da0064fdaf4bd4955e9d130e500ccb71e2df41a65eef619d1c556972d1d6cac1

Analysis

max time kernel
148s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe
Size

1.0MB
MD5

0063afc31e689ab178279bce2ec3419b
SHA1

5f755f4804a5991cef2395889b4a31fd1fa54822
SHA256

da0064fdaf4bd4955e9d130e500ccb71e2df41a65eef619d1c556972d1d6cac1
SHA512

d3efa84da31d6a8f743ec8229438711337fe6c886930bec9f8d37d6ec301b81ac5838b86b51b373baaaa566867c11e306717481c9b88b99a491b3aeee3ec40e2
SSDEEP

24576:RNHuGUiEOqILxACgJ2DM/r1uzYN6jzXTsBM2DJ01mlJg:RNHXUtOqI1jatT1uUOzjsB31qmPg

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\3WJR06OVN7.exe = "C:\\Users\\Admin\\AppData\\Roaming\\3WJR06OVN7.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	0063afc31e689ab178279bce2ec3419b_JaffaCakes1181.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	0063afc31e689ab178279bce2ec3419b_JaffaCakes1181.exe

Executes dropped EXE 1 IoCs

pid	Process
4536	0063afc31e689ab178279bce2ec3419b_JaffaCakes1181.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2984 set thread context of 4268	2984	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	84

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 502f0be488c2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078f1237f04e5404da848d5bad8ef8626000000000200000000001066000000010000200000002b58e7f8f2c12522c39064c6a6b77205fdea004b6b0a2e0449c0de272adc58c7000000000e8000000002000020000000d91df6ecbab0b4fb7bc3c768ed333d9e10845473fce86ce824efc27d6f94b1f8200000004f0acf48fd6ca7900555bbe88f65c0513dc4048b26d34a087cea566f0b8d99f840000000a9564461c59282d24b98d87e8cddf2f65dcfd7af717e9d11ee4d9ae497d526ba0e86edc80ec8b5df4a52c7293e6602e190e46423ddd15fba5fd7c602812b931d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078f1237f04e5404da848d5bad8ef86260000000002000000000010660000000100002000000097b1d2e50a5586e5475633cf3779ffe68bc3018cbe0e115bdf2aec4aa111991a000000000e80000000020000200000006c6b9dc43ebd7302330452adca697acca554af55627b60e22b9fb5cefc35ed62200000001be9ea1b64eaeadb069a4a086b2055e93659f846cceb484a1356deff1a9c751740000000b954b7b158e387409c5453f6716908c0db489d57448abf91d3473cf2777365501775380d3cf5cfe0c6c1f9f8938313e6ca4986befb38339afefbc02f69dfd1af	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424991462"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0EFFA681-2E7C-11EF-9519-5ABC67A14C95} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e508e488c2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1984	reg.exe
2020	reg.exe
1460	reg.exe
4600	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 1	4268	vbc.exe
Token: SeCreateTokenPrivilege	4268	vbc.exe
Token: SeAssignPrimaryTokenPrivilege	4268	vbc.exe
Token: SeLockMemoryPrivilege	4268	vbc.exe
Token: SeIncreaseQuotaPrivilege	4268	vbc.exe
Token: SeMachineAccountPrivilege	4268	vbc.exe
Token: SeTcbPrivilege	4268	vbc.exe
Token: SeSecurityPrivilege	4268	vbc.exe
Token: SeTakeOwnershipPrivilege	4268	vbc.exe
Token: SeLoadDriverPrivilege	4268	vbc.exe
Token: SeSystemProfilePrivilege	4268	vbc.exe
Token: SeSystemtimePrivilege	4268	vbc.exe
Token: SeProfSingleProcessPrivilege	4268	vbc.exe
Token: SeIncBasePriorityPrivilege	4268	vbc.exe
Token: SeCreatePagefilePrivilege	4268	vbc.exe
Token: SeCreatePermanentPrivilege	4268	vbc.exe
Token: SeBackupPrivilege	4268	vbc.exe
Token: SeRestorePrivilege	4268	vbc.exe
Token: SeShutdownPrivilege	4268	vbc.exe
Token: SeDebugPrivilege	4268	vbc.exe
Token: SeAuditPrivilege	4268	vbc.exe
Token: SeSystemEnvironmentPrivilege	4268	vbc.exe
Token: SeChangeNotifyPrivilege	4268	vbc.exe
Token: SeRemoteShutdownPrivilege	4268	vbc.exe
Token: SeUndockPrivilege	4268	vbc.exe
Token: SeSyncAgentPrivilege	4268	vbc.exe
Token: SeEnableDelegationPrivilege	4268	vbc.exe
Token: SeManageVolumePrivilege	4268	vbc.exe
Token: SeImpersonatePrivilege	4268	vbc.exe
Token: SeCreateGlobalPrivilege	4268	vbc.exe
Token: 31	4268	vbc.exe
Token: 32	4268	vbc.exe
Token: 33	4268	vbc.exe
Token: 34	4268	vbc.exe
Token: 35	4268	vbc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1648	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4268	vbc.exe
4268	vbc.exe
4268	vbc.exe
4268	vbc.exe
1648	iexplore.exe
1648	iexplore.exe
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 4268	2984	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	84
PID 2984 wrote to memory of 4268	2984	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	84
PID 2984 wrote to memory of 4268	2984	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	84
PID 2984 wrote to memory of 4268	2984	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	84
PID 2984 wrote to memory of 4268	2984	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	84
PID 2984 wrote to memory of 4268	2984	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	84
PID 2984 wrote to memory of 4268	2984	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	84
PID 2984 wrote to memory of 4268	2984	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	84
PID 4268 wrote to memory of 3372	4268	vbc.exe	85
PID 4268 wrote to memory of 3372	4268	vbc.exe	85
PID 4268 wrote to memory of 3372	4268	vbc.exe	85
PID 4268 wrote to memory of 3916	4268	vbc.exe	86
PID 4268 wrote to memory of 3916	4268	vbc.exe	86
PID 4268 wrote to memory of 3916	4268	vbc.exe	86
PID 4268 wrote to memory of 4744	4268	vbc.exe	87
PID 4268 wrote to memory of 4744	4268	vbc.exe	87
PID 4268 wrote to memory of 4744	4268	vbc.exe	87
PID 4268 wrote to memory of 4140	4268	vbc.exe	88
PID 4268 wrote to memory of 4140	4268	vbc.exe	88
PID 4268 wrote to memory of 4140	4268	vbc.exe	88
PID 2984 wrote to memory of 1648	2984	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	93
PID 2984 wrote to memory of 1648	2984	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	93
PID 4140 wrote to memory of 2020	4140	cmd.exe	94
PID 4140 wrote to memory of 2020	4140	cmd.exe	94
PID 4140 wrote to memory of 2020	4140	cmd.exe	94
PID 3916 wrote to memory of 1984	3916	cmd.exe	95
PID 3916 wrote to memory of 1984	3916	cmd.exe	95
PID 3916 wrote to memory of 1984	3916	cmd.exe	95
PID 3372 wrote to memory of 1460	3372	cmd.exe	96
PID 3372 wrote to memory of 1460	3372	cmd.exe	96
PID 3372 wrote to memory of 1460	3372	cmd.exe	96
PID 2984 wrote to memory of 3020	2984	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	97
PID 2984 wrote to memory of 3020	2984	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	97
PID 2984 wrote to memory of 3020	2984	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	97
PID 4744 wrote to memory of 4600	4744	cmd.exe	99
PID 4744 wrote to memory of 4600	4744	cmd.exe	99
PID 4744 wrote to memory of 4600	4744	cmd.exe	99
PID 1648 wrote to memory of 1196	1648	iexplore.exe	100
PID 1648 wrote to memory of 1196	1648	iexplore.exe	100
PID 1648 wrote to memory of 1196	1648	iexplore.exe	100
PID 3020 wrote to memory of 1036	3020	vbc.exe	101
PID 3020 wrote to memory of 1036	3020	vbc.exe	101
PID 3020 wrote to memory of 1036	3020	vbc.exe	101
PID 2984 wrote to memory of 4536	2984	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	102
PID 2984 wrote to memory of 4536	2984	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	102
PID 2984 wrote to memory of 4536	2984	0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe	102

C:\Users\Admin\AppData\Local\Temp\0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:1460
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:1984
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:4600
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\3WJR06OVN7.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\3WJR06OVN7.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\3WJR06OVN7.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\3WJR06OVN7.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      Modifies registry key
      PID:2020
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Roaming\Happy Birthday.gif
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1196
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hegp8wye.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F0C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD1D5ED041EDC444A8B6538E97563F37.TMP"
    3⤵
    PID:1036
- C:\Users\Admin\AppData\Roaming\0063afc31e689ab178279bce2ec3419b_JaffaCakes1181.exe
  "C:\Users\Admin\AppData\Roaming\0063afc31e689ab178279bce2ec3419b_JaffaCakes1181.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES3F0C.tmp

