Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 17:22
Static task
static1
Behavioral task
behavioral1
Sample
aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe
-
Size
955KB
-
MD5
aae3437826361e72e932c22c5f63cd4d
-
SHA1
f7369ab8c45664c463c672d39a78da3213b7cea3
-
SHA256
80b8f61fd6a9d4ef0aec1db74258b10cbf1d00ff05f7007962d2859f082a68ab
-
SHA512
6da566349f51453354301c8f1739c973d06515f00da8f44c4aad4df61d9cb8a1ff3f5ca14eb922ee72c7f38727ddebf974dea49de6e07c7c8d9656bbf947ca7e
-
SSDEEP
24576:SX48QE+Ul876dNhofAFC9KTBMt+yavz1b/yO7TTB/h7Amo:SXz+9WD4PKTBMt+yw1b/DVDo
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt svchost.exe -
Drops startup file 1 IoCs
Processes:
aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\codec.exe aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe -
Executes dropped EXE 3 IoCs
Processes:
svchost.exesvchost.exesvchost.exepid process 2204 svchost.exe 2472 svchost.exe 1920 svchost.exe -
Loads dropped DLL 4 IoCs
Processes:
aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exesvchost.exepid process 1508 aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe 1508 aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe 2204 svchost.exe 2204 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/1920-29-0x0000000000400000-0x000000000049B000-memory.dmp upx behavioral1/memory/1920-32-0x0000000000400000-0x000000000049B000-memory.dmp upx behavioral1/memory/1920-28-0x0000000000400000-0x000000000049B000-memory.dmp upx behavioral1/memory/1920-34-0x0000000000400000-0x000000000049B000-memory.dmp upx behavioral1/memory/1920-35-0x0000000000400000-0x000000000049B000-memory.dmp upx behavioral1/memory/1920-36-0x0000000000400000-0x000000000049B000-memory.dmp upx behavioral1/memory/1920-37-0x0000000000400000-0x000000000049B000-memory.dmp upx behavioral1/memory/1920-672-0x0000000000400000-0x000000000049B000-memory.dmp upx behavioral1/memory/1920-1329-0x0000000000400000-0x000000000049B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sopropool = "C:\\Program Files (x86)\\svchost.exe" svchost.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Ultimate\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_types.ps1xml.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_functions.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Line_Editing.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\_Default\ProfessionalE\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasicN\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\_Default\ProfessionalN\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_prompts.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\OEM\Ultimate\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_History.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Switch.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_type_operators.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\UltimateN\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_remote_FAQ.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_hash_tables.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_modules.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_debuggers.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Foreach.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Foreach.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\Enterprise\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomeBasicE\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\eval\HomeBasicN\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_command_precedence.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_pssessions.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_type_operators.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Arithmetic_Operators.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasicN\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_join.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Reserved_Words.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_functions.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\OEM\UltimateE\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\ja-JP\lipeula.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Comparison_Operators.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_methods.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Windows_PowerShell_2.0.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\eval\Ultimate\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\_Default\EnterpriseN\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_PSSnapins.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_pipelines.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Ref.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_History.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_logical_operators.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_scopes.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\UltimateN\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\eval\UltimateE\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Command_Syntax.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_pssession_details.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Command_Syntax.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote_jobs.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_hash_tables.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_aliases.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomeBasicE\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Parsing.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_eventlogs.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_execution_policies.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomeBasicE\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_wildcards.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_If.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\eval\ProfessionalN\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_command_precedence.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_While.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Quoting_Rules.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_split.help.txt svchost.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\desk.bmp" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
