Analysis
-
max time kernel
145s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2024 07:16
Static task
static1
Behavioral task
behavioral1
Sample
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe
-
Size
164KB
-
MD5
058524baa2ab984ae42e38bea409e19b
-
SHA1
615866bc6118eb416078a1ff21227c6aa103a9c2
-
SHA256
234a3979e6539ae7cb03d274bc7a24443f855b8fd5b56c6911b6889b6a3500c2
-
SHA512
6fcb594d8281c233517e550fddd57224add4a728e7571a77875577552dfa901e71dd100ce3a69c113b827aee6d7985bfb780a92bad722a4d9c21a520f380e26f
-
SSDEEP
3072:Pt74elV4KOH33pZWh1bsepg3JMIpu/AXyG/5iMCC1Wa:Fsid43PWvbDgAAjb13
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 3 TTPs 8 IoCs
Processes:
wmpdl32.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications wmpdl32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpdl32.exe = "C:\\Windows\\SysWOW64\\wmpdl32.exe:*:Enabled:Windows Data Launcher" wmpdl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List wmpdl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile wmpdl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications wmpdl32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpdl32.exe = "C:\\Windows\\SysWOW64\\wmpdl32.exe:*:Enabled:Windows Data Launcher" wmpdl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List wmpdl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile wmpdl32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe -
Deletes itself 1 IoCs
Processes:
wmpdl32.exepid process 4804 wmpdl32.exe -
Executes dropped EXE 2 IoCs
Processes:
wmpdl32.exewmpdl32.exepid process 372 wmpdl32.exe 4804 wmpdl32.exe -
Processes:
resource yara_rule behavioral2/memory/808-0-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/808-2-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/808-4-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/808-3-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/808-40-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4804-44-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4804-45-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4804-46-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4804-47-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4804-48-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4804-49-0x0000000000400000-0x0000000000457000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
wmpdl32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Data Launcher = "C:\\Windows\\SysWOW64\\wmpdl32.exe" wmpdl32.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exewmpdl32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdl32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpdl32.exe -
Drops file in System32 directory 4 IoCs
Processes:
wmpdl32.exe058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ wmpdl32.exe File opened for modification C:\Windows\SysWOW64\ 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wmpdl32.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe File created C:\Windows\SysWOW64\wmpdl32.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exewmpdl32.exedescription pid process target process PID 4020 set thread context of 808 4020 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe PID 372 set thread context of 4804 372 wmpdl32.exe wmpdl32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exewmpdl32.exepid process 808 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 808 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 808 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 808 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 4804 wmpdl32.exe 4804 wmpdl32.exe 4804 wmpdl32.exe 4804 wmpdl32.exe 4804 wmpdl32.exe 4804 wmpdl32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wmpdl32.exedescription pid process Token: SeDebugPrivilege 4804 wmpdl32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exewmpdl32.exewmpdl32.exedescription pid process target process PID 4020 wrote to memory of 808 4020 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe PID 4020 wrote to memory of 808 4020 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe PID 4020 wrote to memory of 808 4020 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe PID 4020 wrote to memory of 808 4020 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe PID 4020 wrote to memory of 808 4020 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe PID 4020 wrote to memory of 808 4020 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe PID 4020 wrote to memory of 808 4020 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe PID 808 wrote to memory of 372 808 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe wmpdl32.exe PID 808 wrote to memory of 372 808 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe wmpdl32.exe PID 808 wrote to memory of 372 808 058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe wmpdl32.exe PID 372 wrote to memory of 4804 372 wmpdl32.exe wmpdl32.exe PID 372 wrote to memory of 4804 372 wmpdl32.exe wmpdl32.exe PID 372 wrote to memory of 4804 372 wmpdl32.exe wmpdl32.exe PID 372 wrote to memory of 4804 372 wmpdl32.exe wmpdl32.exe PID 372 wrote to memory of 4804 372 wmpdl32.exe wmpdl32.exe PID 372 wrote to memory of 4804 372 wmpdl32.exe wmpdl32.exe PID 372 wrote to memory of 4804 372 wmpdl32.exe wmpdl32.exe PID 4804 wrote to memory of 612 4804 wmpdl32.exe winlogon.exe PID 4804 wrote to memory of 612 4804 wmpdl32.exe winlogon.exe PID 4804 wrote to memory of 612 4804 wmpdl32.exe winlogon.exe PID 4804 wrote to memory of 672 4804 wmpdl32.exe lsass.exe PID 4804 wrote to memory of 780 4804 wmpdl32.exe fontdrvhost.exe PID 4804 wrote to memory of 784 4804 wmpdl32.exe fontdrvhost.exe PID 4804 wrote to memory of 800 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 908 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 956 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 332 4804 wmpdl32.exe dwm.exe PID 4804 wrote to memory of 516 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 996 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1068 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1076 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1104 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1132 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1168 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1176 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1272 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1332 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1408 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1416 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1620 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1628 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1636 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1724 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1760 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1768 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1848 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 2000 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 2024 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 2032 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1696 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 1880 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 2112 4804 wmpdl32.exe spoolsv.exe PID 4804 wrote to memory of 2168 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 2216 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 2336 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 2540 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 2548 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 2636 4804 wmpdl32.exe sihost.exe PID 4804 wrote to memory of 2664 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 2740 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 2764 4804 wmpdl32.exe taskhostw.exe PID 4804 wrote to memory of 2796 4804 wmpdl32.exe svchost.exe PID 4804 wrote to memory of 2812 4804 wmpdl32.exe sysmon.exe PID 4804 wrote to memory of 2836 4804 wmpdl32.exe svchost.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:332
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:672
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:800
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:3152
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3904
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3992
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4060
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:1500
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4180
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:5100
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:4672
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵PID:632
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:2212
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3348
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:1756
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding2⤵PID:440
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca2⤵PID:1428
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding2⤵PID:5012
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:516
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:996
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1068
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1076
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1104
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2764
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1132
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1168
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1176
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1272
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1332
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1408
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1416
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1620
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1628
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1724
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1760
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1768
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:2000
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:2024
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:2032
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1696
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:1880
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2112
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2168
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2216
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2740
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2796
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2812
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2836
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2856
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2868
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3472
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\058524baa2ab984ae42e38bea409e19b_JaffaCakes118.exe"3⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\wmpdl32.exe"C:\Windows\SysWOW64\wmpdl32.exe" C:\Users\Admin\AppData\Local\Temp\058524~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\wmpdl32.exe"C:\Windows\SysWOW64\wmpdl32.exe" C:\Users\Admin\AppData\Local\Temp\058524~1.EXE5⤵
- Modifies firewall policy service
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3692
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:4992
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:1188
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:2424
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:4840
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:4844
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:4312
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:2468
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD5058524baa2ab984ae42e38bea409e19b
SHA1615866bc6118eb416078a1ff21227c6aa103a9c2
SHA256234a3979e6539ae7cb03d274bc7a24443f855b8fd5b56c6911b6889b6a3500c2
SHA5126fcb594d8281c233517e550fddd57224add4a728e7571a77875577552dfa901e71dd100ce3a69c113b827aee6d7985bfb780a92bad722a4d9c21a520f380e26f