Analysis
-
max time kernel
113s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 16:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe
-
Size
312KB
-
MD5
79b891f80896a36e29cb4ed8599cacf6
-
SHA1
2b238ea58a1c54ab4d8531a9b1e6c3c56e554f7b
-
SHA256
1a2079f29f4de929d34127d64e682db7ea6bfdb7b55831dd4be511a024d6e237
-
SHA512
baf68e46948abb51e59fc1867e20398b9617729a60b02883301898c5344130f107676471bf03d1e63cf0050e03d8401ae632f4500d87a15588501245692c0236
-
SSDEEP
6144:Qdr14UChnrsy/Ay4aUi8YRBfkvtmFW/OZM9+1+gWQbHyuG9peWx5Xyy7XcW3bROJ:OyUChnrsy/Ay4aUi8YRVkvtmFW/OZM9m
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\WINDOWS\\userinit.exe" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\WINDOWS\\userinit.exe" h2s.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\WINDOWS\\userinit.exe" nacl.exe -
Disables RegEdit via registry modification 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lsass.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" h2s.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nacl.exe -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\WINDOWS\system32\drivers\etc\hosts lsass.exe File opened for modification C:\WINDOWS\system32\drivers\etc\hosts nacl.exe -
Executes dropped EXE 6 IoCs
pid Process 940 h2s.exe 2384 lsass.exe 2836 h2s.exe 4344 lsass.exe 2412 nacl.exe 3696 lsass.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pikachu = "C:\\WINDOWS\\nacl.exe" lsass.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pikachu = "C:\\WINDOWS\\nacl.exe" h2s.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pikachu = "C:\\WINDOWS\\nacl.exe" nacl.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\link.sys h2s.exe File opened for modification C:\WINDOWS\SysWOW64\link.sys h2s.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\WINDOWS\userinit.exe 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe File created C:\WINDOWS\system\lsass.exe 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe File opened for modification C:\WINDOWS\nacl.exe 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe File created C:\WINDOWS\nacl.exe h2s.exe File created C:\WINDOWS\system\lsass.exe h2s.exe File opened for modification C:\WINDOWS\nacl.exe h2s.exe File opened for modification C:\WINDOWS\system\lsass.exe h2s.exe File created C:\WINDOWS\userinit.exe 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe File created C:\WINDOWS\h2s.exe 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe File opened for modification C:\WINDOWS\h2s.exe 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe File opened for modification C:\WINDOWS\system\lsass.exe 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe File created C:\WINDOWS\nacl.exe 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3548 940 WerFault.exe 84 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe -
Modifies registry class 41 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000cc0000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000009a58f969100041646d696e003c0009000400efbe9a586d64bb58b5822e0000006ce101000000010000000000000000000000000000004e9d0701410064006d0069006e00000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000009a58846610004c6f63616c003c0009000400efbe9a586d64bb58b5822e0000008ae101000000010000000000000000000000000000000fbb7c004c006f00630061006c00000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = a600310000000000bb58b58210003739423839317e3100008e0009000400efbebb58b582bb58b5822e000000293402000000070000000000000000000000000000006acc5e00370039006200380039003100660038003000380039003600610033003600650032003900630062003400650064003800350039003900630061006300660036005f004a006100660066006100430061006b0065007300310031003800000018000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000bb58b5821100557365727300640009000400efbe874f7748bb58b5822e000000c70500000000010000000000000000003a0000000000662f610055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e00310000000000bb58b682100054656d7000003a0009000400efbe9a586d64bb58b6822e0000008be10100000001000000000000000000000000000000f4188c00540065006d007000000014000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000009a586d6412004170704461746100400009000400efbe9a586d64bb58b5822e00000077e10100000001000000000000000000000000000000b9c71f014100700070004400610074006100000016000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe -
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1592 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 940 h2s.exe 940 h2s.exe 2384 lsass.exe 2384 lsass.exe 2836 h2s.exe 2836 h2s.exe 4344 lsass.exe 4344 lsass.exe 2384 lsass.exe 2384 lsass.exe 2836 h2s.exe 2836 h2s.exe 2412 nacl.exe 2412 nacl.exe 3696 lsass.exe 3696 lsass.exe 2384 lsass.exe 2384 lsass.exe 2412 nacl.exe 2412 nacl.exe 2836 h2s.exe 2836 h2s.exe 2384 lsass.exe 2384 lsass.exe 2412 nacl.exe 2412 nacl.exe 2836 h2s.exe 2836 h2s.exe 2384 lsass.exe 2384 lsass.exe 2412 nacl.exe 2412 nacl.exe 2836 h2s.exe 2836 h2s.exe 2384 lsass.exe 2384 lsass.exe 2412 nacl.exe 2412 nacl.exe 2836 h2s.exe 2836 h2s.exe 2384 lsass.exe 2384 lsass.exe 2412 nacl.exe 2412 nacl.exe 2836 h2s.exe 2836 h2s.exe 2384 lsass.exe 2384 lsass.exe 2412 nacl.exe 2836 h2s.exe 2836 h2s.exe 2412 nacl.exe 2384 lsass.exe 2384 lsass.exe 2836 h2s.exe 2412 nacl.exe 2836 h2s.exe 2412 nacl.exe 2384 lsass.exe 2384 lsass.exe 2836 h2s.exe 2836 h2s.exe 2412 nacl.exe 2412 nacl.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 940 h2s.exe 940 h2s.exe 2384 lsass.exe 2384 lsass.exe 2836 h2s.exe 2836 h2s.exe 4344 lsass.exe 4344 lsass.exe 1592 explorer.exe 1592 explorer.exe 2412 nacl.exe 2412 nacl.exe 3696 lsass.exe 3696 lsass.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4080 wrote to memory of 4072 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 82 PID 4080 wrote to memory of 4072 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 82 PID 4080 wrote to memory of 4072 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 82 PID 4080 wrote to memory of 940 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 84 PID 4080 wrote to memory of 940 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 84 PID 4080 wrote to memory of 940 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 84 PID 940 wrote to memory of 3312 940 h2s.exe 85 PID 940 wrote to memory of 3312 940 h2s.exe 85 PID 940 wrote to memory of 3312 940 h2s.exe 85 PID 4072 wrote to memory of 4832 4072 cmd.exe 86 PID 4072 wrote to memory of 4832 4072 cmd.exe 86 PID 4072 wrote to memory of 4832 4072 cmd.exe 86 PID 4832 wrote to memory of 2796 4832 net.exe 88 PID 4832 wrote to memory of 2796 4832 net.exe 88 PID 4832 wrote to memory of 2796 4832 net.exe 88 PID 3312 wrote to memory of 2188 3312 cmd.exe 89 PID 3312 wrote to memory of 2188 3312 cmd.exe 89 PID 3312 wrote to memory of 2188 3312 cmd.exe 89 PID 2188 wrote to memory of 1184 2188 net.exe 90 PID 2188 wrote to memory of 1184 2188 net.exe 90 PID 2188 wrote to memory of 1184 2188 net.exe 90 PID 4080 wrote to memory of 2384 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 97 PID 4080 wrote to memory of 2384 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 97 PID 4080 wrote to memory of 2384 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 97 PID 2384 wrote to memory of 4360 2384 lsass.exe 98 PID 2384 wrote to memory of 4360 2384 lsass.exe 98 PID 2384 wrote to memory of 4360 2384 lsass.exe 98 PID 4360 wrote to memory of 368 4360 cmd.exe 100 PID 4360 wrote to memory of 368 4360 cmd.exe 100 PID 4360 wrote to memory of 368 4360 cmd.exe 100 PID 368 wrote to memory of 4460 368 net.exe 101 PID 368 wrote to memory of 4460 368 net.exe 101 PID 368 wrote to memory of 4460 368 net.exe 101 PID 4080 wrote to memory of 2368 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 103 PID 4080 wrote to memory of 2368 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 103 PID 4080 wrote to memory of 2368 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 103 PID 4080 wrote to memory of 2836 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 104 PID 4080 wrote to memory of 2836 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 104 PID 4080 wrote to memory of 2836 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 104 PID 2836 wrote to memory of 3380 2836 h2s.exe 106 PID 2836 wrote to memory of 3380 2836 h2s.exe 106 PID 2836 wrote to memory of 3380 2836 h2s.exe 106 PID 4080 wrote to memory of 4344 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 108 PID 4080 wrote to memory of 4344 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 108 PID 4080 wrote to memory of 4344 4080 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe 108 PID 4344 wrote to memory of 4160 4344 lsass.exe 109 PID 4344 wrote to memory of 4160 4344 lsass.exe 109 PID 4344 wrote to memory of 4160 4344 lsass.exe 109 PID 3380 wrote to memory of 4752 3380 cmd.exe 111 PID 3380 wrote to memory of 4752 3380 cmd.exe 111 PID 3380 wrote to memory of 4752 3380 cmd.exe 111 PID 4752 wrote to memory of 4760 4752 net.exe 112 PID 4752 wrote to memory of 4760 4752 net.exe 112 PID 4752 wrote to memory of 4760 4752 net.exe 112 PID 4160 wrote to memory of 3088 4160 cmd.exe 113 PID 4160 wrote to memory of 3088 4160 cmd.exe 113 PID 4160 wrote to memory of 3088 4160 cmd.exe 113 PID 3088 wrote to memory of 4692 3088 net.exe 114 PID 3088 wrote to memory of 4692 3088 net.exe 114 PID 3088 wrote to memory of 4692 3088 net.exe 114 PID 2836 wrote to memory of 2412 2836 h2s.exe 116 PID 2836 wrote to memory of 2412 2836 h2s.exe 116 PID 2836 wrote to memory of 2412 2836 h2s.exe 116 PID 2412 wrote to memory of 2012 2412 nacl.exe 118 -
