Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 18:36
Behavioral task
behavioral1
Sample
fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
-
Size
301KB
-
MD5
fd60ad05941f2bee3dfd05c976bc2eff
-
SHA1
eae3af05983d5e47ebb3f228f98517f9a3806376
-
SHA256
2753c8b0d7cc891d9f9665e82cefcdc085064810ec8c0cb1988c36bbc0938bc7
-
SHA512
b16dbd2bb8c169bb5e772469f2bd98947e74dd7c30a1899b3416da6b2c967c6644baf97f138192b725e343233ec10c4b2516c889b7f0e302f0161392052c522b
-
SSDEEP
6144:tmcD66R7M5JGmrpQsK3RD2u270jupCJsCxC:4cD66DZ2zkPaCx
Malware Config
Extracted
cybergate
2.6
vítima
mise1.zapto.org:5210
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
título da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{5VA86RD0-3W22-6R73-7QS8-ODE408423R68} fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5VA86RD0-3W22-6R73-7QS8-ODE408423R68}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
server.exepid process 2336 server.exe -
Loads dropped DLL 2 IoCs
Processes:
fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exepid process 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/3040-298-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/2336-2088-0x00000000318E0000-0x00000000318ED000-memory.dmp upx behavioral1/memory/2336-2166-0x00000000318E0000-0x00000000318ED000-memory.dmp upx behavioral1/memory/3040-2798-0x0000000024010000-0x0000000024072000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe -
Drops file in System32 directory 4 IoCs
Processes:
fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exefd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\install\server.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\install\server.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\install\ fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe File created C:\Windows\SysWOW64\install\server.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exefd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exepid process 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exepid process 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe Token: SeDebugPrivilege 3040 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exedescription pid process target process PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe PID 3000 wrote to memory of 3040 3000 fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}4⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fd60ad05941f2bee3dfd05c976bc2eff_JaffaCakes118.exe"3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\install\server.exe"C:\Windows\system32\install\server.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
240KB
MD540bf045a90c5af86f363d052477f951e
SHA1ff32c907dca090c8e3cba347708964cf213bc4a9
SHA256bf3afb0a67cadfa0f7cd76d91da74b80bfee530c5a5ac266c41a7ccde4a77104
SHA5122518a062a9141a6cd9e7216217f89f496cecb81688939664dda7067dfb52ee92fa8e0bc6f956f32c2542a10cbb2a2a374999d4ac551cffe8e7f3a43cb2291c58
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD533915267c1ef3bbd0550b143f8d2bc68
SHA17d11951b5ece4e421ddc56d040533e2b6cbdea54
SHA256cf3f5d41a232ad7c422f1e05dc345f9b895a847698ae4b2a8e4e9499c6eac999
SHA512c66d4abf6163c8122c867ba71dd0dc68904d58322c87ea4fadfb5664adaee3641c19790e57251d6945fadb4bd476d486cc4f0b943eebbb4807210991319aa2c6
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD5d850110327de35422695a8525226f0ec
SHA17802b0c220afa550f682182501d0e9b5d1af89c4
