Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 23:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe
-
Size
42KB
-
MD5
0b2d88e02b879c09b5a615cf670e592a
-
SHA1
156dea84ee8b56c8e45459358d54f41be0876fb8
-
SHA256
db94bfc9678d07f1c93a7880fdbdda84aa61193500fc0824803d583b637bef2d
-
SHA512
89035bffb6c7a7971ea231f36b9f0fdae644c52e822a3288cb42d47332e25e55fe88cf576064875aa8f3b701862b21d09b2f251260bc6021df1712c126906f71
-
SSDEEP
768:5sGgkgs9PuO7wd/xAfCK3j/7ZEEALZGXwnvN5BMCt:5sLs9uOEdcCK3z7ZEE6GXwl5R
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\o4316027.exe\"" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\j6316022.exe" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\j6316022.exe" m4623.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\j6316022.exe" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\o4316027.exe\"" 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\j6316022.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\o4316027.exe\"" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\o4316027.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\o4316027.exe\"" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\o4316027.exe\"" m4623.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\j6316022.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\o4316027.exe\"" qm4623.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\j6316022.exe" qm4623.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\j6316022.exe" 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\o4316027.exe\"" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\j6316022.exe" smss.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" lsass.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" qm4623.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" m4623.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" services.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csrss.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lsass.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qm4623.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" m4623.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" services.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csrss.exe -
Adds policy Run key to start application 2 TTPs 18 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\N5028c = "\"C:\\Windows\\_default31602.pif\"" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\f1464Adm = "\"C:\\Users\\Admin\\AppData\\Local\\dv692700x\\yesbron.com\"" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\N5028c = "\"C:\\Windows\\_default31602.pif\"" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\N5028c = "\"C:\\Windows\\_default31602.pif\"" m4623.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\f1464Adm = "\"C:\\Users\\Admin\\AppData\\Local\\dv692700x\\yesbron.com\"" 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\f1464Adm = "\"C:\\Users\\Admin\\AppData\\Local\\dv692700x\\yesbron.com\"" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\f1464Adm = "\"C:\\Users\\Admin\\AppData\\Local\\dv692700x\\yesbron.com\"" lsass.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\f1464Adm = "\"C:\\Users\\Admin\\AppData\\Local\\dv692700x\\yesbron.com\"" m4623.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\N5028c = "\"C:\\Windows\\_default31602.pif\"" 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\f1464Adm = "\"C:\\Users\\Admin\\AppData\\Local\\dv692700x\\yesbron.com\"" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\N5028c = "\"C:\\Windows\\_default31602.pif\"" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\N5028c = "\"C:\\Windows\\_default31602.pif\"" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\N5028c = "\"C:\\Windows\\_default31602.pif\"" qm4623.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\f1464Adm = "\"C:\\Users\\Admin\\AppData\\Local\\dv692700x\\yesbron.com\"" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\N5028c = "\"C:\\Windows\\_default31602.pif\"" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\f1464Adm = "\"C:\\Users\\Admin\\AppData\\Local\\dv692700x\\yesbron.com\"" qm4623.exe -
Disables RegEdit via registry modification 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lsass.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" qm4623.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" m4623.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" smss.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" services.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csrss.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts csrss.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation smss.exe Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation winlogon.exe Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation lsass.exe -
Executes dropped EXE 7 IoCs
pid Process 3528 smss.exe 1884 winlogon.exe 548 services.exe 3016 csrss.exe 4592 lsass.exe 4604 qm4623.exe 1336 m4623.exe -