svchost.exedescription pid process target process PID 2204 set thread context of 1920 2204 svchost.exe svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt svchost.exe File opened for modification C:\Program Files\7-Zip\License.txt svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\AUTHORS.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg svchost.exe File opened for modification C:\Program Files\Java\jre7\lib\jvm.hprof.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File A.txt svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\THANKS.txt svchost.exe File created C:\Program Files (x86)\PGZFGTJBPM.DNO svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt svchost.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt svchost.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceAmharic.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt svchost.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.jpg svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt svchost.exe File opened for modification C:\Program Files\ReceiveSave.txt svchost.exe File opened for modification C:\Program Files (x86)\svchost.exe svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt svchost.exe File opened for modification C:\Program Files\7-Zip\History.txt svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi svchost.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c871894fcd57712d\license.rtf svchost.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_remote_jobs.help.txt svchost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..fessional.resources_31bf3856ad364e35_6.1.7601.17514_de-de_f866c80944f0adee\license.rtf svchost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1ba5473c786c35fa\license.rtf svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_transactions.help.txt svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Session_Configurations.help.txt svchost.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_Throw.help.txt svchost.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_While.help.txt svchost.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_Windows_PowerShell_ISE.help.txt svchost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_eff8b99e913299d2\license.rtf svchost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..t-starter.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_54b8783c97704202\license.rtf svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..indetails.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5a6758686ecd5550\OOBE_HELP_Opt_in_Details.rtf svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_Assignment_Operators.help.txt svchost.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_scopes.help.txt svchost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..epremiume.resources_31bf3856ad364e35_6.1.7601.17514_es-es_bccfa508b62ebcf2\license.rtf svchost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_8793be4882b63f95\license.rtf svchost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_203bbba4ef78364f\license.rtf svchost.exe File opened for modification C:\Windows\ehome\it-IT\playReady_eula_oem.txt svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7601.17514_en-us_4a0c23262e7d22c6\license.rtf svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-landscapes_31bf3856ad364e35_6.1.7600.16385_none_e57abb2f66db71a9\img9.jpg svchost.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_try_catch_finally.help.txt svchost.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_functions_cmdletbindingattribute.help.txt svchost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-lcphrase-tbl_31bf3856ad364e35_6.1.7600.16385_none_d464ca659dc6f7f0\lcptr.tbl svchost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-n..35cdfcomp.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a64913c605a9a2c0\DropSqlPersistenceProviderLogic.sql svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\de\SqlPersistenceProviderLogic.sql svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..terprisen.resources_31bf3856ad364e35_6.1.7601.17514_es-es_9c867a3a571c6936\license.rtf svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_remote_FAQ.help.txt svchost.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_Reserved_Words.help.txt svchost.