f7c4f3251b3878671f36854e689e7e3c2b7222a17686ad2612b5d66f2e72e9fd

Analysis

max time kernel
150s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
Size

8.3MB
MD5

05a92bdd1ce967851f2d789a3c306eff
SHA1

73e4c9f6eb4da48fa4f91db4f71f93ad723296b7
SHA256

f7c4f3251b3878671f36854e689e7e3c2b7222a17686ad2612b5d66f2e72e9fd
SHA512

951efd424dd7e2836946ec07301af8e309cbd52045c5f919bf5d7f79b9d2de9c70cf416dc400fdd286c84363bf694e19514208d46dad7874f84b79d0cfb64775
SSDEEP

196608:N7effIPEsy58doQaTxLhQyZbIly38doQalArdfehQM2gsyVCQlXI1G8do8a888Fa:N7effIPEsy58doQaTxLhQyZbIly38doF

Score

10^/10

adware persistence stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\spools.exe	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\spools.exe	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spools.exe	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spools.exe	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe

Sets service image path in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe

ACProtect 1.3x - 1.4x DLL software 7 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000002346a-16.dat	acprotect
behavioral2/memory/2800-19-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral2/memory/2800-22-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral2/memory/5028-31-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral2/memory/5028-34-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral2/memory/3284-46-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral2/memory/3284-49-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect

Loads dropped DLL 3 IoCs

pid	Process
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
5028	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
3284	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002346a-16.dat	upx
behavioral2/memory/2800-19-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral2/memory/2800-22-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral2/memory/5028-31-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral2/memory/5028-34-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral2/memory/3284-46-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral2/memory/3284-49-0x0000000010000000-0x000000001010B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\G:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\U:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\H:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\G:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\T:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\T:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\W:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\J:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\R:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\I:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\O:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\T:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\W:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\E:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\P:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\V:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\V:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\J:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\P:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\J:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\R:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\L:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\M:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\T:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\X:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\N:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\N:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\N:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\V:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\J:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\P:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\R:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\G:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\H:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\S:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\M:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\I:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\Q:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\M:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\X:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\Q:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\I:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\U:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\Q:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\K:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\N:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\S:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\I:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\K:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\K:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\N:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\K:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\Q:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\G:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\O:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\O:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\O:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\P:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\M:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\R:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\U:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\H:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened (read-only)	\??\T:	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	reg.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost = "logonui.exe"	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ftpdll.dll	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ftpdll.dll	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ftpdll.dll	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2932	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2932	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2932	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
2932	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
5028	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
3284	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2932	2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	86
PID 2800 wrote to memory of 2932	2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	86
PID 2800 wrote to memory of 2932	2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	86
PID 2800 wrote to memory of 2812	2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	88
PID 2800 wrote to memory of 2812	2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	88
PID 2800 wrote to memory of 2812	2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	88
PID 2800 wrote to memory of 464	2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	89
PID 2800 wrote to memory of 464	2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	89
PID 2800 wrote to memory of 464	2800	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	89
PID 2932 wrote to memory of 5028	2932	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	91
PID 2932 wrote to memory of 5028	2932	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	91
PID 2932 wrote to memory of 5028	2932	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	91
PID 2932 wrote to memory of 3284	2932	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	93
PID 2932 wrote to memory of 3284	2932	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	93
PID 2932 wrote to memory of 3284	2932	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	93
PID 464 wrote to memory of 1624	464	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	95
PID 464 wrote to memory of 1624	464	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	95
PID 464 wrote to memory of 1624	464	05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Users\Admin\AppData\Local\Temp\05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
    3⤵
    - Drops file in Drivers directory
    - Sets service image path in registry
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:5028
- - C:\Users\Admin\AppData\Local\Temp\05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
    3⤵
    - Drops file in Drivers directory
    - Sets service image path in registry
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:3284
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
  2⤵
  - Installs/modifies Browser Helper Object
  PID:2812
- C:\Users\Admin\AppData\Local\Temp\05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
  2⤵
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Users\Admin\AppData\Local\Temp\05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\05a92bdd1ce967851f2d789a3c306eff_JaffaCakes118.exe
    3⤵
    - Enumerates connected drives
    PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
44d87d695ae8e5bc46e021fe5c69c3b1

SHA1
f3721082b90536bc145ce40900ffa0a8f439ed3c

SHA256
3fdf46e976b3ec1dbd30c0ba73de6b051b2d0c32c43e1e9b5db29af05d1a0165

SHA512
d615aad7d482cc27e18dfaeb2f67747919a19818e5fb71a73f2e078afa7cf943e31bf3051d5d577f4b4415f1ad2a122e5da97a5969ca32bbd89d826e9c4f94cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
b09d8360aa2a4dd525ee46e99810e5b4

SHA1
77267b4ba9e8f295a6c147f421adda1c40fb0522

SHA256
636209061ee63fa830b63468de4025bddf87dc5fdccbbe570b61bf689ee33a0f

SHA512
715c784cd50766a668232a2fcc895a64a7838953b6bcb04d3845683e961fbbac8ad8f868865cef52731c8b7673792e0fcc9078ff7ce55b64f179af103f88084a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
5240a0287489358156c1496bff1e8e85

SHA1
acee89298b81233e3c4a162e6612dac9e420ebfd

SHA256
7f683fec243ee7ebbc08c77581b5590b23d44854a2703362ce0e6fc39e5c52d6

SHA512
2dbb5715fcb8974b2dfb4eb705afa7963b03a72d17cc9df7e4f853f39951336ab82a3e0f9540b5b3e2a26ddeba7220ce9926db2822464277d8d5bb4ca2bb9c55

Download Submit
C:\Users\Admin\AppData\Local\cftmon.exe

Filesize
8.3MB

MD5
18fff685a476b340a0be640998dddfe9

SHA1
bb2a190dc680b4ef3b255303b34b56a57938f096

SHA256
6cf7180a6a9bda1abe5c5cbde4e88e174859f9cf99e3eb4d89e30caea1cfcc8f

SHA512
09cd67ac5d428b7776d0195c01ff357be44cf19c1d075242df512851fb5da7bf8f0ef1911281c4d3790e21b252e6cdf7ab7ffd634eada530a94c643f5a420b39

Download Submit
C:\Windows\SysWOW64\drivers\spools.exe

Filesize
8.3MB

MD5
86980cdc0797ac8450163170c68bfe33

SHA1
176ac3d5f6ede4b137a406390ddee41b1c6d8492

SHA256
8db9ca7b6dfc627906165511f1bd171310138387a3885d45f5ffcbf46966839e

SHA512
2fe5cb8d17ba2f217829aa0b496d5f58b15e261ac75698f4d8cfab46118538b98e01b43d7ed7a7f19526eafda42ceb11d7bdaf4bb992afe690918722f7e8e3a2

Download Submit
C:\Windows\SysWOW64\ftpdll.dll

Filesize
5KB

MD5
d807aa04480d1d149f7a4cac22984188

SHA1
ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9

SHA256
eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb

SHA512
875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e

Download Submit
memory/464-7-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/464-48-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1624-35-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1624-52-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2800-21-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2800-22-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/2800-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2800-19-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/2932-47-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3284-46-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/3284-49-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/3284-50-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/5028-34-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/5028-33-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/5028-31-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download