Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 00:20
Static task
static1
Behavioral task
behavioral1
Sample
1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe
-
Size
496KB
-
MD5
1402edfdcc8d1c5f9ec36eba012a8d37
-
SHA1
cfbe8acbaec2676015c7105032d1da134f31c1ab
-
SHA256
96c5aeea64be8ac8173f07a0f8c7d252a83eb2fad215160f36078829856c0def
-
SHA512
a9baa0af65f8c3893673becc7235a3641ba4db0ac850a120431d85c38768dd10ceeb2becc7b9983088b5c65fa644f9b2b1f72b03ab4893518b1e23263d0856d9
-
SSDEEP
6144:aKEGlVcJboOtGY8q75yKC2qJDrNRlpwPBYgZ9fVU93eJwN6QFbSpO4XcA2n4aA8:aKr3QboC9qLGKgZKe4HYpHvcbT
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" mzxxdccswjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" mzxxdccswjh.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" jrzznr.exe -
Adds policy Run key to start application 2 TTPs 27 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run mzxxdccswjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yfmly = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrmzaredpkavbjxemka.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yfmly = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvshkdsthewtblbkuumjg.exe" mzxxdccswjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yfmly = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrmzaredpkavbjxemka.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yfmly = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfbprjxxkgxtajygpofb.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yfmly = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfbprjxxkgxtajygpofb.exe" mzxxdccswjh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yfmly = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvozynyvfymfjpbgm.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lvfhxdft = "jfbprjxxkgxtajygpofb.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lvfhxdft = "lfzllbnlwqfzelyeli.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lvfhxdft = "wrmzaredpkavbjxemka.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yfmly = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvozynyvfymfjpbgm.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lvfhxdft = "yvshkdsthewtblbkuumjg.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lvfhxdft = "vnfpnblhqivnqvgk.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lvfhxdft = "yvshkdsthewtblbkuumjg.exe" mzxxdccswjh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yfmly = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfzllbnlwqfzelyeli.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yfmly = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vnfpnblhqivnqvgk.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lvfhxdft = "vnfpnblhqivnqvgk.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lvfhxdft = "lfzllbnlwqfzelyeli.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yfmly = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvshkdsthewtblbkuumjg.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lvfhxdft = "cvozynyvfymfjpbgm.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yfmly = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vnfpnblhqivnqvgk.exe" jrzznr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run mzxxdccswjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yfmly = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfzllbnlwqfzelyeli.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lvfhxdft = "cvozynyvfymfjpbgm.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lvfhxdft = "wrmzaredpkavbjxemka.exe" mzxxdccswjh.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jrzznr.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mzxxdccswjh.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jrzznr.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation mzxxdccswjh.exe -
Executes dropped EXE 4 IoCs
pid Process 644 mzxxdccswjh.exe 2704 jrzznr.exe 2080 jrzznr.exe 416 mzxxdccswjh.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc jrzznr.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager jrzznr.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys jrzznr.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc jrzznr.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power jrzznr.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys jrzznr.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jrzznr = "jfbprjxxkgxtajygpofb.exe" jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrzznr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfbprjxxkgxtajygpofb.exe" jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vhtxpxbrug = "lfzllbnlwqfzelyeli.exe ." jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wfopejk = "wrmzaredpkavbjxemka.exe ." mzxxdccswjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nbpvpzfxcqzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrmzaredpkavbjxemka.exe" mzxxdccswjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdqvoxctxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vnfpnblhqivnqvgk.exe ." mzxxdccswjh.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wfopejk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfbprjxxkgxtajygpofb.exe ." jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nbpvpzfxcqzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfzllbnlwqfzelyeli.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nbpvpzfxcqzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrmzaredpkavbjxemka.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wfopejk = "lfzllbnlwqfzelyeli.exe ." mzxxdccswjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wfopejk = "cvozynyvfymfjpbgm.exe ." jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nbpvpzfxcqzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfbprjxxkgxtajygpofb.exe" jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrzznr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vnfpnblhqivnqvgk.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wfopejk = "vnfpnblhqivnqvgk.exe ." jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdqvoxctxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrmzaredpkavbjxemka.exe ." jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdqvoxctxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfbprjxxkgxtajygpofb.exe ." jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdqvoxctxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrmzaredpkavbjxemka.exe ." jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cnybszcrt = "jfbprjxxkgxtajygpofb.