Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 11:56
Static task
static1
Behavioral task
behavioral1
Sample
672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe
-
Size
600KB
-
MD5
672e7bfd74c6bfcae7a45b3eef091a89
-
SHA1
f15a1f1265fa4b2f73620cf4b1c0fbe68756a94f
-
SHA256
d0ce7284573bd0b16c06d34bdfcd6c1960738c0e8e39a6327c178523ce412f44
-
SHA512
ef6551a467da3e1b0d122cb393ce6bad21c25c88507585d0671ec5fde1d0f306317a3c59bde617f11c24c594da1f505ad31fc167ef79403c9c333e77ae8552e6
-
SSDEEP
12288:wmjIjUK9OJBC+DHRny6vi98eiSdaQCDQM0mnLpMoMwTkf:HnTp96da0MxpM5f
Malware Config
Extracted
emotet
Epoch2
201.184.105.242:443
24.45.195.162:7080
24.45.195.162:8443
94.192.225.46:80
80.11.163.139:443
133.167.80.63:7080
198.199.114.69:8080
80.79.23.144:443
192.254.173.31:8080
67.225.229.55:8080
190.108.228.48:990
62.75.187.192:8080
185.94.252.13:443
94.205.247.10:80
211.63.71.72:8080
59.103.164.174:80
192.81.213.192:8080
27.4.80.183:443
190.145.67.134:8090
115.78.95.230:443
104.131.11.150:8080
95.128.43.213:8080
212.71.234.16:8080
178.254.6.27:7080
86.98.25.30:53
91.205.215.66:8080
188.166.253.46:8080
80.11.163.139:21
186.75.241.230:80
190.106.97.230:443
78.24.219.147:8080
217.160.182.191:8080
173.212.203.26:8080
92.222.216.44:8080
136.243.177.26:8080
37.157.194.134:443
190.211.207.11:443
104.236.246.93:8080
190.18.146.70:80
103.255.150.84:80
138.201.140.110:8080
41.220.119.246:80
200.71.148.138:8080
85.54.169.141:8080
144.139.247.220:80
149.202.153.252:8080
31.172.240.91:8080
186.4.172.5:443
178.79.161.166:443
186.4.172.5:8080
206.189.98.125:8080
87.106.139.101:8080
46.105.131.87:80
45.123.3.54:443
222.214.218.192:8080
85.106.1.166:50000
83.136.245.190:8080
179.32.19.219:22
152.89.236.214:8080
181.31.213.158:8080
87.106.136.232:8080
47.41.213.2:22
201.251.43.69:8080
24.51.106.145:21
87.230.19.21:8080
190.228.72.244:53
181.143.194.138:443
182.176.106.43:995
31.12.67.62:7080
182.76.6.2:8080
190.226.44.20:21
181.143.53.227:21
189.209.217.49:80
190.186.203.55:80
27.147.163.188:8080
159.65.25.128:8080
101.187.237.217:20
182.176.132.213:8090
199.19.237.192:80
124.240.198.66:80
5.196.74.210:8080
190.53.135.159:21
186.4.172.5:20
45.33.49.124:443
92.233.128.13:143
85.104.59.244:20
169.239.182.217:8080
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
querycpls.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat querycpls.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 29 IoCs
Processes:
querycpls.exequerycpls.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\YourCompany\Drawcli Application\Settings querycpls.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" querycpls.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" querycpls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-52-f3-de-d7-f3\WpadDecisionReason = "1" querycpls.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings querycpls.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad querycpls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\YourCompany\Drawcli Application\Settings querycpls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-52-f3-de-d7-f3 querycpls.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-52-f3-de-d7-f3\WpadDecisionTime = 5030c28446acda01 querycpls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\YourCompany\Drawcli Application\Recent File List querycpls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\YourCompany\Drawcli Application\Recent File List querycpls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings querycpls.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 querycpls.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix querycpls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\YourCompany\Drawcli Application querycpls.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 querycpls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BC6B1433-1661-4C64-9947-012EB7BD0820}\WpadDecisionReason = "1" querycpls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BC6B1433-1661-4C64-9947-012EB7BD0820}\WpadDecision = "0" querycpls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" querycpls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BC6B1433-1661-4C64-9947-012EB7BD0820} querycpls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BC6B1433-1661-4C64-9947-012EB7BD0820}\8a-52-f3-de-d7-f3 querycpls.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8a-52-f3-de-d7-f3\WpadDecision = "0" querycpls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\YourCompany querycpls.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 querycpls.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BC6B1433-1661-4C64-9947-012EB7BD0820}\WpadDecisionTime = 5030c28446acda01 querycpls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\YourCompany querycpls.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\YourCompany\Drawcli Application querycpls.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections querycpls.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BC6B1433-1661-4C64-9947-012EB7BD0820}\WpadNetworkName = "Network 3" querycpls.exe -
Modifies registry class 64 IoCs
Processes:
672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exequerycpls.exequerycpls.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.drw\ = "Drawcl.Document" 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\DefaultIcon 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\DefaultIcon querycpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\command querycpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document querycpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\DefaultIcon querycpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\672E7B~1.EXE /dde" 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\ = "Drawcl Document" 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\command 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\ddeexec\ = "[print(\"%1\")]" querycpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" querycpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\command querycpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\command 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\ddeexec\ = "[open(\"%1\")]" 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\ddeexec 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document querycpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\ddeexec querycpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\ddeexec\ = "[print(\"%1\")]" querycpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\ = "Drawcl Document" 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.drw\ShellNew\NullFile 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\ = "Drawcl Document" querycpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\ddeexec querycpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\command querycpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\command\ = "C:\\Windows\\SysWOW64\\QUERYC~1.EXE /dde" querycpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\DefaultIcon\ = "C:\\Windows\\SysWOW64\\QUERYC~1.EXE,0" querycpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\ddeexec querycpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\command\ = "C:\\Windows\\SysWOW64\\QUERYC~1.EXE /dde" querycpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\command 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\DefaultIcon\ = "C:\\Windows\\SysWOW64\\QUERYC~1.EXE,0" querycpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\ddeexec 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\ddeexec\ = "[print(\"%1\")]" 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\ddeexec 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\command 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\command querycpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\672E7B~1.EXE,0" 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\ddeexec 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\command 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\672E7B~1.EXE /dde" 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\ddeexec\ = "[open(\"%1\")]" querycpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\ddeexec\ = "[open(\"%1\")]" 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\ddeexec 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\ddeexec\ = "[open(\"%1\")]" querycpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\672E7B~1.EXE /dde" 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\672E7B~1.EXE /dde" 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\command\ = "C:\\Windows\\SysWOW64\\QUERYC~1.EXE /dde" querycpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\ddeexec\ = "[print(\"%1\")]" 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\open\command\ = "C:\\Windows\\SysWOW64\\QUERYC~1.EXE /dde" querycpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\ = "Drawcl Document" querycpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print\ddeexec querycpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\ddeexec querycpls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]" querycpls.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\print 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\command 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\672E7B~1.EXE /dde" 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.drw 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.drw\ShellNew 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drawcl.Document\shell\printto\command querycpls.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
querycpls.exepid process 2612 querycpls.exe 2612 querycpls.exe 2612 querycpls.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exepid process 2596 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exequerycpls.exequerycpls.exepid process 2080 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe 2080 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe 2596 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe 2596 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe 2556 querycpls.exe 2556 querycpls.exe 2612 querycpls.exe 2612 querycpls.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exequerycpls.exedescription pid process target process PID 2080 wrote to memory of 3028 2080 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe splwow64.exe PID 2080 wrote to memory of 3028 2080 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe splwow64.exe PID 2080 wrote to memory of 3028 2080 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe splwow64.exe PID 2080 wrote to memory of 3028 2080 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe splwow64.exe PID 2080 wrote to memory of 2596 2080 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe PID 2080 wrote to memory of 2596 2080 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe PID 2080 wrote to memory of 2596 2080 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe PID 2080 wrote to memory of 2596 2080 672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe 672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe PID 2556 wrote to memory of 2612 2556 querycpls.exe querycpls.exe PID 2556 wrote to memory of 2612 2556 querycpls.exe querycpls.exe PID 2556 wrote to memory of 2612 2556 querycpls.exe querycpls.exe PID 2556 wrote to memory of 2612 2556 querycpls.exe querycpls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\672e7bfd74c6bfcae7a45b3eef091a89_JaffaCakes118.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\672e7bfd74c6bfcae7a45b3eef091a89_jaffacakes118.exe--b5ca9b7a2⤵
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\querycpls.exe"C:\Windows\SysWOW64\querycpls.exe"1⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\querycpls.exe--cc68b0322⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2080-1-0x00000000004A0000-0x00000000004B4000-memory.dmpFilesize
80KB
-
memory/2080-6-0x00000000003E0000-0x00000000003EF000-memory.dmpFilesize
60KB
-
memory/2556-12-0x0000000000270000-0x0000000000284000-memory.dmpFilesize
80KB
-
memory/2596-7-0x0000000000310000-0x0000000000324000-memory.dmpFilesize
80KB
-
memory/2596-17-0x0000000000400000-0x0000000000499000-memory.dmpFilesize
612KB
-
memory/2612-18-0x0000000000260000-0x0000000000274000-memory.dmpFilesize
80KB