9f108d3210afe4fd08c411caa2cd5540c7d1501b419018c193d30eccca8b02df

General

Target

1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe
Size

731KB
MD5

1c7ed964dddd78ee5e8d3427e39fb613
SHA1

e34a8c0d58ffe8228ccd18adcab3bd155012f7bb
SHA256

9f108d3210afe4fd08c411caa2cd5540c7d1501b419018c193d30eccca8b02df
SHA512

e2995588fd9b0a02e19f1eb9443d507b6160ae34a6e6d5b7d8749ae895eceda19cdf55c24d1b563bb8841c6dc05fdcf8a8b857f5ccfdede7ebbeeee8d8d3546b
SSDEEP

12288:164z/NTF6hT2H72/3DTYFC24a10Yw54xs0FzNiqosdA6F5mSZ/:gWF6hTCq3YFD4eosa6/

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

zdejkye.exezdejkye.exe

pid process

1040 zdejkye.exe
4648 zdejkye.exe

pid	process
1040	zdejkye.exe
4648	zdejkye.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

File opened (read-only) \??\F: svchost.exe

description	ioc	process
File opened (read-only)	\??\F:	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exezdejkye.exe

description	pid	process	target process
PID 4624 set thread context of 3156	4624	1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe	1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe
PID 1040 set thread context of 4648	1040	zdejkye.exe	zdejkye.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2884 4648 WerFault.exe zdejkye.exe
4500 4648 WerFault.exe zdejkye.exe

pid	pid_target	process	target process
2884	4648	WerFault.exe	zdejkye.exe
4500	4648	WerFault.exe	zdejkye.exe

Modifies data under HKEY_USERS 23 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{bb0c4c32-0000-0000-0000-f0ff3a000000}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{bb0c4c32-0000-0000-0000-f0ff3a000000}\MaxCapacity = "2047"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{bb0c4c32-0000-0000-0000-d01200000000}\MaxCapacity = "14116"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{bb0c4c32-0000-0000-0000-d01200000000}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{bb0c4c32-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{bb0c4c32-0000-0000-0000-f0ff3a000000}\NukeOnDelete = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00620062003000630034006300330032002d0030003000300030002d0030003000300030002d0030003000300030002d006400300031003200300030003000300030003000300030007d00000030002c007b00620062003000630034006300330032002d0030003000300030002d0030003000300030002d0030003000300030002d006600300066006600330061003000300030003000300030007d0000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe

Modifies registry class 32 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133594721786074866"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133594721441075077"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133594721758262389"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133594721770449946"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133594721769043582"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133594722109043719"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133594722114356286"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133594721112949894"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\PCT = "133579878873416712"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\ICT = "133579878875292108"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133594721436387426"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133594721444981278"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133594721778731168"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133594721430762507"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133594722107012626"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133594722108262343"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133594721103731225"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exezdejkye.exe

pid	process
3156	1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe
3156	1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe
4648	zdejkye.exe
4648	zdejkye.exe
4648	zdejkye.exe
4648	zdejkye.exe
4648	zdejkye.exe
4648	zdejkye.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

zdejkye.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	4648	zdejkye.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe
Token: SeTcbPrivilege	780	svchost.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exezdejkye.exezdejkye.exesvchost.exe

description	pid	process	target process
PID 4624 wrote to memory of 3156	4624	1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe	1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe
PID 4624 wrote to memory of 3156	4624	1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe	1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe
PID 4624 wrote to memory of 3156	4624	1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe	1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe
PID 4624 wrote to memory of 3156	4624	1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe	1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe
PID 4624 wrote to memory of 3156	4624	1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe	1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe
PID 1040 wrote to memory of 4648	1040	zdejkye.exe	zdejkye.exe
PID 1040 wrote to memory of 4648	1040	zdejkye.exe	zdejkye.exe
PID 1040 wrote to memory of 4648	1040	zdejkye.exe	zdejkye.exe
PID 1040 wrote to memory of 4648	1040	zdejkye.exe	zdejkye.exe
PID 1040 wrote to memory of 4648	1040	zdejkye.exe	zdejkye.exe
PID 4648 wrote to memory of 780	4648	zdejkye.exe	svchost.exe
PID 780 wrote to memory of 112	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 112	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 112	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 2576	780	svchost.exe	DllHost.exe
PID 780 wrote to memory of 2576	780	svchost.exe	DllHost.exe
PID 780 wrote to memory of 4164	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 4164	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 4164	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 1336	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 1336	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 1336	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 1908	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 1908	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 1908	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 3220	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 3220	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 3220	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 4864	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 4864	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 4864	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 5104	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 5104	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 5104	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 1296	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 1296	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 1296	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 636	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 636	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 636	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 4384	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 4384	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 4384	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 1004	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 1004	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 1004	780	svchost.exe	BackgroundTransferHost.exe
PID 780 wrote to memory of 1672	780	svchost.exe	DllHost.exe
PID 780 wrote to memory of 1672	780	svchost.exe	DllHost.exe
PID 780 wrote to memory of 1640	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 1640	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 1640	780	svchost.exe	backgroundTaskHost.exe
PID 780 wrote to memory of 5036	780	svchost.exe	BackgroundTaskHost.exe
PID 780 wrote to memory of 5036	780	svchost.exe	BackgroundTaskHost.exe
PID 780 wrote to memory of 5036	780	svchost.exe	BackgroundTaskHost.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:112
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:2576
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4164
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:1336
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:1908
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:3220
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4864
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:5104
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:1296
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:636
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:4384
- C:\Windows\system32\BackgroundTransferHost.exe
  "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
  2⤵
  PID:1004
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:1672
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:1640
- C:\Windows\system32\BackgroundTaskHost.exe
  "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
  2⤵
  PID:5036

C:\Users\Admin\AppData\Local\Temp\1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Local\Temp\1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\1c7ed964dddd78ee5e8d3427e39fb613_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3156

C:\Users\Admin\AppData\Local\Temp\zdejkye.exe
C:\Users\Admin\AppData\Local\Temp\zdejkye.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Users\Admin\AppData\Local\Temp\zdejkye.exe
  "C:\Users\Admin\AppData\Local\Temp\zdejkye.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 656
    3⤵
    - Program crash
    PID:2884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 676
    3⤵
    - Program crash
    PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4648 -ip 4648
1⤵
PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4648 -ip 4648
1⤵
PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SoftwareDistribution\fexlhzi

Filesize
654B

MD5
c56f94cd3b37a4cfb2a4963bd150d6b7

SHA1
ac7276f65b2601f68408d947475f16420d130b3f

SHA256
1e7594c7d039dbf626103532a78d1696615068578bb0df919ec3e166d50ad8e3

SHA512
d94848767ae7bbb872fcd34e063cb330db483d870b0156c9e84a9cdc5b359551f2c522e895c871ddd52f3d564dee2e9a5d46def1d072b4b515ad3c4d04b7347d

Download Submit
C:\Users\Admin\AppData\Local\Temp\zdejkye.exe

Filesize
731KB

MD5
1c7ed964dddd78ee5e8d3427e39fb613

SHA1
e34a8c0d58ffe8228ccd18adcab3bd155012f7bb

SHA256
9f108d3210afe4fd08c411caa2cd5540c7d1501b419018c193d30eccca8b02df

SHA512
e2995588fd9b0a02e19f1eb9443d507b6160ae34a6e6d5b7d8749ae895eceda19cdf55c24d1b563bb8841c6dc05fdcf8a8b857f5ccfdede7ebbeeee8d8d3546b

Download Submit
F:\$RECYCLE.BIN\S-1-5-18\desktop.ini

Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
memory/780-17-0x0000000005610000-0x0000000005687000-memory.dmp

Filesize
476KB

Download
memory/780-51-0x0000000005610000-0x0000000005687000-memory.dmp

Filesize
476KB

Download
memory/780-20-0x0000000005610000-0x0000000005687000-memory.dmp

Filesize
476KB

Download
memory/780-3400-0x0000000005610000-0x0000000005687000-memory.dmp

Filesize
476KB

Download
memory/780-225-0x0000000005610000-0x0000000005687000-memory.dmp

Filesize
476KB

Download
memory/780-19-0x0000000005610000-0x0000000005687000-memory.dmp

Filesize
476KB

Download
memory/780-25-0x0000000005610000-0x0000000005687000-memory.dmp

Filesize
476KB

Download
memory/780-23-0x0000000005610000-0x0000000005687000-memory.dmp

Filesize
476KB

Download
memory/3156-8-0x0000000000400000-0x00000000004A4600-memory.dmp

Filesize
657KB

Download
memory/3156-2-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/3156-0-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/3156-3-0x0000000000870000-0x0000000000A8A000-memory.dmp

Filesize
2.1MB

Download
memory/3156-4-0x0000000000A90000-0x0000000000CDB000-memory.dmp

Filesize
2.3MB

Download
memory/4648-14-0x0000000000960000-0x0000000000BAB000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads