luminosity | e3cab08c80b5ca08d9b65e2fbde171b5c386f45b95b0863e7ec019eca07a43aa

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe
Size

1.0MB
MD5

6af87a9e7baeb38bc0aee84fb505a53f
SHA1

afe6ee7d43cbc89bdf416fbd96d43ac0883d6f6a
SHA256

e3cab08c80b5ca08d9b65e2fbde171b5c386f45b95b0863e7ec019eca07a43aa
SHA512

27cde2c1b1150d0c7294bc7aa1eba1ed6e32e8341bda162f050a2cfbfe84040d9587399c7d31c41fa38ee0d076610d6cad6d77f7dbbf6adf2eb0c47a99ac5a60
SSDEEP

12288:4P4wN/lTUyEs2t4/3VwcBXDxFFpZwCCUOkr77s7Cgrd+OJTK/f70WdqKxPvz7Cs/:W/a4fjdDHZp77QrIITKfguz7Csblia

Score

10^/10

luminosity persistence rat

Malware Config

Signatures

Luminosity 2 IoCs

Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.

rat luminosity

description	ioc	pid	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000		6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe
		2348	schtasks.exe

Executes dropped EXE 1 IoCs

pid	Process
2788	d_update.exe

Loads dropped DLL 4 IoCs

pid	Process
2880	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe

Adds Run key to start application 2 TTPs 25 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\d_update.exe"	d_update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\d_update.exe"	d_update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Client Monitor = "cmd /c \"start \"Client Monitor\" \"C:\\Program Files (x86)\\Client\\client.exe\""	REG.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Client\client.exe	d_update.exe
File opened for modification	C:\Program Files (x86)\Client\client.exe	d_update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2348	schtasks.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe
2788	d_update.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2880	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe
Token: SeDebugPrivilege	2788	d_update.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2788	d_update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2788	2880	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe	28
PID 2880 wrote to memory of 2788	2880	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe	28
PID 2880 wrote to memory of 2788	2880	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe	28
PID 2880 wrote to memory of 2788	2880	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe	28
PID 2880 wrote to memory of 2788	2880	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe	28
PID 2880 wrote to memory of 2788	2880	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe	28
PID 2880 wrote to memory of 2788	2880	6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe	28
PID 2788 wrote to memory of 2776	2788	d_update.exe	29
PID 2788 wrote to memory of 2776	2788	d_update.exe	29
PID 2788 wrote to memory of 2776	2788	d_update.exe	29
PID 2788 wrote to memory of 2776	2788	d_update.exe	29
PID 2788 wrote to memory of 2776	2788	d_update.exe	29
PID 2788 wrote to memory of 2776	2788	d_update.exe	29
PID 2788 wrote to memory of 2776	2788	d_update.exe	29
PID 2788 wrote to memory of 2348	2788	d_update.exe	31
PID 2788 wrote to memory of 2348	2788	d_update.exe	31
PID 2788 wrote to memory of 2348	2788	d_update.exe	31
PID 2788 wrote to memory of 2348	2788	d_update.exe	31
PID 2788 wrote to memory of 2348	2788	d_update.exe	31
PID 2788 wrote to memory of 2348	2788	d_update.exe	31
PID 2788 wrote to memory of 2348	2788	d_update.exe	31
PID 2788 wrote to memory of 2188	2788	d_update.exe	33
PID 2788 wrote to memory of 2188	2788	d_update.exe	33
PID 2788 wrote to memory of 2188	2788	d_update.exe	33
PID 2788 wrote to memory of 2188	2788	d_update.exe	33
PID 2788 wrote to memory of 2188	2788	d_update.exe	33
PID 2788 wrote to memory of 2188	2788	d_update.exe	33
PID 2788 wrote to memory of 2188	2788	d_update.exe	33
PID 2788 wrote to memory of 1640	2788	d_update.exe	35
PID 2788 wrote to memory of 1640	2788	d_update.exe	35
PID 2788 wrote to memory of 1640	2788	d_update.exe	35
PID 2788 wrote to memory of 1640	2788	d_update.exe	35
PID 2788 wrote to memory of 1640	2788	d_update.exe	35
PID 2788 wrote to memory of 1640	2788	d_update.exe	35
PID 2788 wrote to memory of 1640	2788	d_update.exe	35
PID 2788 wrote to memory of 2272	2788	d_update.exe	39
PID 2788 wrote to memory of 2272	2788	d_update.exe	39
PID 2788 wrote to memory of 2272	2788	d_update.exe	39
PID 2788 wrote to memory of 2272	2788	d_update.exe	39
PID 2788 wrote to memory of 2272	2788	d_update.exe	39
PID 2788 wrote to memory of 2272	2788	d_update.exe	39
PID 2788 wrote to memory of 2272	2788	d_update.exe	39
PID 2788 wrote to memory of 2844	2788	d_update.exe	41
PID 2788 wrote to memory of 2844	2788	d_update.exe	41
PID 2788 wrote to memory of 2844	2788	d_update.exe	41
PID 2788 wrote to memory of 2844	2788	d_update.exe	41
PID 2788 wrote to memory of 2844	2788	d_update.exe	41
PID 2788 wrote to memory of 2844	2788	d_update.exe	41
PID 2788 wrote to memory of 2844	2788	d_update.exe	41
PID 2788 wrote to memory of 984	2788	d_update.exe	43
PID 2788 wrote to memory of 984	2788	d_update.exe	43
PID 2788 wrote to memory of 984	2788	d_update.exe	43
PID 2788 wrote to memory of 984	2788	d_update.exe	43
PID 2788 wrote to memory of 984	2788	d_update.exe	43
PID 2788 wrote to memory of 984	2788	d_update.exe	43
PID 2788 wrote to memory of 984	2788	d_update.exe	43
PID 2788 wrote to memory of 924	2788	d_update.exe	45
PID 2788 wrote to memory of 924	2788	d_update.exe	45
PID 2788 wrote to memory of 924	2788	d_update.exe	45
PID 2788 wrote to memory of 924	2788	d_update.exe	45
PID 2788 wrote to memory of 924	2788	d_update.exe	45
PID 2788 wrote to memory of 924	2788	d_update.exe	45
PID 2788 wrote to memory of 924	2788	d_update.exe	45
PID 2788 wrote to memory of 1536	2788	d_update.exe	47