Adds Run key to start application 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N5028c = "\"C:\\Windows\\j6316022.exe\"" smss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N5028c = "\"C:\\Windows\\j6316022.exe\"" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N5028c = "\"C:\\Windows\\j6316022.exe\"" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1464Adm = "\"C:\\Windows\\system32\\s4827\\zh59927084y.exe\"" lsass.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1464Adm = "\"C:\\Windows\\system32\\s4827\\zh59927084y.exe\"" qm4623.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1464Adm = "\"C:\\Windows\\system32\\s4827\\zh59927084y.exe\"" 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N5028c = "\"C:\\Windows\\j6316022.exe\"" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N5028c = "\"C:\\Windows\\j6316022.exe\"" qm4623.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N5028c = "\"C:\\Windows\\j6316022.exe\"" m4623.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N5028c = "\"C:\\Windows\\j6316022.exe\"" 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1464Adm = "\"C:\\Windows\\system32\\s4827\\zh59927084y.exe\"" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1464Adm = "\"C:\\Windows\\system32\\s4827\\zh59927084y.exe\"" smss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1464Adm = "\"C:\\Windows\\system32\\s4827\\zh59927084y.exe\"" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N5028c = "\"C:\\Windows\\j6316022.exe\"" services.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1464Adm = "\"C:\\Windows\\system32\\s4827\\zh59927084y.exe\"" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f1464Adm = "\"C:\\Windows\\system32\\s4827\\zh59927084y.exe\"" m4623.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: lsass.exe File opened (read-only) \??\P: lsass.exe File opened (read-only) \??\Q: lsass.exe File opened (read-only) \??\S: lsass.exe File opened (read-only) \??\T: lsass.exe File opened (read-only) \??\G: lsass.exe File opened (read-only) \??\M: lsass.exe File opened (read-only) \??\R: lsass.exe File opened (read-only) \??\U: lsass.exe File opened (read-only) \??\V: lsass.exe File opened (read-only) \??\H: lsass.exe File opened (read-only) \??\I: lsass.exe File opened (read-only) \??\O: lsass.exe File opened (read-only) \??\W: lsass.exe File opened (read-only) \??\Y: lsass.exe File opened (read-only) \??\Z: lsass.exe File opened (read-only) \??\E: lsass.exe File opened (read-only) \??\J: lsass.exe File opened (read-only) \??\K: lsass.exe File opened (read-only) \??\L: lsass.exe File opened (read-only) \??\X: lsass.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exe 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exe smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll lsass.exe File created C:\Windows\SysWOW64\s4827\smss.exe m4623.exe File created C:\Windows\SysWOW64\c_31602k.com 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\s4827\smss.exe services.exe File opened for modification C:\Windows\SysWOW64\s4827\smss.exe 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\s4827\smss.exe smss.exe File opened for modification C:\Windows\SysWOW64\s4827\lsass.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exe services.exe File opened for modification C:\Windows\SysWOW64\s4827 csrss.exe File opened for modification C:\Windows\SysWOW64\s4827 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe File created C:\Windows\SysWOW64\s4827\smss.exe smss.exe File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exe m4623.exe File created C:\Windows\SysWOW64\s4827\c.bron.tok.txt lsass.exe File opened for modification C:\Windows\SysWOW64\c_31602k.com services.exe File opened for modification C:\Windows\SysWOW64\c_31602k.com qm4623.exe File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exe lsass.exe File opened for modification C:\Windows\SysWOW64\s4827 m4623.exe File created C:\Windows\SysWOW64\s4827\zh59927084y.exe 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\s4827 smss.exe File opened for modification C:\Windows\SysWOW64\s4827 winlogon.exe File created C:\Windows\SysWOW64\s4827\zh59927084y.exe m4623.exe File created C:\Windows\SysWOW64\s4827\m4623.exe winlogon.exe File created C:\Windows\SysWOW64\s4827\smss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\s4827\smss.exe lsass.exe File created C:\Windows\SysWOW64\s4827\Spread.Mail.Bro\[email protected] services.exe File opened for modification C:\Windows\SysWOW64\c_31602k.com smss.exe File opened for modification C:\Windows\SysWOW64\s4827\services.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\s4827\winlogon.exe winlogon.exe File created C:\Windows\SysWOW64\s4827\smss.exe services.exe File opened for modification C:\Windows\SysWOW64\c_31602k.com csrss.exe File created C:\Windows\SysWOW64\s4827\smss.exe qm4623.exe File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exemsatr.bin smss.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll m4623.