SysWOW64\s4827\domlist.txt lsass.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll qm4623.exe File opened for modification C:\Windows\SysWOW64\s4827\smss.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\s4827\csrss.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll services.exe File opened for modification C:\Windows\SysWOW64\s4827\smss.exe lsass.exe File opened for modification C:\Windows\SysWOW64\c_27282k.com fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\s4827\lsass.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\s4827 services.exe File opened for modification C:\Windows\SysWOW64\s4827 m4623.exe File opened for modification C:\Windows\SysWOW64\c_27282k.com smss.exe File created C:\Windows\SysWOW64\s4827\csrss.exe winlogon.exe File created C:\Windows\SysWOW64\s4827\smss.exe m4623.exe File created C:\Windows\SysWOW64\s4827\zh59927084y.exe fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe File created C:\Windows\SysWOW64\s4827\smss.exe services.exe File opened for modification C:\Windows\SysWOW64\s4827\smss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\s4827 lsass.exe File created C:\Windows\SysWOW64\s4827\smss.exe winlogon.exe File created C:\Windows\SysWOW64\s4827\lsass.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exe csrss.exe File created C:\Windows\SysWOW64\s4827\domlist.txt cmd.exe File opened for modification C:\Windows\SysWOW64\c_27282k.com qm4623.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll lsass.exe File created C:\Windows\SysWOW64\s4827\c.bron.tok.txt lsass.exe File created C:\Windows\SysWOW64\c_27282k.com qm4623.exe File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exe fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe File created C:\Windows\SysWOW64\s4827\winlogon.exe smss.exe File opened for modification C:\Windows\SysWOW64\s4827 csrss.exe File created C:\Windows\SysWOW64\s4827\zh59927084y.exe m4623.exe File created C:\Windows\SysWOW64\s4827\smss.exe csrss.exe File created C:\Windows\SysWOW64\s4827\Spread.Mail.Bro\[email protected] services.exe File opened for modification C:\Windows\SysWOW64\c_27282k.com lsass.exe File opened for modification C:\Windows\SysWOW64\c_27282k.com m4623.exe File created C:\Windows\SysWOW64\s4827\zh59927084y.exe qm4623.exe File opened for modification C:\Windows\SysWOW64\s4827\smss.exe smss.exe File opened for modification C:\Windows\SysWOW64\s4827\services.exe winlogon.exe File created C:\Windows\SysWOW64\s4827\smss.exe lsass.exe File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exemsatr.bin smss.exe File opened for modification C:\Windows\SysWOW64\s4827 qm4623.exe File opened for modification C:\Windows\SysWOW64\s4827\smss.exe qm4623.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\s4827\winlogon.exe winlogon.exe -
Drops file in Windows directory 38 IoCs
description ioc Process File opened for modification C:\Windows\j6272822.exe fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe File opened for modification C:\Windows\j6272822.exe qm4623.exe File created C:\Windows\o4272827.exe m4623.exe File opened for modification C:\Windows\o4272827.exe fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe File opened for modification C:\Windows\j6272822.exe smss.exe File opened for modification C:\Windows\o4272827.exe smss.exe File opened for modification C:\Windows\Ad10218\qm4623.exe winlogon.exe File opened for modification C:\Windows\j6272822.exe lsass.exe File opened for modification C:\Windows\o4272827.exe csrss.exe File opened for modification C:\Windows\o4272827.exe qm4623.exe File created C:\Windows\o4272827.exe qm4623.exe File opened for modification