Filesize
1KB

MD5
f6010427f314fa011b731521c881c4b0

SHA1
f1f45394189592241922bb3572baa9ff4c20a4ec

SHA256
f29644b2cdacd46fa7c8847769d3a5680e205a6f985068a2bc32bcb3ef6722ed

SHA512
e7900d46c9bb2f7907e01d11d87978f2d415234f426e8589edeebf37c89caa6407d14662d5523e2e7f293365cbe9bccdd16a6c45f24b0db97e0e82670d6fbff7

Download Submit
C:\Users\Admin\AppData\Local\Temp\hegp8wye.0.vb

Filesize
381B

MD5
d9004fd374c4ace6543730c562103204

SHA1
eb7b51eaf67efe09f8f726c6095f4e8c435af3d1

SHA256
8615310e4321e54e435d3ca2db985b19dd3f5b9653b54ad7af854d94a719c43e

SHA512
052609cbfbedeaaf14914a07f52bc8b6f5cddbbaac7f25be190e735f53b245b3e302f887164396c4c8ced468e171d98bf9408efa124cbb5f7e3daef67808301e

Download Submit
C:\Users\Admin\AppData\Local\Temp\hegp8wye.cmdline

Filesize
235B

MD5
8b96c632315d38f62cdfb3533c5f125d

SHA1
af941a2a1309c67d9e54d2160803d147e0f6a2a8

SHA256
ff8920c2d38ddb33311fe2d3023ce50db6e7cfacd4cfb88e56227c7fab625cc6

SHA512
5c0e21698cde30b47d1c5c52e1ee11891eb945b539392a0a274ff57c3fe8b0a31be62dd33610bfd76c6ba54119558cb1509446ec3c1b47014fd17751bb7efba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcD1D5ED041EDC444A8B6538E97563F37.TMP

Filesize
804B

MD5
72f0efb76ac38f31b1feb9e3372237ad

SHA1
c9a2660bc7f1657e42f2ed081e1e17b3a993cbf1

SHA256
8aa7dc06856721b3ba60d3defcb757428c02ad383a02fec147808333a7f07108

SHA512
087e62ca99afbc4d1c61b85b929fab16ffe63cdff658047027a5850e2dacb6c5f2f2188109e4f8bcc4d3ced8df5d4bb021fa1ccf88bc823c3296b4fe4e453b85

Download Submit
C:\Users\Admin\AppData\Roaming\0063afc31e689ab178279bce2ec3419b_JaffaCakes118.exe

Filesize
1.0MB

MD5
0063afc31e689ab178279bce2ec3419b

SHA1
5f755f4804a5991cef2395889b4a31fd1fa54822

SHA256
da0064fdaf4bd4955e9d130e500ccb71e2df41a65eef619d1c556972d1d6cac1

SHA512
d3efa84da31d6a8f743ec8229438711337fe6c886930bec9f8d37d6ec301b81ac5838b86b51b373baaaa566867c11e306717481c9b88b99a491b3aeee3ec40e2

Download Submit
C:\Users\Admin\AppData\Roaming\0063afc31e689ab178279bce2ec3419b_JaffaCakes1181.exe

Filesize
6KB

MD5
ba3dce5b4c7863bf7010fbca141e7399

SHA1
ee7d83197bb301e3082e7e79cf8250e2dd76bcb7

SHA256
3b5177edd2fe2a8dd1d2de7492ffb0a519adeffa5e8beaa9cf13d0d2fd5a3a92

SHA512
58fcbe674654c7325f181a6fe7b10f910c982275ca48ee9f605043587da32a6f67028360a522fd480c578082ef5c342b27944630794b1092086dc2b19c76f90a

Download Submit
C:\Users\Admin\AppData\Roaming\Happy Birthday.gif

Filesize
90KB

MD5
e1f336d93eae5dcef0ea53e27d33135b

SHA1
c8acc96fe0f80bc220f8ed43f71c8b55250b585d

SHA256
07dd33438839fab641dfd51fc6f97443398138db7ea4ace748da5c3638079542

SHA512
f04653d6567a4cdcce5f73cc38021a448453b852f0972869aa8f156c47af985d67d3cb0602ec91a469333b4fa012118f240748c2ac887a906a9492550fbb2469

Download Submit
memory/2984-36-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/2984-1-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/2984-0-0x00000000752A2000-0x00000000752A3000-memory.dmp

Filesize
4KB

Download
memory/2984-2-0x00000000752A0000-0x0000000075851000-memory.dmp

Filesize
5.7MB

Download
memory/4268-47-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4268-50-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4268-41-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4268-42-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4268-44-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4268-7-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4268-48-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4268-5-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4268-51-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4268-54-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4268-55-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4268-56-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4268-58-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4268-59-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads