41bd936780175c8426596c4412ec550d9e34afc5ebcce436e38b43268cf66d2f

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe
Size

40KB
MD5

aa830d37b6634687837dfbba5ca55c09
SHA1

8b3fb03d5b73abdfdd94fa651722b919e7e0e871
SHA256

41bd936780175c8426596c4412ec550d9e34afc5ebcce436e38b43268cf66d2f
SHA512

55da7a48a2a714cf279fe84bbf93814ad0b8f0732fcda3e3b966d19f3fe93938f218e5d306e3fb902067b90fbc96a95635d04ec7a7e38009dcd2956513337265
SSDEEP

768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHNFYl:aqk/Zdic/qjh8w19JDHkl

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

2108 services.exe

pid	process
2108	services.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\services.exe	upx
behavioral1/memory/2108-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/3048-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-27-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-441-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-765-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-801-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-805-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-812-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-815-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-819-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-820-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2108-824-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\services.exe	aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe
File created	C:\Windows\java.exe	aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe

description	pid	process	target process
PID 3048 wrote to memory of 2108	3048	aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe	services.exe
PID 3048 wrote to memory of 2108	3048	aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe	services.exe
PID 3048 wrote to memory of 2108	3048	aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe	services.exe
PID 3048 wrote to memory of 2108	3048	aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aa830d37b6634687837dfbba5ca55c09_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3048

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2108

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
36c501a9d552af1b1d5d211d7ad2aa1d

SHA1
fb5d04b4664c903e7055dd214e43ccc122a6c7f9

SHA256
aae4081dd1c66ba4f5a8c24fda62cbf74fcb48122300ec283743c7b12f3ccd04

SHA512
5d067cd6d89e20d1633b87fc6fc045298a9e64f1457d9b35e4c288d5d7b9fc5f8cebd69c7e54c1e5d987d471ebeab2c57d40fbb378967742c0517b1dca163e53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
394706a15500b81467dfaf233b1a8b77

SHA1
df449e68c86f64b0a33b2f32ce81777781818205

SHA256
95edd5d3a2156be9d2c198781f738b2e3d5e1270a9896e2d3bfaa14cd71372cb

SHA512
87c5483d689bd0700f53aa5292aa2b39c246a1f5e3d8b11bb677964457a75c1aa647058a9086c190b72e91a04d41ba2574775d5b86c83d56ce4f08b34df5f6c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
b577a0cf7b4c836e253082ccada8fb2a

SHA1
37e0f0ff0a3f282c8acab9320787a8a7365af605

SHA256
cdf13489afa48fb9b55d210cc6f76faecf9a35208bec247dbc7a6a3b27cf4b22

SHA512
7db33f5cb8bdcc1db411e70e1ca401863867f5c034a7c8417e3a5694e1ff169c66592204c0e8fc765df6861edea18220125683b48464c72d7e9f1eb09af15ec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
825afb434f18911a9f9939a5f2e45ae1

SHA1
04266f197c595507e189a3d19eb4a850ba8701ba

SHA256
fa044583abd3eeaf4a0a1c5bf616b8de6b4a606cc77a21fb20b5520ce683bc70

SHA512
1d69d87866e08aa585daccd757c0fa2542a9fb98bf617055ff2081f3075e24c7d032bd2465df5ffbf72277c1cbdbea7982ec352c6ae1e636455be0b56b61e97a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
e0da113a6ec883e12d97a3c080417164

SHA1
90d0d55d827535528ece0d32cf7d4c4562f63845

SHA256
c3c2396e9423082b6184521491dbaf5cc8209a4f9f7b2ddd9d02522117e8a201

SHA512
5ef70d3007573684d9fae2f9d2dd23ee0dcc510e69464d42196bc2d2407fb1bff427abca03bdb1fc5e3e0103c47cc8d6e0fc908b026560cefb116aa7f142e1f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6KXI1UGL\results[2].htm
Filesize
1KB

MD5
211da0345fa466aa8dbde830c83c19f8

SHA1
779ece4d54a099274b2814a9780000ba49af1b81

SHA256
aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

SHA512
37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6KXI1UGL\search[3].htm
Filesize
142KB

MD5
775e61447ecc3237fa47effed3f04ec0

SHA1
7b8c232a20e92cfae7d0134d48b8b1de9c0cb52a

SHA256
a749cb60c0b56eb29b95e0d431bcecc296f508f079bc0175b968e81184a8a5e6

SHA512
bbf8255a981d1d1f41563ff01a8f1ed1e26a688ebfd3e0e3019aa6108d57a42744dae4189f3da3ac69e682ebcc881cfd4b69da811580fe1add02ef560e95dc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6KXI1UGL\search[6].htm
Filesize
101KB

MD5
e79a31abe9f967ea9c9ad51803eb0246

SHA1
2e91cc14dafa577a9dba97822199227cac8dc759

SHA256
86cc1eb043b4d96f8f7d41e381c49b1dcf7917edbdcea2aefeb96439c640c89b

SHA512
940d0b4b5ffbbb6b6b5f025b46fa8e30d52bff2279e843994842744637fb314cb7942f44d2127ec3a9316dac8fcc3ea67267b737df01946e2de36a0593ddadd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8YQJDQ2N\IZD3NO5H.htm
Filesize
185KB