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_pipelines.help.txt svchost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Garden.jpg svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_aliases.help.txt svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_remote.help.txt svchost.exe File opened for modification C:\Windows\winsxs\amd64_wiaca00b.inf_31bf3856ad364e35_6.1.7600.16385_none_9a3fc1497fbc9081\CNC172DD.TBL svchost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_1cbdcfd93365b0f0\license.rtf svchost.exe File opened for modification C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp3.jpg svchost.exe File opened for modification C:\Windows\Web\Wallpaper\Scenes\img25.jpg svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d34b7c772c3fe85c\license.rtf svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_remote_output.help.txt svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_script_internationalization.help.txt svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_escape_characters.help.txt svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\ja\Tracking_Logic.sql svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_6a8fc4b7a7c6fdc9\license.rtf svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Line_Editing.help.txt svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_prompts.help.txt svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-characters_31bf3856ad364e35_6.1.7600.16385_none_bde0eaed84920a21\img23.jpg svchost.exe File opened for modification C:\Windows\winsxs\amd64_prnca00d.inf_31bf3856ad364e35_6.1.7600.16385_none_de510ba10fac7008\Amd64\CNBJ2850.TBL svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\es\DropSqlPersistenceProviderLogic.sql svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..epremiume.resources_31bf3856ad364e35_6.1.7600.16385_it-it_37669c3d6397c19d\license.rtf svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_parameters.help.txt svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_objects.help.txt svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026\Blue_Gradient.jpg svchost.exe File opened for modification C:\Windows\Web\Wallpaper\Nature\img3.jpg svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..epremiume.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4d3ea5f68c65dc1f\license.rtf svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_en-us_36242a66d0a3fac8\license.rtf svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_parameters.help.txt svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_functions_advanced_methods.help.txt svchost.exe File opened for modification C:\Windows\winsxs\amd64_prnca00h.inf_31bf3856ad364e35_6.1.7600.16385_none_e0755475742561ac\Amd64\CNBJ2880.TBL svchost.exe File opened for modification C:\Windows\ehome\de-DE\playready_eula.txt svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1033\eula.rtf svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..homegroup.resources_31bf3856ad364e35_6.1.7600.16385_it-it_e09c57750c431b94\OOBE_HELP_What_is_HomeGroup.rtf svchost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_CommonParameters.help.txt svchost.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_types.ps1xml.help.txt svchost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7601.17514_de-de_d7f59b6f239c3e50\license.rtf svchost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aeacd0d57d868ef3\license.rtf svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 3 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop svchost.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\ svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\Desktop\TileWallpaper = "0" svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
svchost.exepid process 1920 svchost.exe 1920 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exesvchost.exesvchost.execmd.exedescription pid process target process PID 1508 wrote to memory of 2204 1508 aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe svchost.exe PID 1508 wrote to memory of 2204 1508 aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe svchost.exe PID 1508 wrote to memory of 2204 1508 aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe svchost.exe PID 1508 wrote to memory of 2204 1508 aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe svchost.exe PID 2204 wrote to memory of 2472 2204 svchost.exe svchost.exe PID 2204 wrote to memory of 2472 2204 svchost.exe svchost.exe PID 2204 wrote to memory of 2472 2204 svchost.exe svchost.exe PID 2204 wrote to memory of 2472 2204 svchost.exe svchost.exe PID 2204 wrote to memory of 1920 2204 svchost.exe svchost.exe PID 2204 wrote to memory of 1920 2204 svchost.exe svchost.exe PID 2204 wrote to memory of 1920 2204 svchost.exe svchost.exe PID 2204 wrote to memory of 1920 2204 svchost.exe svchost.exe PID 2204 wrote to memory of 1920 2204 svchost.exe svchost.exe PID 2204 wrote to memory of 1920 2204 svchost.exe svchost.exe PID 2204 wrote to memory of 1920 2204 svchost.exe svchost.exe PID 2204 wrote to memory of 1920 2204 svchost.exe svchost.exe PID 1920 wrote to memory of 1316 1920 svchost.exe cmd.exe PID 1920 wrote to memory of 1316 1920 svchost.exe cmd.exe PID 1920 wrote to memory of 1316 1920 svchost.exe cmd.exe PID 1920 wrote to memory of 1316 1920 svchost.exe cmd.exe PID 1316 wrote to memory of 1348 1316 cmd.exe chcp.com PID 1316 wrote to memory of 1348 1316 cmd.exe chcp.com PID 1316 wrote to memory of 1348 1316 cmd.exe chcp.com PID 1316 wrote to memory of 1348 1316 cmd.exe chcp.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\LUBGQ.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\chcp.comchcp 12515⤵PID:1348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
195B
MD56a82eda3a3a666ba9066a80bd2991f88
SHA1ce1d3cbb34057268b3558dbcecd420a0c17b119b
SHA256dfdec52773e24485a4fa24916cf565f9825cae5377e305d2b200c131584f0383
SHA51275b796f29434030052d3eadea32edc9bbcdc3b44a2026aeb6bbf8efbf33d87fb9f4075cb3e41c97ee64d0d020f2213cadb9cac346768f41b52f92529a4a53615
-
Filesize
421KB
MD504570aca8e3c6d50c63df19d7716fafb
SHA133dce47cbc7f76f971d64d1f3b893fac702047e6
SHA256dfd333a159c6ba2160bbda110c36f8a2b0ea03ba34b7b95743cfe7e63b066088
SHA51234793b8c20000f84e4d517b82bfde8e23e4c7da688451777dea16d174a375e71f9929a6e7d768e9d5cbf19cc64c0a606e7fc370e131bedf9ce94e36f58ed262a