C:\Windows\_default27282.pif fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe File opened for modification C:\Windows\j6272822.exe csrss.exe File created C:\Windows\j6272822.exe m4623.exe File opened for modification C:\Windows\o4272827.exe lsass.exe File opened for modification C:\Windows\_default27282.pif csrss.exe File opened for modification C:\Windows\o4272827.exe m4623.exe File created C:\Windows\j6272822.exe fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe File opened for modification C:\Windows\_default27282.pif smss.exe File created C:\Windows\Ad10218\qm4623.exe winlogon.exe File created C:\Windows\o4272827.exe lsass.exe File created C:\Windows\j6272822.exe qm4623.exe File opened for modification C:\Windows\o4272827.exe winlogon.exe File opened for modification C:\Windows\_default27282.pif winlogon.exe File opened for modification C:\Windows\_default27282.pif services.exe File created C:\Windows\_default27282.pif lsass.exe File created C:\Windows\_default27282.pif m4623.exe File opened for modification C:\Windows\o4272827.exe services.exe File opened for modification C:\Windows\_default27282.pif m4623.exe File created C:\Windows\_default27282.pif fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe File opened for modification C:\Windows\j6272822.exe winlogon.exe File opened for modification C:\Windows\Ad10218 winlogon.exe File opened for modification C:\Windows\_default27282.pif qm4623.exe File created C:\Windows\o4272827.exe fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe File opened for modification C:\Windows\j6272822.exe services.exe File opened for modification C:\Windows\j6272822.exe m4623.exe File opened for modification C:\Windows\_default27282.pif lsass.exe File created C:\Windows\_default27282.pif qm4623.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Discovers systems in the same network 1 TTPs 1 IoCs
pid Process 1936 net.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe 3356 winlogon.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 3964 wrote to memory of 1960 3964 fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe 89 PID 3964 wrote to memory of 1960 3964 fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe 89 PID 3964 wrote to memory of 1960 3964 fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe 89 PID 1960 wrote to memory of 3356 1960 smss.exe 91 PID 1960 wrote to memory of 3356 1960 smss.exe 91 PID 1960 wrote to memory of 3356 1960 smss.exe 91 PID 3356 wrote to memory of 3952 3356 winlogon.exe 95 PID 3356 wrote to memory of 3952 3356 winlogon.exe 95 PID 3356 wrote to memory of 3952 3356 winlogon.exe 95 PID 3356 wrote to memory of 2184 3356 winlogon.exe 98 PID 3356 wrote to memory of 2184 3356 winlogon.exe 98 PID 3356 wrote to memory of 2184 3356 winlogon.exe 98 PID 3356 wrote to memory of 3164 3356 winlogon.exe 100 PID 3356 wrote to memory of 3164 3356 winlogon.exe 100 PID 3356 wrote to memory of 3164 3356 winlogon.exe 100 PID 3356 wrote to memory of 1396 3356 winlogon.exe 102 PID 3356 wrote to memory of 1396 3356 winlogon.exe 102 PID 3356 wrote to memory of 1396 3356 winlogon.exe 102 PID 3356 wrote to memory of 2404 3356 winlogon.exe 104 PID 3356 wrote to memory of 2404 3356 winlogon.exe 104 PID 3356 wrote to memory of 2404 3356 winlogon.exe 104 PID 3356 wrote to memory of 4312 3356 winlogon.exe 108 PID 3356 wrote to memory of 4312 3356 winlogon.exe 108 PID 3356 wrote to memory of 4312 3356 winlogon.exe 108 PID 3356 wrote to memory of 2764 3356 winlogon.exe 110 PID 3356 wrote to memory of 2764 3356 winlogon.exe 110 PID 3356 wrote to memory of 2764 3356 winlogon.exe 110 PID 3356 wrote to memory of 4416 3356 winlogon.exe 113 PID 3356 wrote to memory of 4416 3356 winlogon.exe 113 PID 3356 wrote to memory of 4416 3356 winlogon.exe 113 PID 3164 wrote to memory of 1828 3164 lsass.exe 120 PID 3164 wrote to memory of 1828 3164 lsass.exe 120 PID 3164 wrote to memory of 1828 3164 lsass.exe 120 PID 1828 wrote to memory of 1936 1828 cmd.exe 122 PID 1828 wrote to memory of 1936 1828 cmd.exe 122 PID 1828 wrote to memory of 1936 1828 cmd.