Analysis Overview
SHA256
936ac6210bbdf887ceb17246e841c8c7e88322ef3359f65c548ec972cf51d92b
Threat Level: Known bad
The file 13e2313c0090887c6e5ca605a4daea44_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
Modifies firewall policy service
Darkcomet
Modifies WinLogon for persistence
Modifies security service
Windows security bypass
Disables RegEdit via registry modification
Disables Task Manager via registry modification
Checks BIOS information in registry
Executes dropped EXE
Windows security modification
Checks computer location settings
Loads dropped DLL
Adds Run key to start application
Drops file in System32 directory
Suspicious use of SetThreadContext
Enumerates physical storage devices
Unsigned PE
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Modifies registry class
Checks processor information in registry
Suspicious behavior: GetForegroundWindowSpam
Enumerates system info in registry
System policy modification
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-26 23:29
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-26 23:29
Reported
2024-06-26 23:32
Platform
win7-20240611-en
Max time kernel
149s
Max time network
121s
Command Line
Signatures
Darkcomet
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
Modifies firewall policy service
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Windupdt\winupdate.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" | C:\Windupdt\winupdate.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" | C:\Windupdt\winupdate.exe | N/A |
Modifies security service
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" | C:\Windupdt\winupdate.exe | N/A |
Windows security bypass
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" | C:\Windupdt\winupdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" | C:\Windupdt\winupdate.exe | N/A |
Disables RegEdit via registry modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | C:\Windupdt\winupdate.exe | N/A |
Disables Task Manager via registry modification
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate | C:\Windupdt\winupdate.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windupdt\winupdate.exe | N/A |
| N/A | N/A | C:\Windupdt\winupdate.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Windupdt\winupdate.exe | N/A |
| N/A | N/A | C:\Windupdt\winupdate.exe | N/A |
| N/A | N/A | C:\Windupdt\winupdate.exe | N/A |
| N/A | N/A | C:\Windupdt\winupdate.exe | N/A |
| N/A | N/A | C:\Windupdt\winupdate.exe | N/A |
| N/A | N/A | C:\Windupdt\winupdate.exe | N/A |
| N/A | N/A | C:\Windupdt\winupdate.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" | C:\Windupdt\winupdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" | C:\Windupdt\winupdate.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\explorer.exe | C:\Windows\SysWOW64\explorer.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2212 set thread context of 2056 | N/A | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe |
| PID 2056 set thread context of 2812 | N/A | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | C:\Windows\SysWOW64\explorer.exe |
| PID 2792 set thread context of 2784 | N/A | C:\Windupdt\winupdate.exe | C:\Windupdt\winupdate.exe |
Enumerates physical storage devices
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier | C:\Windupdt\winupdate.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier | C:\Windupdt\winupdate.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Windupdt\winupdate.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windupdt\winupdate.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier | C:\Windupdt\winupdate.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windupdt\winupdate.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\explorer.exe | N/A |
| N/A | N/A | C:\Windupdt\winupdate.exe | N/A |
| N/A | N/A | C:\Windupdt\winupdate.exe | N/A |
Suspicious use of WriteProcessMemory
System policy modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern | C:\Windupdt\winupdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" | C:\Windupdt\winupdate.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion | C:\Windupdt\winupdate.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe
C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
C:\Windupdt\winupdate.exe
"C:\Windupdt\winupdate.exe"
C:\Windupdt\winupdate.exe
C:\Windupdt\winupdate.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | gamber.zapto.org | udp |
Files
memory/2212-0-0x0000000000400000-0x0000000000408036-memory.dmp
memory/2056-3-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2056-8-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2056-17-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2212-18-0x0000000000230000-0x0000000000239000-memory.dmp
memory/2212-20-0x0000000000400000-0x0000000000408036-memory.dmp
memory/2056-16-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2056-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2056-13-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2056-12-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2056-11-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2056-10-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2056-7-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2056-5-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2056-21-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2056-22-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2056-23-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2812-31-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2812-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2812-27-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2812-33-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2812-36-0x0000000000400000-0x0000000000409000-memory.dmp
\Windupdt\winupdate.exe
| MD5 | 13e2313c0090887c6e5ca605a4daea44 |
| SHA1 | 4504137765992c716ba98ff5ad6e9baf4cf256ae |
| SHA256 | 936ac6210bbdf887ceb17246e841c8c7e88322ef3359f65c548ec972cf51d92b |
| SHA512 | a36d88d83a39566e8c027dec55589373519ae94d264e65c5dc12b4a59593f89a95235788281b7a7f0e1f821f6676132e560a506ca0ad1ef10e80b1099dfa5392 |
memory/2056-40-0x0000000004010000-0x0000000004019000-memory.dmp
memory/2792-44-0x0000000000400000-0x0000000000408036-memory.dmp
memory/2056-43-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2792-53-0x0000000000020000-0x0000000000029000-memory.dmp
memory/2792-52-0x0000000000020000-0x0000000000029000-memory.dmp
memory/2792-51-0x0000000000020000-0x0000000000029000-memory.dmp