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe File created C:\Windows\SysWOW64\s4827\smss.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\s4827 services.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll services.exe File created C:\Windows\SysWOW64\s4827\lsass.exe winlogon.exe File created C:\Windows\SysWOW64\s4827\domlist.txt cmd.exe File created C:\Windows\SysWOW64\s4827\zh59927084y.exe qm4623.exe File created C:\Windows\SysWOW64\s4827\csrss.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exe csrss.exe File opened for modification C:\Windows\SysWOW64\s4827\zh59927084y.exe qm4623.exe File opened for modification C:\Windows\SysWOW64\s4827\smss.exe m4623.exe File opened for modification C:\Windows\SysWOW64\c_31602k.com m4623.exe File created C:\Windows\SysWOW64\s4827\smss.exe lsass.exe File opened for modification C:\Windows\SysWOW64\s4827\smss.exe qm4623.exe File opened for modification C:\Windows\SysWOW64\c_31602k.com lsass.exe File created C:\Windows\SysWOW64\s4827\smss.exe 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe File created C:\Windows\SysWOW64\s4827\zh59927084y.exemsatr.bin smss.exe File created C:\Windows\SysWOW64\s4827\winlogon.exe smss.exe File opened for modification C:\Windows\SysWOW64\s4827\smss.exe csrss.exe File opened for modification C:\Windows\SysWOW64\s4827 lsass.exe File opened for modification C:\Windows\SysWOW64\s4827\domlist.txt lsass.exe File created C:\Windows\SysWOW64\c_31602k.com m4623.exe File opened for modification C:\Windows\SysWOW64\c_31602k.com 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\c_31602k.com winlogon.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll winlogon.exe File opened for modification C:\Windows\SysWOW64\s4827\csrss.exe winlogon.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll qm4623.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csrss.exe -
Drops file in Windows directory 35 IoCs
description ioc Process File opened for modification C:\Windows\j6316022.exe lsass.exe File opened for modification C:\Windows\o4316027.exe csrss.exe File opened for modification C:\Windows\_default31602.pif csrss.exe File created C:\Windows\_default31602.pif qm4623.exe File opened for modification C:\Windows\o4316027.exe m4623.exe File created C:\Windows\j6316022.exe 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe File opened for modification C:\Windows\j6316022.exe smss.exe File opened for modification C:\Windows\_default31602.pif smss.exe File opened for modification C:\Windows\j6316022.exe services.exe File opened for modification C:\Windows\j6316022.exe csrss.exe File opened for modification C:\Windows\o4316027.exe 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe File opened for modification C:\Windows\_default31602.pif winlogon.exe File opened for modification C:\Windows\_default31602.pif lsass.exe File created C:\Windows\j6316022.exe m4623.exe File created C:\Windows\o4316027.exe m4623.exe File opened for modification C:\Windows\o4316027.exe winlogon.exe File opened for modification C:\Windows\Ad10218\qm4623.exe winlogon.exe File opened for modification C:\Windows\j6316022.exe qm4623.exe File created C:\Windows\_default31602.pif m4623.exe File created C:\Windows\o4316027.exe qm4623.exe File opened for modification C:\Windows\_default31602.pif 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe File opened for modification C:\Windows\o4316027.exe services.exe File created C:\Windows\Ad10218\qm4623.exe winlogon.exe File opened for modification C:\Windows\o4316027.exe lsass.exe File opened for modification C:\Windows\j6316022.exe m4623.exe File opened for modification C:\Windows\_default31602.pif m4623.exe File created C:\Windows\_default31602.pif 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe File opened for modification C:\Windows\_default31602.pif services.exe File opened for modification C:\Windows\o4316027.exe qm4623.exe File opened for modification C:\Windows\_default31602.pif qm4623.exe File opened for modification C:\Windows\j6316022.exe 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe File created C:\Windows\o4316027.exe 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe File opened for modification C:\Windows\o4316027.exe smss.exe File opened for modification C:\Windows\j6316022.exe winlogon.exe File opened for modification C:\Windows\Ad10218 winlogon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Discovers systems in the same network 1 TTPs 1 IoCs
