glupteba | 803f140bd2b1a74fe2334a0f68337fbd85adc6074dff8fc6bea58b6f2a5ab457

Analysis

max time kernel
138s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Size

3.8MB
MD5

468dcdb06c6733d0048a75360d52e1a4
SHA1

eb1ad2cb3ddb7ac6560cf30cc7c286bd31989b1d
SHA256

803f140bd2b1a74fe2334a0f68337fbd85adc6074dff8fc6bea58b6f2a5ab457
SHA512

b78b6e303b4264727e157e559fcb947c7016087e453d4449001a5378297fc6306cec59aabec418f4a08e32101d7e74eca689a8801de451dbb76c5e696f4b0909
SSDEEP

49152:ARuPPnhH53LFZLGbPG/mvDI7ZpZGyip8QCW3c7DfjqcPm93gBmXjKozboyujkXOa:AebSqmvkd6y/WcHjlm93kKKglWVJM

Score

10^/10

glupteba dropper evasion loader persistence trojan

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 14 IoCs

resource	yara_rule
behavioral1/memory/3040-2-0x00000000027E0000-0x0000000002ED1000-memory.dmp	family_glupteba
behavioral1/memory/3040-3-0x0000000000400000-0x0000000000B0B000-memory.dmp	family_glupteba
behavioral1/memory/3040-5-0x00000000027E0000-0x0000000002ED1000-memory.dmp	family_glupteba
behavioral1/memory/3040-7-0x0000000000400000-0x0000000000B0B000-memory.dmp	family_glupteba
behavioral1/memory/2644-10-0x0000000000400000-0x0000000000B0B000-memory.dmp	family_glupteba
behavioral1/memory/2644-20-0x0000000000400000-0x0000000000B0B000-memory.dmp	family_glupteba
behavioral1/memory/2432-33-0x0000000000400000-0x0000000000B0B000-memory.dmp	family_glupteba
behavioral1/memory/2432-34-0x0000000000400000-0x0000000000B0B000-memory.dmp	family_glupteba
behavioral1/memory/2432-35-0x0000000000400000-0x0000000000B0B000-memory.dmp	family_glupteba
behavioral1/memory/2432-36-0x0000000000400000-0x0000000000B0B000-memory.dmp	family_glupteba
behavioral1/memory/2432-38-0x0000000000400000-0x0000000000B0B000-memory.dmp	family_glupteba
behavioral1/memory/2432-40-0x0000000000400000-0x0000000000B0B000-memory.dmp	family_glupteba
behavioral1/memory/2432-42-0x0000000000400000-0x0000000000B0B000-memory.dmp	family_glupteba
behavioral1/memory/2432-45-0x0000000000400000-0x0000000000B0B000-memory.dmp	family_glupteba

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\QuietDream = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\cloudnet.exe = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2724	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
2432	csrss.exe

Loads dropped DLL 2 IoCs

pid	Process
2644	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
2644	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe

Windows security modification 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\cloudnet.exe = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\QuietDream = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\QuietDream = "\"C:\\Windows\\rss\\csrss.exe\""	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
File created	C:\Windows\rss\csrss.exe	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
File created	C:\Windows\Logs\CBS\CbsPersist_20240515141015.cab	makecab.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-552 = "North Asia Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-551 = "North Asia Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-521 = "N. Central Asia Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-581 = "North Asia East Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time"	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3040	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
3040	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
3040	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
3040	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
2644	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
2644	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
2644	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
2432	csrss.exe
2432	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
Token: SeImpersonatePrivilege	3040	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2748	2644	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe	33
PID 2644 wrote to memory of 2748	2644	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe	33
PID 2644 wrote to memory of 2748	2644	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe	33
PID 2644 wrote to memory of 2748	2644	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe	33
PID 2748 wrote to memory of 2724	2748	cmd.exe	35
PID 2748 wrote to memory of 2724	2748	cmd.exe	35
PID 2748 wrote to memory of 2724	2748	cmd.exe	35
PID 2644 wrote to memory of 2432	2644	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe	36
PID 2644 wrote to memory of 2432	2644	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe	36
PID 2644 wrote to memory of 2432	2644	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe	36
PID 2644 wrote to memory of 2432	2644	468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe	36

C:\Users\Admin\AppData\Local\Temp\468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3040
- C:\Users\Admin\AppData\Local\Temp\468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\468dcdb06c6733d0048a75360d52e1a4_JaffaCakes118.exe"
  2⤵
  - Windows security bypass
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Modifies data under HKEY_USERS
      PID:2724
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe ""
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:2432

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240515141015.log C:\Windows\Logs\CBS\CbsPersist_20240515141015.cab
1⤵
- Drops file in Windows directory
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\rss\csrss.exe

Filesize
3.8MB

MD5
468dcdb06c6733d0048a75360d52e1a4

SHA1
eb1ad2cb3ddb7ac6560cf30cc7c286bd31989b1d

SHA256
803f140bd2b1a74fe2334a0f68337fbd85adc6074dff8fc6bea58b6f2a5ab457

SHA512
b78b6e303b4264727e157e559fcb947c7016087e453d4449001a5378297fc6306cec59aabec418f4a08e32101d7e74eca689a8801de451dbb76c5e696f4b0909

Download Submit
memory/2432-35-0x0000000000400000-0x0000000000B0B000-memory.dmp

Filesize
7.0MB

Download
memory/2432-34-0x0000000000400000-0x0000000000B0B000-memory.dmp

Filesize
7.0MB

Download
memory/2432-42-0x0000000000400000-0x0000000000B0B000-memory.dmp

Filesize
7.0MB

Download
memory/2432-38-0x0000000000400000-0x0000000000B0B000-memory.dmp

Filesize
7.0MB

Download
memory/2432-36-0x0000000000400000-0x0000000000B0B000-memory.dmp

Filesize
7.0MB

Download
memory/2432-33-0x0000000000400000-0x0000000000B0B000-memory.dmp

Filesize
7.0MB

Download
memory/2432-21-0x0000000002490000-0x0000000002834000-memory.dmp

Filesize
3.6MB

Download
memory/2432-40-0x0000000000400000-0x0000000000B0B000-memory.dmp

Filesize
7.0MB

Download
memory/2432-45-0x0000000000400000-0x0000000000B0B000-memory.dmp

Filesize
7.0MB

Download
memory/2644-20-0x0000000000400000-0x0000000000B0B000-memory.dmp

Filesize
7.0MB

Download
memory/2644-9-0x0000000000400000-0x0000000000B0B000-memory.dmp

Filesize
7.0MB

Download
memory/2644-8-0x0000000002410000-0x00000000027B4000-memory.dmp

Filesize
3.6MB

Download
memory/2644-10-0x0000000000400000-0x0000000000B0B000-memory.dmp

Filesize
7.0MB

Download
memory/3040-7-0x0000000000400000-0x0000000000B0B000-memory.dmp

Filesize
7.0MB

Download
memory/3040-2-0x00000000027E0000-0x0000000002ED1000-memory.dmp

Filesize
6.9MB

Download
memory/3040-0-0x0000000002430000-0x00000000027D4000-memory.dmp

Filesize
3.6MB

Download
memory/3040-6-0x0000000002430000-0x00000000027D4000-memory.dmp

Filesize
3.6MB

Download
memory/3040-5-0x00000000027E0000-0x0000000002ED1000-memory.dmp

Filesize
6.9MB

Download
memory/3040-1-0x0000000002430000-0x00000000027D4000-memory.dmp

Filesize
3.6MB

Download
memory/3040-3-0x0000000000400000-0x0000000000B0B000-memory.dmp

Filesize
7.0MB

Download