SHA256b4761afcbcd7bd7fc678890c2eadded5bd74496c1e15b6cc68cd9d0dcec39062
SHA5127124c9e609d373370e4beee4372fb2ccca45836e46658b9256985520048c797298c4be5bc2e3d28761d7e84e0a6479d46114870dfc21b5811afe51f08cc3088b
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD5132d20c4b9bcef08badb2e3b8853a17a
SHA1c98d4f1b2e09f9c65206595d61fcfca4c5c283ac
SHA256eb414e8319e117f94582fc14fdb8ae075df1a64ffce74d248931cb2e77bee3fa
SHA51235c2a57583655c3f13199e6b9f2cbf7f8de5b36aef0da067e3a7b161da007e0e01e35c5e67eccd5dab5c04fb0601946f33eefbcd64e730ae6bfce46e481392fb
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD56306f1c8dd43d49c356faf4e80074318
SHA175b79d031e1bdbc0f126d12df14370b1f7d83b91
SHA25664db5087f21e4431c5fc4c2fc49ac89020b390ced14b0ccba3258991b5302b7a
SHA512d353920c33c3e363065aa38abca40449a70e6fe57333770f5fd7898dfc913764212a29e053296edcd4ef06968fb8578f23a9ed98932928b9ef7ee8607055b51c
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD596c41ea474b5255d400a4be3a23ccef2
SHA154d36e91e748763e8816c3ccbcfa444928c141bc
SHA256984e52144e570e23ca939c4bb771766aa7bb92bfb6aa1bb08dd4f7cb27c0d90c
SHA512b61ef7db9dc8d61cd66f7d3bb4bd6c7bc589970df239f62d1c044466a28a68cf6cff12c104a73f1264d061a78e9400ac02c5033884db3da51c240a427f0a2ebf
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD56ad93990f1ee39cb9a312a8d3e847424
SHA1d3411ba661d91739ae9a41e4533992416fe24ff6
SHA256cc963f9b2e0d2f002caa6a7438ddd9f0341518ddf518713a05438d8b401a0259
SHA512102d384bb013f8fc556e4223a39896924a35a40bbc9219e4f09b8be2bd8780e42eaba5f5d5d7824c8b621a2651770f59f5940b89062170e69bd4e658fe121e66
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD5528c30e1d1347c2c01395b83924933d2
SHA1ee5ee048d7fb597ec6f4701c6b25d8f41b72f9e6
SHA2561063c0da8c861b66cd38ce1dc85a635ee3501874f248a43db4344d6b64c321c3
SHA512b8db265a4f5b18175d9480df93694c9fcc719c7c9cbaf6b0b5dffce2048ba18c73677b26e204056894c6b67d5b61779991fd829291cef71ba832370003a4a4d0
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD52164c33f7f6444950cc38d14cf10970e
SHA1016b85aeaaa5dfe13c69e10851bf85463c82c798
SHA256070aaa5312339c0c1baa2dd6a7dcdb73919bb29cc920ebb47687572b4b0e59cd
SHA51258bbca70ea1fe14e009451e1a450bf9b0341728cc0890cd910d9c803b77aafd65cc7fc5f432844d312ff75d5ca72190455d5acb433dd2529f0467b1bf630a43d
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD52fc581dd4d9a0e74a1468ac56646e634
SHA16d4f81ba3d6fff834815c344561e50139afc02cc
SHA256298708be31ed1228cc8899e777e1c0f5cc0bf59226853ee591e30f713ea80fc1
SHA5126aa28222f52b18b4b978cc0caf2dd6a25e5d3a1fe1adbfd46a51ce11778e094c68fcdffbdc1300555577ad8e2a8a9c1b742c50612ab18cecc9e2aacc74f75183
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD51023e0ffca3c554bce8a5006dfaf16ab
SHA171b6c29e88a7417d3993ad9ae6ac47455edc9d46
SHA256487cea35d8e94e078fcd8500afb382dedfd2e2b97fa94f2858fc50bc05601aff
SHA5123607f0a4efd88f0b36adfac63c42f0f7d3b9c59010f73f41e83a338480eb70b087fe4cec0a41ce3b7b3e69f8ebbb8fa6aa10f19bc0ef8b531ab20f00dc891f9b
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD56c23a8299977a34533d12840c875e9a1
SHA1d09f3336add89da7d21775d1f9161beabaefcbc2
SHA256c1d98d505911d64982e3fa57c935168d84438a7bed1316d943514d5304a97a3d
SHA5127afdd12b36ede4be3891dcbb197226b61d2d68e7fd97e5302a4752e82de898f9f6514bace7fe74b552daa62986cc6ad17a9bb5c813fad55fdc45587bb0d8fa92
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD5351e07048840ac5ca6cf00d5ce52dd6f
SHA12d1f973b185a058e2ed626bc4f5b27b7bedabe7e
SHA2568a7abeb475285b0d4b21b79017dafd55f0b94a3c5e8ec406183ca0414a7b8fcb
