Analysis
-
max time kernel
144s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 02:01
Static task
static1
Behavioral task
behavioral1
Sample
01e08124e97858a044f7be04467118fb_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
01e08124e97858a044f7be04467118fb_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
01e08124e97858a044f7be04467118fb_JaffaCakes118.exe
-
Size
710KB
-
MD5
01e08124e97858a044f7be04467118fb
-
SHA1
525c2206e9ccbc69f33e219852268ed0a89df020
-
SHA256
e1045ae27e2cecf73c60f452c047a6a991974dc8cd9e1312c6fced78f27e3499
-
SHA512
d575d0828b7c8d6bc7220c687d655dbf0e95ad2f2251901533f366d2b9381d467c326683e2fc9de90bfb1d80b83a2ed6e6a0da52247d3a4549771b00fcb9b463
-
SSDEEP
12288:BNnhEXReigHdYA0mApYc9eH9i3zoDFmujec1ZF3Z4mxxFhsV4AOwf7DGj7Xzs:BNnhEXDAnkL94yzC9egZQmXzYtfujE
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SaveFile.exe modiloader_stage2 C:\Temp\5.exe modiloader_stage2 behavioral2/memory/2000-105-0x0000000000770000-0x0000000000836000-memory.dmp modiloader_stage2 behavioral2/memory/1852-106-0x0000000000400000-0x00000000004C6000-memory.dmp modiloader_stage2 -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
Processes:
SaveFile.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVXP.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\katmain.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\katmain.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVXP.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmon.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavmonD.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvMonXP.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscntfy.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscntfy.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmon.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe SaveFile.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SaveFile.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation SaveFile.exe -
Executes dropped EXE 2 IoCs
Processes:
SaveFile.exe5.exepid process 4304 SaveFile.exe 1852 5.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
01e08124e97858a044f7be04467118fb_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 01e08124e97858a044f7be04467118fb_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5.exedescription pid process target process PID 1852 set thread context of 2000 1852 5.exe IEXPLORE.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
5.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt 5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3466816459" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31113909" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425613852" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31113909" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FA4106B7-2EA8-11EF-8383-663BBECB1CCD} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31113909" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3466816459" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3469941353" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
SaveFile.exepid process 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe 4304 SaveFile.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SaveFile.exedescription pid process Token: SeDebugPrivilege 4304 SaveFile.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 2000 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
SaveFile.exeIEXPLORE.EXEIEXPLORE.EXEpid process 4304 SaveFile.exe 2000 IEXPLORE.EXE 2000 IEXPLORE.EXE 1792 IEXPLORE.EXE 1792 IEXPLORE.EXE 1792 IEXPLORE.EXE 1792 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
01e08124e97858a044f7be04467118fb_JaffaCakes118.exeSaveFile.exe5.exeIEXPLORE.EXEdescription pid process target process PID 4800 wrote to memory of 4304 4800 01e08124e97858a044f7be04467118fb_JaffaCakes118.exe SaveFile.exe PID 4800 wrote to memory of 4304 4800 01e08124e97858a044f7be04467118fb_JaffaCakes118.exe SaveFile.exe PID 4800 wrote to memory of 4304 4800 01e08124e97858a044f7be04467118fb_JaffaCakes118.exe SaveFile.exe PID 4304 wrote to memory of 1852 4304 SaveFile.exe 5.exe PID 4304 wrote to memory of 1852 4304 SaveFile.exe 5.exe PID 4304 wrote to memory of 1852 4304 SaveFile.exe 5.exe PID 1852 wrote to memory of 2000 1852 5.exe IEXPLORE.EXE PID 1852 wrote to memory of 2000 1852 5.exe IEXPLORE.EXE PID 1852 wrote to memory of 2000 1852 5.exe IEXPLORE.EXE PID 2000 wrote to memory of 1792 2000 IEXPLORE.EXE IEXPLORE.EXE PID 2000 wrote to memory of 1792 2000 IEXPLORE.EXE IEXPLORE.EXE PID 2000 wrote to memory of 1792 2000 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\01e08124e97858a044f7be04467118fb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\01e08124e97858a044f7be04467118fb_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SaveFile.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SaveFile.exe2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Temp\5.exe"C:\Temp\5.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Event Triggered Execution
1Image File Execution Options Injection
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Temp\5.exeFilesize
752KB
MD5330549ac67e34581e39c2c6d72e2ed86
SHA1ce835896e5d0fbba8940faff0f66708c2da5b858
SHA256f322a69361a7d3bbf49afa46ce317f6c2cee8c0d07aa8fd83ed9abc80969a4e9
SHA51264ff1eed562decdeaa69babec11bf955664b76d28a013ddef083d021c5ba4fa869fc5d3ba548b15a774b9fa77f49c3ca6afc80a40d876a1089447a27322b1fc4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SaveFile.exeFilesize
780KB
MD5685552f9a515aaa0868396b967ac9226
SHA1e9d3049ccd0d9b5aab2fe85c9391fed6cd1d3d07
SHA25651ac9cd1ee309e003c60829239357891ffd0cebc95bdff5644c3b14de3de27ad
SHA5127176b7f3dde3162ccf6916227cff0421332040619c28cfea29fc80c14a1d34916859a3e60a0047d08d5eae4fd80e47c0d3d9026a4a4c13f215782326b63135b1
-