C:\Users\Admin\AppData\Local\Temp\6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6af87a9e7baeb38bc0aee84fb505a53f_JaffaCakes118.exe"
1⤵
- Luminosity
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Roaming\d_update.exe
  "C:\Users\Admin\AppData\Roaming\d_update.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:2776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /NP /sc onlogon /tn "Client Monitor" /rl highest /tr "'C:\Program Files (x86)\Client\client.exe' /startup" /f
    3⤵
    - Luminosity
    - Creates scheduled task(s)
    PID:2348
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:2188
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1640
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:2272
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:2844
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:984
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:924
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1536
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1484
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1804
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1352
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1912
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1860
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1252
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1708
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:840
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:2544
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:2916
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:2676
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:2588
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:2652
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:2568
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Client Monitor" /d "cmd /c """start """Client Monitor""" """C:\Program Files (x86)\Client\client.exe"""" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
471B

MD5
4b376095237f75073a2a247e1518433f

SHA1
ad7571886ccf7fcf34b7f18694a5b6fc8d65da1a

SHA256
28aec2ad57d12b8dccf2c48e9cad64382c027ed9b8e5120cec6d9c93c30fe297

SHA512
3f470e948382eaf5b35a5c10c005ff44416e7bc3bd7b8138f38358a1899cb4c9bb1914b7860c2645f5beee5254d1bb4ab6d7aacc03f9d4f4e48abd76be41b6ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_108A7991F73F2B507007C35661993162

Filesize
471B

MD5
445c78b1decc260cf7cb9efdaa43a6ad

SHA1
d59a3caed612cf12831e0baa925728b1b1c99523

SHA256
5b8dae610070c323229f4e5494902c28d4712e793a45da48062760cd3d495a4d

SHA512
4c4b10ffbdce024ad00b0bfb21b1679443d172435ee4d5a9e12b66300db0485b5e7e69972790d1161fdb06f25aaa034b9f6733aa72b70dbd9ddca94cc4d10806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
404B

MD5
f9d2996e872d97ffb91e868fe2fce7b1

SHA1
2fb2072d9dc4200c37c6c549a6f7fabf6bd08ee3

SHA256
82e9962048faa7267e4b4a22feadd2cd8655a7e968cdf12b58060b255da449a4

SHA512
6baa3fb04e8e78ccb4ceea45733653e4401dc3d4bfef1efb5c78eb97e3b5065a851a6b18d6f8133b2ad379400225e64b28dfaad5b311e53151eaddc1464f6bc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_108A7991F73F2B507007C35661993162

Filesize
400B

MD5
fc6dafe6abbdfa723b92f4ba74600498

SHA1
793738b541a39290f188ed19298370bee5fb53a5

SHA256
a14645fbe4f189e50a9d8193c23986437e8bbd06c58ad18e718f525497c1483c

SHA512
1ba3a82242532f9ce3ee58ae640f58ebadb4f349a1eb29295fe58c1d9330c9aee75ac77f4ef5ef92a1b641a7bcd2db8c1b6c05969fd08c92c0d51081d6cdaa4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
532bf8c515f32ddf48821ac46de70efc

SHA1
ce1ee5be9504a9231f4003610d803b8b69908239

SHA256
27c1bafd4379c2c4ac76b444ba22d0faee05005158c6bb0c63b6d56287918b53

SHA512
57844edbf5960896f92cab4f62f18c2551c85c4f86e1f4f66e2c9c4dccb2de9a5427e5f6839982a94eb11a87f025f7403a4cea6dbe2d0d0bc046d898c2ad733a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16EB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Users\Admin\AppData\Roaming\d_update.exe

Filesize
1.0MB

MD5
6af87a9e7baeb38bc0aee84fb505a53f

SHA1
afe6ee7d43cbc89bdf416fbd96d43ac0883d6f6a

SHA256
e3cab08c80b5ca08d9b65e2fbde171b5c386f45b95b0863e7ec019eca07a43aa

SHA512
27cde2c1b1150d0c7294bc7aa1eba1ed6e32e8341bda162f050a2cfbfe84040d9587399c7d31c41fa38ee0d076610d6cad6d77f7dbbf6adf2eb0c47a99ac5a60

Download Submit
memory/2788-61-0x0000000074CF0000-0x000000007529B000-memory.dmp

Filesize
5.7MB

Download
memory/2788-67-0x0000000074CF0000-0x000000007529B000-memory.dmp

Filesize
5.7MB

Download
memory/2880-0-0x0000000074D71000-0x0000000074D72000-memory.dmp

Filesize
4KB

Download
memory/2880-44-0x0000000074D70000-0x000000007531B000-memory.dmp

Filesize
5.7MB

Download
memory/2880-2-0x0000000074D70000-0x000000007531B000-memory.dmp

Filesize
5.7MB

Download
memory/2880-1-0x0000000074D70000-0x000000007531B000-memory.dmp

Filesize
5.7MB

Download