SHA512c0680d49da57f3a1d926f9811287d98f28955a2ae9112c8a6e963dca7774234207a3d7bab42d93a61834334b15bb4c5570ee0d0967b02d5a19e03dfea57d7391
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD5db0f22a8ea8ce5955c1755ffebae74a8
SHA1d17e343970edf1494b64f04bb69e945ad51267d3
SHA256b429b9d7c686c11b5d8a301da753792a5d748a732da363fef65ce33d2c4e9544
SHA5122eda830c1cf5de435885393542777d134b69f440f2a774ad6e7a966aebe2e436dc0f8259298e4b9ffbb69baf820d85c44ca6aef9c8654179b090e9997ebb6602
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD5892fc721f259562a132c096eb807acee
SHA1053f445ce0266cac3842cf1d2edfd31ebd554d1c
SHA2561b6cf228db17f10b050a366f90e459971abc28d969ca13d72d14f182da8e6584
SHA512ece5b6c5c650057a76baadf5bdee0e38e95e7ddccf7b40f3bc34bb13fcc354c53ff4dd6a0ade4ee483aac1e6a418a02c8732e00a1ced6ed880a0bd54289adda6
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD5d176f6a5ee75b483ef9461e9754332c5
SHA18e2357cc49c50c1f76ad517ff06ce7a23b19d5b0
SHA2565f74120e3c286d92a6227cb10d297014e254d1de189cefccf19ecf7511b32a33
SHA512120b8a7546109c01d840a9946ea1d9c0671edc58dffb74a4aee7fffb026535f8e8087c6eef8595be357fd630d3f9ad4461b64920962f0013940a5364689e968f
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD5016e5104945f67769a62c15ac5b3d867
SHA10ab3167bcd34dde302e70698abf1586f7f902595
SHA2563af6b48fade70cb47832f0cebefa7857dc20b7ac805f71b641dc8b5314c5dd38
SHA512a5b09e51e7c4f0d6e914254465318f91bbffdeca3b0137feb94572d2d5721fb842a01be38e09ebbd6e4e7bd08572444c170c7bee5cb607ce9d8a990a5ced7ab3
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD525bf3b84b377874470022c402048eb88
SHA1286e2f4deb80587ea42eda4ba62db61e03597308
SHA256bab2f4d2c10b50f3fe361e715f7773cc2c5ce234da53128d802336fa51043b4b
SHA512078dfd1dc8e43d3636495600adf7843d93106e1fb7f0858cc30e24ed9aab6b8eba61fa63ae2ee8c757e183b70479ea73121ad05e7c564169efac9f91193c1496
-
C:\Users\Admin\AppData\Local\Temp\XxX.xXxFilesize
8B
MD5ce2749b0c218bd1567d02f953e611854
SHA111f0f324d7a5fb2fd96cd9d833e72e97b81db436
SHA256ba89dd609a99c8b19f70d79af1fae06e13c6b1b9e653c32855f8d304afb40361
SHA512b038839b3a2bba223fb09c4d1087f8190669fa3c26d262b3e4a565bcaecd2908b509556ec66f1511f1f63c45910525d5eaaea672d8df56c17792fb181c6cdd1e
-
C:\Users\Admin\AppData\Roaming\logs.datFilesize
15B
MD5e21bd9604efe8ee9b59dc7605b927a2a
SHA13240ecc5ee459214344a1baac5c2a74046491104
SHA25651a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
SHA51242052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493
-
C:\Windows\SysWOW64\install\server.exeFilesize
301KB
MD5fd60ad05941f2bee3dfd05c976bc2eff
SHA1eae3af05983d5e47ebb3f228f98517f9a3806376
SHA2562753c8b0d7cc891d9f9665e82cefcdc085064810ec8c0cb1988c36bbc0938bc7
SHA512b16dbd2bb8c169bb5e772469f2bd98947e74dd7c30a1899b3416da6b2c967c6644baf97f138192b725e343233ec10c4b2516c889b7f0e302f0161392052c522b
-
memory/2336-2032-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/2336-2166-0x00000000318E0000-0x00000000318ED000-memory.dmpFilesize
52KB
-
memory/2336-2088-0x00000000318E0000-0x00000000318ED000-memory.dmpFilesize
52KB
-
memory/2336-2031-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/3040-2798-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/3040-3-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/3040-298-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/3040-15-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/3040-6-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB