Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 00:06
Static task
static1
Behavioral task
behavioral1
Sample
0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe
-
Size
310KB
-
MD5
0b6d1a782246c0afb602c1a6548892ab
-
SHA1
26a13cec3e01beefab1ac83e0fffbbfaccc60616
-
SHA256
0d13b46286128dd6e2dd217bb33c1cc6e48b444d9501e0843443d151bc339c32
-
SHA512
ab9145e10232857577b279ed925034ba417df595267bf4d49a253e63d3f8df2dfdae3a899bc05d887d7c818bd7419d182576d676631d3ed5fba390a05ccfc814
-
SSDEEP
6144:Vw8bgKZh/N1tysPVpfJxYWqMK2A9F3tGR7PapETwwUPd004ppQke:Vw80KZh/N1tygRxYIKP3tG7PHT2K0fv
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1796 vab0726ze.exe -
Loads dropped DLL 3 IoCs
pid Process 2428 cmd.exe 2428 cmd.exe 1796 vab0726ze.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\BTStacAvs = "C:\\Users\\Admin\\BTStacAvs.exe" vab0726ze.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\HkAvgLrj = "C:\\Users\\Admin\\HkAvgLrj.exe" vab0726ze.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\BTStacFrr = "C:\\Users\\Admin\\BTStacFrr.exe" vab0726ze.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\BTStacPgn = "C:\\Users\\Admin\\BTStacPgn.exe" vab0726ze.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MsgrUpd = "C:\\Users\\Admin\\MsgrUpd.exe" vab0726ze.exe -
Document created with cracked Office version 1 IoCs
Office document contains Grizli777 string known to be caused by using a cracked version of the software.
resource yara_rule behavioral1/files/0x0008000000015cc7-35.dat grizli777_cracked_office -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\config\LdrAdc.dll 0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\config\LdrAdc.dll 0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe File created C:\WINDOWS\SysWOW64\config\vab0726ze.exe 0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\config\vazb0620px.bat 0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe File created C:\WINDOWS\SysWOW64\config\__tmp_rar_sfx_access_check_259400428 0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\config\vab0726ze.exe 0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe File created C:\WINDOWS\SysWOW64\config\vab0726ze.pps 0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\config\vab0726ze.pps 0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe File created C:\WINDOWS\SysWOW64\config\vazb0620px.bat 0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\vab0726ze.pps POWERPNT.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command POWERPNT.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit POWERPNT.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell POWERPNT.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote POWERPNT.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND POWERPNT.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit POWERPNT.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" POWERPNT.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" POWERPNT.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND POWERPNT.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" POWERPNT.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor POWERPNT.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version POWERPNT.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic POWERPNT.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word POWERPNT.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" POWERPNT.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel POWERPNT.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" POWERPNT.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" POWERPNT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" POWERPNT.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command POWERPNT.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2740 POWERPNT.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2428 2960 0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe 28 PID 2960 wrote to memory of 2428 2960 0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe 28 PID 2960 wrote to memory of 2428 2960 0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe 28 PID 2960 wrote to memory of 2428 2960 0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe 28 PID 2428 wrote to memory of 1796 2428 cmd.exe 30 PID 2428 wrote to memory of 1796 2428 cmd.exe 30 PID 2428 wrote to memory of 1796 2428 cmd.exe 30 PID 2428 wrote to memory of 1796 2428 cmd.exe 30 PID 2428 wrote to memory of 2740 2428 cmd.exe 31 PID 2428 wrote to memory of 2740 2428 cmd.exe 31 PID 2428 wrote to memory of 2740 2428 cmd.exe 31 PID 2428 wrote to memory of 2740 2428 cmd.exe 31 PID 2428 wrote to memory of 2740 2428 cmd.exe 31 PID 2428 wrote to memory of 2740 2428 cmd.exe 31 PID 2428 wrote to memory of 2740 2428 cmd.exe 31 PID 2428 wrote to memory of 2740 2428 cmd.exe 31 PID 2428 wrote to memory of 2740 2428 cmd.exe 31 PID 2740 wrote to memory of 2764 2740 POWERPNT.EXE 32 PID 2740 wrote to memory of 2764 2740 POWERPNT.EXE 32 PID 2740 wrote to memory of 2764 2740 POWERPNT.EXE 32 PID 2740 wrote to memory of 2764 2740 POWERPNT.EXE 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0b6d1a782246c0afb602c1a6548892ab_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\WINDOWS\system32\config\vazb0620px.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\config\vab0726ze.exevab0726ze.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:1796
-
-
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" /s "C:\Windows\System32\config\vab0726ze.pps"3⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122884⤵PID:2764
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5b8e80e2b539ff450e7f5ba4998bbcfa5
SHA1ba42ff9c3353b0e84ca0dd2c5c34f6969712f358
SHA256526f8ac5139e0ce09a6b098944bb81c15fda3d816c134eabb02f92e3c9d318f0
SHA512f0064716ee1fe78055d895323e71b6ed2bf3e94b177512340513ec003aefa6cb3ea4edec245f36eb575e2f6d8873671ea364b4454aad01a675ff8e1e4823f4c7
-
Filesize
243B
MD5c6a0739c021bb5858ec6c6de1bf4defc
SHA14333ec7cdc0477bc6c0d4d70c6655d933eccec3f
SHA2569a03e38cd7c3930c4f0251e281310c359c0c328ef895c37d8ff935616f5ba94a
SHA51250c21fe8b8197ce38d3f429757153b3d260a8473640330ff7a7b938f9fd180b7c659a3d77af31a99138b258171f66bda8a6350dfc6983f29cb7e70e09105f2c1
-
Filesize
88KB
MD5c7cdd580237ffac1704ffc1c93a9a328
SHA1a69ad77cf351be1cb53e6a3ca990a37b03297a1d
SHA256d3e7ce933dc7ece16066033b740eb0ef7c9a0d45d496babd42e8b8b163f87bc4
SHA5124ee4ec1828ebf99134c6f4a539b9a448566a333c1ef8baf45095f43ba90551105e2fd0ebc529094034644816baf0c4892dddd634ca40397367d1bde64f2d0fc3
-
Filesize
375KB
MD5249c96ac98d01d6d33fe63045c244a6d
SHA1caf03883a3dd584116bf4b5797c6a96bbdb06587
SHA2565f0c62ab8647416443254a9f29dddbee33934a7082ef189d988ad78dcd1c3c68
SHA512212fb0f9294483c62a0334d1ce142f82629d2a3ed315fe6e31c913777b5f1a176ed93d3419a8446a7ffbd2b3198d222cdb0e98330274a05408c82a6db25eccbf