memory/2784-83-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2784-84-0x0000000000020000-0x0000000000029000-memory.dmp
memory/2784-78-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2792-77-0x0000000000400000-0x0000000000408036-memory.dmp
memory/2784-73-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2784-85-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2784-87-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2784-88-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2784-86-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2784-89-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2812-90-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2784-91-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2784-92-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2784-93-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2784-94-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2784-95-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2784-96-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2784-97-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2784-98-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/2784-99-0x0000000000400000-0x00000000004B0000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-26 23:29
Reported
2024-06-26 23:32
Platform
win10v2004-20240226-en
Max time kernel
150s
Max time network
152s
Command Line
Signatures
Darkcomet
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
Modifies firewall policy service
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile | C:\Windupdt\winupdate.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" | C:\Windupdt\winupdate.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" | C:\Windupdt\winupdate.exe | N/A |
Modifies security service
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" | C:\Windupdt\winupdate.exe | N/A |
Windows security bypass
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" | C:\Windupdt\winupdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" | C:\Windupdt\winupdate.exe | N/A |
Disables RegEdit via registry modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" | C:\Windupdt\winupdate.exe | N/A |
Disables Task Manager via registry modification
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate | C:\Windupdt\winupdate.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windupdt\winupdate.exe | N/A |
| N/A | N/A | C:\Windupdt\winupdate.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" | C:\Windupdt\winupdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" | C:\Windupdt\winupdate.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3544 set thread context of 4148 | N/A | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe |
| PID 216 set thread context of 6024 | N/A | C:\Windupdt\winupdate.exe | C:\Windupdt\winupdate.exe |
Enumerates physical storage devices
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Windupdt\winupdate.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windupdt\winupdate.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier | C:\Windupdt\winupdate.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier | C:\Windupdt\winupdate.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier | C:\Windupdt\winupdate.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windupdt\winupdate.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Windupdt\winupdate.exe | N/A |
| N/A | N/A | C:\Windupdt\winupdate.exe | N/A |
Suspicious use of WriteProcessMemory
System policy modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion | C:\Windupdt\winupdate.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern | C:\Windupdt\winupdate.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" | C:\Windupdt\winupdate.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\13e2313c0090887c6e5ca605a4daea44_JaffaCakes118.exe
C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
C:\Windupdt\winupdate.exe
"C:\Windupdt\winupdate.exe"
C:\Windupdt\winupdate.exe
C:\Windupdt\winupdate.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| GB | 142.250.187.202:443 | tcp | |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | gamber.zapto.org | udp |
| US | 8.8.8.8:53 | gamber.zapto.org | udp |
| US | 8.8.8.8:53 | gamber.zapto.org | udp |
| US | 8.8.8.8:53 | gamber.zapto.org | udp |
| US | 8.8.8.8:53 | gamber.zapto.org | udp |
| US | 8.8.8.8:53 | gamber.zapto.org | udp |
| US | 8.8.8.8:53 | gamber.zapto.org | udp |
| US | 8.8.8.8:53 | gamber.zapto.org | udp |
| US | 8.8.8.8:53 | gamber.zapto.org | udp |
| US | 8.8.8.8:53 | gamber.zapto.org | udp |
| US | 8.8.8.8:53 | 109.116.69.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | gamber.zapto.org | udp |
Files
memory/3544-0-0x0000000000400000-0x0000000000408036-memory.dmp
memory/3544-1-0x0000000000400000-0x0000000000408036-memory.dmp
memory/3544-4-0x0000000000400000-0x0000000000408036-memory.dmp
memory/4148-5-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4148-6-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/3544-7-0x0000000000400000-0x0000000000408036-memory.dmp
memory/4148-8-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4148-10-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4148-11-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4148-12-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4148-16-0x0000000000400000-0x00000000004B0000-memory.dmp
C:\Windupdt\winupdate.exe
| MD5 | 13e2313c0090887c6e5ca605a4daea44 |
| SHA1 | 4504137765992c716ba98ff5ad6e9baf4cf256ae |
| SHA256 | 936ac6210bbdf887ceb17246e841c8c7e88322ef3359f65c548ec972cf51d92b |
| SHA512 | a36d88d83a39566e8c027dec55589373519ae94d264e65c5dc12b4a59593f89a95235788281b7a7f0e1f821f6676132e560a506ca0ad1ef10e80b1099dfa5392 |
memory/216-80-0x0000000000400000-0x0000000000408036-memory.dmp
memory/216-87-0x0000000000400000-0x0000000000408036-memory.dmp
memory/6024-88-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/6024-89-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/6024-90-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/6024-93-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/6024-92-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/6024-91-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/6024-96-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/6024-97-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/6024-98-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/6024-99-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/6024-100-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/6024-101-0x0000000000400000-0x00000000004B0000-memory.dmp