Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
21/06/2024, 13:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe
- Size 411KB
- Sample240621-q3rysswdrm
- SHA256 e1cbd135d37099174bba81c54c27b6b7af35c9caf8f90bbd7bbea89adc60f78d
- MD5 0bfdb3f8d171f7579cd604bf5d01fc07
- SHA1 1ac739f5bf55030831263d42865a2b43eaabb07b
- SHA512 181b0938707d888701141fd0b8f42814a5f63cf7d076a40f1109335851f5861dbcf402fdffdaae149db675f5b304cc63ca64cbf805b07fa7ada88c4cb6564cda
- SSDEEP 12288:2snBEDiUydWp6Hi9yrrMsuoD+SRwku7t/tN:2snuO9H+ya9+1u7BtN
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/files/0x00070000000233f5-7.dat modiloader_stage2 behavioral2/memory/4412-14-0x0000000000400000-0x00000000004BC000-memory.dmp modiloader_stage2 - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscntfy.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guard.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvMonXP.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guard.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmon.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscntfy.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avast.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVXP.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmon.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavmonD.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavmonD.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avast.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVXP.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvMonXP.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe\debugger = "IFEOFILE" 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe - Executes dropped EXE 1 IoCs
pid Process 4412 jplnz48c2008_server.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt jplnz48c2008_server.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2360 wrote to memory of 4412 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 80 PID 2360 wrote to memory of 4412 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 80 PID 2360 wrote to memory of 4412 2360 0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe 80 PID 4412 wrote to memory of 3644 4412 jplnz48c2008_server.exe 81 PID 4412 wrote to memory of 3644 4412 jplnz48c2008_server.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0bfdb3f8d171f7579cd604bf5d01fc07_JaffaCakes118.exe"1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Temp\jplnz48c2008_server.exe"C:\Temp\jplnz48c2008_server.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵PID:3644
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Temp\jplnz48c2008_server.exe
- Size 685KB
- SHA256 608d4d1edb4b5eaf7e8dcbbccde8c3ac49a16b9a6ac719817193f835e217dca6
- MD5 e7bfa93af2a8fa7e95c8c070a37c655b
- SHA1 f4be15da1901307c1c571ae0bb253498bab6378d
- SHA512 79f8124896997b5fae59c3c46c3a5878fc852dba41f2441b10df4dd6b4f56438024482cb710de9120155ce4951097fce185b45c0faa5ef66b2e074eff35f24e4
- SSDEEP 12288:DMh9S2Ty+X7hEnrGmjglFeiHzJ9OhDBW5NpfHrf+VT7K:4bSH67hACrveE6hBEpjf+VTO
- MD5 SHA1 SHA512 SSDEEP