MD5
890cfad9ffa9ba86415aefc0cb59c47b

SHA1
907f1ebbd50429e78427162b3d40a7d0c2daf12f

SHA256
e5fac0cd953cb326b33d051aca68a2c9e780a192ced382ea00da8a69f3c29d83

SHA512
5d0e493156fb2403c754185574971ad9b9cdd76bcc0a7c4bc4f215a6972f42c3dbe901e9ebc29e73f53251fdcbd860e56fd790604849e8001b27942744ff66e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8YQJDQ2N\search[3].htm
Filesize
114KB

MD5
43004a5d1e75e053c9993e327f4fcfe0

SHA1
42a6e90ddc7eedcaf5ee336ea42970d9d6492665

SHA256
e27911690590b5ab7bd10c2563d6a0b28f981b8144f355a1faeda9eef03b5a6a

SHA512
0bc4af802ef026267c80bc5d085414742c38f08c57f9738e7e2726468e398c2b7a9c58a8df768db6f57a7ce3017553c38c2d8d8bce576666d972b3787f894a0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T9A6H5CW\search[2].htm
Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZJ985J2M\8B1X5ZE8.htm
Filesize
185KB

MD5
749023c8e77fbc2569679fda1a2c67ac

SHA1
c0151a28231ec9967a00987ec5a0ab47dc77a9c2

SHA256
e7d5e3ac933c2b2ca317cd28270bc42de1848d4c65734d4916f87a87b35ab3b5

SHA512
2ad10146aa3bd1f517ff4a1bc97f1747dfc652c0aab6925135f2e074d045d8f83444543e5c0980b556717599acdc62a203f49e109542738e9985f59b76ad45a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZJ985J2M\V45SIUFJ.htm
Filesize
185KB

MD5
a6a6be45892272d192ee89258bdf331f

SHA1
ce78dd8d80ba199ef16cd34ded540fdd5a81cf39

SHA256
bfbf9fd99049bbb4b800f3f951f396cf538798fe828637fe59094876451973a7

SHA512
ae61d5b567a3552e1f838001bb19871e66c084b86149746fa6bee3426075f9d650fbdabb41722ddf03d53afa6245e4d9612124e230d9070ef4510b6ee337ef8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZJ985J2M\search[3].htm
Filesize
126KB

MD5
32b10747dc74f3965d03acede5756801

SHA1
70bbb2ec1653d1959fd7c437e5fbef1d93dfab48

SHA256
2160dfdb99171ea0ed3f214723b86bb43b079acd6c65e3c42175e5d17cab7f6f

SHA512
596f6a97e4594cc28a21f6c1ee6ead61973322c0ead6d5da20a2cec4ac71817d1c4bcc02d8347ad3d550fca2325c1f9ff2c32b416fefc7d3fbdd280b879f43f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFD50.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF6B1.tmp
Filesize
40KB

MD5
762bec95f217c10ff8f1b4df10d92bd3

SHA1
597bedf486c0e133fae1519ae6efec95b469e56b

SHA256
056f7bb54b77c9ee879d8a676cd903a9a488abe4a2dcb4db4545cbf286d3344a

SHA512
f72f7c390d1026a5982bdd3464936f62c88eeaee9ca3e4a2238c643a39fd693749bb490c44650e4b6ffc452bd65132949d4780c836efda85957131d5cc1d08ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
1KB

MD5
0c39d8016d555847a4bb4a2b55a92baa

SHA1
b2bfffc809193b8a770d941c9b7eff71a84dd22a

SHA256
509dda3cbd40aa00b749acb94411e4adc96968fb8793e0ce03d9434e5237b414

SHA512
09361c94ce34b6f73ea8b50dcd6aa8dfd350a155fec80fc818686bdfaced15bcda963a0099a907a61332d2cada2c03e7ba91e3b630031fed31449a0b6e808608

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
1KB

MD5
2bf0425c039cc60c623bae44adab1698

SHA1
c1266791780820b92862724d8998e555c8e65a48

SHA256
678038212f9b16acdf2e54741f1eb7379d0b96d5ad46c2e09932cf4eaa0a856a

SHA512
37083f162c834443fa5757c07085d8ad2c7e9385efe2103c12b7618ac3ef75da7a3fddca8bf504313187e8c6a987ba6ec5b6eb09d6dfcc95d6f4d012de98425e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
1KB

MD5
1afc7788891d76821b84496c5603f520

SHA1
f9c6b5a7801d3d2b4f52b37952ed8b86711c140d

SHA256
bc6b4a82f37c033fcd4b7be21f2e32e18261571587b174e64f084c8b4a946d62

SHA512
c46455dbc46eb1de3cdee0df56ef6c11e1504acad71f59e8b81f861dd58d231a54f161544338f3de6d53962b0c158ab27053f91a112cc7e19785351bea5e945c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
1KB

MD5
de332364ec4fefc9d093c1b4339b9ec7

SHA1
d6dfb247af8164729d9cfbb171e843e4cc0ef14e

SHA256
cd8cf0250dda77799abb5d8f580d1d176616071383e7121a346b91ed0c70fcbf

SHA512
1f60fd8ca163886ecbfbf6778d9e58a1ba1695da973447f9c923bcb503fcab82a572adb877633b9d21d21bc23b873641ba5c805f3ce71c7e29e80c5e546d3577

Download Submit
C:\Windows\services.exe
Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2108-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-824-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-820-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-819-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-815-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-765-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-801-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-805-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-441-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2108-812-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3048-0-0x0000000000500000-0x000000000050D000-memory.dmp

Filesize
52KB

Download
memory/3048-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3048-8-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3048-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3048-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download