pid Process 1432 net.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe 1884 winlogon.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1492 wrote to memory of 3528 1492 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe 87 PID 1492 wrote to memory of 3528 1492 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe 87 PID 1492 wrote to memory of 3528 1492 0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe 87 PID 3528 wrote to memory of 1884 3528 smss.exe 91 PID 3528 wrote to memory of 1884 3528 smss.exe 91 PID 3528 wrote to memory of 1884 3528 smss.exe 91 PID 1884 wrote to memory of 548 1884 winlogon.exe 95 PID 1884 wrote to memory of 548 1884 winlogon.exe 95 PID 1884 wrote to memory of 548 1884 winlogon.exe 95 PID 1884 wrote to memory of 3016 1884 winlogon.exe 97 PID 1884 wrote to memory of 3016 1884 winlogon.exe 97 PID 1884 wrote to memory of 3016 1884 winlogon.exe 97 PID 1884 wrote to memory of 4592 1884 winlogon.exe 99 PID 1884 wrote to memory of 4592 1884 winlogon.exe 99 PID 1884 wrote to memory of 4592 1884 winlogon.exe 99 PID 1884 wrote to memory of 4604 1884 winlogon.exe 101 PID 1884 wrote to memory of 4604 1884 winlogon.exe 101 PID 1884 wrote to memory of 4604 1884 winlogon.exe 101 PID 1884 wrote to memory of 1336 1884 winlogon.exe 103 PID 1884 wrote to memory of 1336 1884 winlogon.exe 103 PID 1884 wrote to memory of 1336 1884 winlogon.exe 103 PID 1884 wrote to memory of 3636 1884 winlogon.exe 105 PID 1884 wrote to memory of 3636 1884 winlogon.exe 105 PID 1884 wrote to memory of 3636 1884 winlogon.exe 105 PID 1884 wrote to memory of 1116 1884 winlogon.exe 108 PID 1884 wrote to memory of 1116 1884 winlogon.exe 108 PID 1884 wrote to memory of 1116 1884 winlogon.exe 108 PID 1884 wrote to memory of 752 1884 winlogon.exe 110 PID 1884 wrote to memory of 752 1884 winlogon.exe 110 PID 1884 wrote to memory of 752 1884 winlogon.exe 110 PID 4592 wrote to memory of 2632 4592 lsass.exe 117 PID 4592 wrote to memory of 2632 4592 lsass.exe 117 PID 4592 wrote to memory of 2632 4592 lsass.exe 117 PID 2632 wrote to memory of 1432 2632 cmd.exe 119 PID 2632 wrote to memory of 1432 2632 cmd.exe 119 PID 2632 wrote to memory of 1432 2632 cmd.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0b2d88e02b879c09b5a615cf670e592a_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\s4827\smss.exe"C:\Windows\system32\s4827\smss.exe" ~Brontok~Log~2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\s4827\winlogon.exe"C:\Windows\system32\s4827\winlogon.exe" ~Brontok~Is~The~Best~3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\s4827\services.exe"C:\Windows\system32\s4827\services.exe" ~Brontok~Serv~4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:548
-
-
C:\Windows\SysWOW64\s4827\csrss.exe"C:\Windows\system32\s4827\csrss.exe" ~Brontok~SpreadMail~4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:3016
-
-
C:\Windows\SysWOW64\s4827\lsass.exe"C:\Windows\system32\s4827\lsass.exe" ~Brontok~Network~4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c net view /domain > "C:\Windows\system32\s4827\domlist.txt"5⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\net.exenet view /domain6⤵
- Discovers systems in the same network
PID:1432
-
-
-
-
C:\Windows\Ad10218\qm4623.exe"C:\Windows\Ad10218\qm4623.exe" ~Brontok~Back~Log~4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:4604
-
-
C:\Windows\SysWOW64\s4827\m4623.exe"C:\Windows\system32\s4827\m4623.exe" ~Brontok~Back~Log~4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:1336
-
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe" /delete /y4⤵PID:3636
-
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe" 17:08 /every:M,T,W,Th,F,S,Su "C:\Users\Admin\AppData\Local\jalak-93927015-bali.com"4⤵PID:1116
-
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe" 11:03 /every:M,T,W,Th,F,S,Su "C:\Users\Admin\AppData\Local\jalak-93927015-bali.com"4⤵PID:752
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5b8ad1afd339f63ded784b3a4633c5ea6
SHA1408b7d255b05b21f18e5ba0033877ac3ae399d13
SHA256534caeaccf2949a0c1cc5b787ae59b0ed7b3e564676a77f4400deca688d2f03c
SHA5126565e02cf2d8f4fda0f634acdb43d1465bbcb5924af18eb7124f57921a2065dc9f04b5be12446bbed03cab0960a57341c70bea184d7180c597ef27751634d5f1
-
Filesize
42KB
MD50b2d88e02b879c09b5a615cf670e592a
SHA1156dea84ee8b56c8e45459358d54f41be0876fb8
SHA256db94bfc9678d07f1c93a7880fdbdda84aa61193500fc0824803d583b637bef2d
SHA51289035bffb6c7a7971ea231f36b9f0fdae644c52e822a3288cb42d47332e25e55fe88cf576064875aa8f3b701862b21d09b2f251260bc6021df1712c126906f71
-
Filesize
42KB
MD59d0fdab2cf04b4546ce975a03ddb2eaf
SHA1c0cb61e8d947f031226b98a015a509c65516b7f2
SHA256d842bd8dc8a70ce6498709d76e1d7504e54dd4b7715262de2c1b44c4f4d4c163
SHA51204f995169647416fbb6525e0ee2a51fb8bbf0b74d801f5020165fdaf797b61edcd0fdb028f558cf39ffad738d45093cf10738403ac69c9388ba52d5cccd1e5a0
-
Filesize
42KB
MD556b454c52491455920092de36f23c236
SHA17326ab2ece261b2bde81b327963bae4c87b7ec95
SHA256c6dfb2147178384a5ec8f2d5f92c0f1456c73852a3f4db58a750edbf5d79406f
SHA5122e0ef8d3cf02e14c138ae6adebe29ee0d9dd094834a2769947283611574fdba5aae156d0126d5c2da9d582b804c117cbb51cb0b0c2609948e16ac81273470c8b
-
Filesize
42KB
MD580f31d2fe20931aefb069b31be9066ee
SHA1f80fa6da3c85e8a21e6bf6cf5a75b2a79bfb0dea
SHA2562c6ec25499787ec03bd74983e8a5147fa080e6ea068045a7d1a7a7ad58500ccc
SHA512ddb941a96ebb3d6c5abd749eb8276b46e52c82c18326d94b2183d785ad141eaf83b9d508ca9e35d942058d0aa37414398a3580d2bfc5a9ef800af36794261cb9