memory/1852-106-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB
-
memory/2000-105-0x0000000000770000-0x0000000000836000-memory.dmpFilesize
792KB
-
memory/4800-48-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-45-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-2-0x00000000005F0000-0x00000000005F1000-memory.dmpFilesize
4KB
-
memory/4800-74-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-88-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-87-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-86-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-85-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-84-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-83-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-82-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-81-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-80-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-79-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-78-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-77-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-76-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-75-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-73-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-72-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-71-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-70-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-46-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-68-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-67-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-66-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-65-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-64-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-63-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-62-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-61-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-60-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-59-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-58-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-57-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-56-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-55-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-54-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-53-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-52-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-51-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-50-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-49-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-1-0x00000000004E0000-0x0000000000534000-memory.dmpFilesize
336KB
-
memory/4800-27-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-0-0x0000000001000000-0x000000000111E000-memory.dmpFilesize
1.1MB
-
memory/4800-69-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-44-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-43-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-42-0x0000000000D00000-0x0000000000D01000-memory.dmpFilesize
4KB
-
memory/4800-41-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB
-
memory/4800-40-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/4800-39-0x0000000000CD0000-0x0000000000CD1000-memory.dmpFilesize
4KB
-
memory/4800-38-0x0000000000CF0000-0x0000000000CF1000-memory.dmpFilesize
4KB
-
memory/4800-37-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-36-0x0000000000680000-0x0000000000681000-memory.dmpFilesize
4KB
-
memory/4800-35-0x0000000000C80000-0x0000000000C81000-memory.dmpFilesize
4KB
-
memory/4800-34-0x0000000000C50000-0x0000000000C51000-memory.dmpFilesize
4KB
-
memory/4800-33-0x0000000000C60000-0x0000000000C61000-memory.dmpFilesize
4KB
-
memory/4800-32-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/4800-31-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/4800-30-0x0000000000C70000-0x0000000000C71000-memory.dmpFilesize
4KB
-
memory/4800-29-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/4800-28-0x0000000000C40000-0x0000000000C41000-memory.dmpFilesize
4KB
-
memory/4800-47-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-26-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-25-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-24-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/4800-23-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-22-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-21-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-20-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-19-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-18-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-17-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-16-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-15-0x0000000000630000-0x0000000000631000-memory.dmpFilesize
4KB
-
memory/4800-14-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-13-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-12-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-11-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-10-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-9-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/4800-8-0x0000000000600000-0x0000000000601000-memory.dmpFilesize
4KB
-
memory/4800-7-0x0000000000610000-0x0000000000611000-memory.dmpFilesize
4KB
-
memory/4800-6-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/4800-5-0x00000000005A0000-0x00000000005A1000-memory.dmpFilesize
4KB
-
memory/4800-4-0x0000000000620000-0x0000000000621000-memory.dmpFilesize
4KB
-
memory/4800-3-0x00000000005D0000-0x00000000005D1000-memory.dmpFilesize
4KB
-
memory/4800-109-0x0000000001000000-0x000000000111E000-memory.dmpFilesize
1.1MB
-
memory/4800-108-0x00000000004E0000-0x0000000000534000-memory.dmpFilesize
336KB