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb568481fb808dcbea29f7a12e124bc9_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\s4827\smss.exe"C:\Windows\system32\s4827\smss.exe" ~Brontok~Log~2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\s4827\winlogon.exe"C:\Windows\system32\s4827\winlogon.exe" ~Brontok~Is~The~Best~3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\s4827\services.exe"C:\Windows\system32\s4827\services.exe" ~Brontok~Serv~4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:3952
-
-
C:\Windows\SysWOW64\s4827\csrss.exe"C:\Windows\system32\s4827\csrss.exe" ~Brontok~SpreadMail~4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:2184
-
-
C:\Windows\SysWOW64\s4827\lsass.exe"C:\Windows\system32\s4827\lsass.exe" ~Brontok~Network~4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c net view /domain > "C:\Windows\system32\s4827\domlist.txt"5⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\net.exenet view /domain6⤵
- Discovers systems in the same network
PID:1936
-
-
-
-
C:\Windows\Ad10218\qm4623.exe"C:\Windows\Ad10218\qm4623.exe" ~Brontok~Back~Log~4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:1396
-
-
C:\Windows\SysWOW64\s4827\m4623.exe"C:\Windows\system32\s4827\m4623.exe" ~Brontok~Back~Log~4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:2404
-
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe" /delete /y4⤵PID:4312
-
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe" 17:08 /every:M,T,W,Th,F,S,Su "C:\Users\Admin\AppData\Local\jalak-93927015-bali.com"4⤵PID:2764
-
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe" 11:03 /every:M,T,W,Th,F,S,Su "C:\Users\Admin\AppData\Local\jalak-93927015-bali.com"4⤵PID:4416
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5a8cacfa59e6e2fbcd605f4c70fc61934
SHA1fb0e87f814617703fae04ff6b3f387f537f750d1
SHA2561cf7dee7be3a01862a44ae9de4b91fb822a06a36427ccdcbd2c17e5cab84a427
SHA512042e1c9d2f8e290b2b6281114150992980ee16121b5ac25b5ab1739351b55c229878bd95b0292955c19ea89340c4fc34e832c96dfc8a6efe31bbcadc492e5e30
-
Filesize
97KB
MD5fb568481fb808dcbea29f7a12e124bc9
SHA1489bc6b83f86e3233be44d17d2c02674aba20884
SHA256f4c88afedcd39ddc4fffc9de1da87a17da6bdd4af6332f9eace560ad4f7f9cbf
SHA512d39bbce5d891b78c79dc48e14bc174a4d842a4763dbc69849341e7e5571bec244554d5a351b22d9e5fdc6bf03ec49d375f40a8252116cc6ebcc81db22411be7a
-
Filesize
97KB
MD51d33500b37f027f7e839c7636d0af863
SHA1dbfab02e91a9fe9c59205935dbb08d77ea849968
SHA256823e076d5bae11883e7db0ded89defe90275b7cd085bf337930076cac5d4af24
SHA512eddf55cb24e1462a475fdeb21ac6314438bd3c4a56ac39db2978a9811f88765ed81c841be9fa770d7466c5b071872fbbcbc1a959ab4d14e36645d13697f23cce
-
Filesize
97KB
MD5d05881686d139d08117ab2d6f4e78c7d
SHA1fe4a172213805cd1ac3109e5d6ffe3ecb58f6b0f
SHA25612f5e434542931eafd0f66c96667e47d5ba762a1c8077d702f8798283a17068f
SHA5120ede5ac399e35977be5572c97885e922b8b1da3d724471e93827c525ddce0ab5f9dbcc79cad78672343cc6082ed975f96e1c9ecc3fd7590a203cc03cf069842b
-
Filesize
97KB
MD5de6b9cfa63c0a2cd0bd1a5338e05877e
SHA1d23b15731119355de3b71ba51807a0b14f86e86d
SHA256776a052009a5a4fa052289e661b8daec880d869472ffe25f52527a3ec9737ac7
SHA512d4b29f355f08010748730cfbb3ddf204e14388d190d2bb2b2c7ab8cc167dd4c100c7a00d5cdccd346a66ff8b2af59255ca87b110dfbff86df737f064b05d7415