System policy modification 1 TTPs 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer h2s.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "0" nacl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer nacl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0" nacl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "0" lsass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0" h2s.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "0" h2s.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\79b891f80896a36e29cb4ed8599cacf6_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\cmd.execmd /k net share "phim_hai_hay=C:\Documents and Settings\Temp" & exit &2⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\net.exenet share "phim_hai_hay=C:\Documents and Settings\Temp"3⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share "phim_hai_hay=C:\Documents and Settings\Temp"4⤵PID:2796
-
-
-
-
C:\WINDOWS\h2s.exeC:\WINDOWS\h2s.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\cmd.execmd /k net share "phim_hai_hay=C:\Documents and Settings\Temp" & exit &3⤵
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\net.exenet share "phim_hai_hay=C:\Documents and Settings\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share "phim_hai_hay=C:\Documents and Settings\Temp"5⤵PID:1184
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 6443⤵
- Program crash
PID:3548
-
-
-
C:\WINDOWS\system\lsass.exeC:\WINDOWS\system\lsass.exe2⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2384 -
C:\Windows\SysWOW64\cmd.execmd /k net share "phim_hai_hay=C:\Documents and Settings\Temp" & exit &3⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\net.exenet share "phim_hai_hay=C:\Documents and Settings\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share "phim_hai_hay=C:\Documents and Settings\Temp"5⤵PID:4460
-
-
-
-
-
C:\Windows\SysWOW64\explorer.exeexplorer 79b891f80896a36e29cb4ed8599cacf6_JaffaCakes1182⤵PID:2368
-
-
C:\WINDOWS\h2s.exeC:\WINDOWS\h2s.exe2⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2836 -
C:\Windows\SysWOW64\cmd.execmd /k net share "phim_hai_hay=C:\Documents and Settings\Temp" & exit &3⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\net.exenet share "phim_hai_hay=C:\Documents and Settings\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share "phim_hai_hay=C:\Documents and Settings\Temp"5⤵PID:4760
-
-
-
-
C:\WINDOWS\nacl.exeC:\WINDOWS\nacl.exe3⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2412 -
C:\Windows\SysWOW64\cmd.execmd /k net share "phim_hai_hay=C:\Documents and Settings\Temp" & exit &4⤵PID:2012
-
-
-
C:\WINDOWS\system\lsass.exeC:\WINDOWS\system\lsass.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3696 -
C:\Windows\SysWOW64\cmd.execmd /k net share "phim_hai_hay=C:\Documents and Settings\Temp" & exit &4⤵PID:116
-
-
-
-
C:\WINDOWS\system\lsass.exeC:\WINDOWS\system\lsass.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\cmd.execmd /k net share "phim_hai_hay=C:\Documents and Settings\Temp" & exit &3⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\net.exenet share "phim_hai_hay=C:\Documents and Settings\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share "phim_hai_hay=C:\Documents and Settings\Temp"5⤵PID:4692
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 940 -ip 9401⤵PID:3508
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1592
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3976
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
578B
MD54cedd41692993cf5a0a40baeb724b871
SHA1fc1eeb1d88966ea4a816bcbdab320830b6f70261
SHA256fc50ea976a803f4b75f0754c470753049cb6ad93466ec9a55f0b922e112a7695
SHA512e7124fdba0a6580da6c48cd77777c6aa1aa23f304db8383551931db1e5e814d2d03de92eeaeeb64f4a0654ee7de640956abeffdd94bcd23c08a875cdc6907862
-
Filesize
312KB
MD579b891f80896a36e29cb4ed8599cacf6
SHA12b238ea58a1c54ab4d8531a9b1e6c3c56e554f7b
SHA2561a2079f29f4de929d34127d64e682db7ea6bfdb7b55831dd4be511a024d6e237
SHA512baf68e46948abb51e59fc1867e20398b9617729a60b02883301898c5344130f107676471bf03d1e63cf0050e03d8401ae632f4500d87a15588501245692c0236