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wfopejk = "yvshkdsthewtblbkuumjg.exe ." jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cnybszcrt = "lfzllbnlwqfzelyeli.exe" jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vhtxpxbrug = "wrmzaredpkavbjxemka.exe ." jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nbpvpzfxcqzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvshkdsthewtblbkuumjg.exe" jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cnybszcrt = "lfzllbnlwqfzelyeli.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nbpvpzfxcqzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvshkdsthewtblbkuumjg.exe" jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrzznr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrmzaredpkavbjxemka.exe" mzxxdccswjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jrzznr = "lfzllbnlwqfzelyeli.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nbpvpzfxcqzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfbprjxxkgxtajygpofb.exe" jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrzznr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvozynyvfymfjpbgm.exe" jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrzznr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvshkdsthewtblbkuumjg.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jrzznr = "lfzllbnlwqfzelyeli.exe" mzxxdccswjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jrzznr = "cvozynyvfymfjpbgm.exe" mzxxdccswjh.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wfopejk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfzllbnlwqfzelyeli.exe ." jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdqvoxctxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vnfpnblhqivnqvgk.exe ." jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wfopejk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfzllbnlwqfzelyeli.exe ." jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdqvoxctxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vnfpnblhqivnqvgk.exe ." mzxxdccswjh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdqvoxctxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvshkdsthewtblbkuumjg.exe ." jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wfopejk = "wrmzaredpkavbjxemka.exe ." jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wfopejk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vnfpnblhqivnqvgk.exe ." jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdqvoxctxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfbprjxxkgxtajygpofb.exe ." jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vhtxpxbrug = "lfzllbnlwqfzelyeli.exe ." jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdqvoxctxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvozynyvfymfjpbgm.exe ." jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jrzznr = "vnfpnblhqivnqvgk.exe" jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cnybszcrt = "cvozynyvfymfjpbgm.exe" jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrzznr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfzllbnlwqfzelyeli.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nbpvpzfxcqzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vnfpnblhqivnqvgk.exe" jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wfopejk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrmzaredpkavbjxemka.exe ." jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cnybszcrt = "vnfpnblhqivnqvgk.exe" jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrzznr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvozynyvfymfjpbgm.exe" jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wfopejk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvozynyvfymfjpbgm.exe ." jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jrzznr = "yvshkdsthewtblbkuumjg.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wfopejk = "jfbprjxxkgxtajygpofb.exe ." jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nbpvpzfxcqzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvozynyvfymfjpbgm.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wfopejk = "vnfpnblhqivnqvgk.exe ." jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cnybszcrt = "yvshkdsthewtblbkuumjg.exe" jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wfopejk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvozynyvfymfjpbgm.exe ." jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrzznr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrmzaredpkavbjxemka.exe" jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrzznr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrmzaredpkavbjxemka.exe" mzxxdccswjh.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vhtxpxbrug = "jfbprjxxkgxtajygpofb.exe ." jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nbpvpzfxcqzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vnfpnblhqivnqvgk.exe" jrzznr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jrzznr = "vnfpnblhqivnqvgk.exe" jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vhtxpxbrug = "cvozynyvfymfjpbgm.exe ." jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jrzznr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfzllbnlwqfzelyeli.exe" jrzznr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wfopejk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfzllbnlwqfzelyeli.exe ." mzxxdccswjh.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vhtxpxbrug = "vnfpnblhqivnqvgk.exe ." mzxxdccswjh.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mzxxdccswjh.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jrzznr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jrzznr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mzxxdccswjh.exe -
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 25 www.showmyipaddress.com 28 www.whatismyip.ca 37 whatismyip.everdot.org 40 whatismyip.everdot.org 41 www.whatismyip.ca 42 whatismyipaddress.com 50 whatismyip.everdot.org -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf jrzznr.exe File opened for modification F:\autorun.inf jrzznr.exe File created F:\autorun.inf jrzznr.exe File opened for modification C:\autorun.inf jrzznr.exe -
Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\cvozynyvfymfjpbgm.exe mzxxdccswjh.exe File opened for modification C:\Windows\SysWOW64\wrmzaredpkavbjxemka.exe mzxxdccswjh.exe File opened for modification C:\Windows\SysWOW64\vnfpnblhqivnqvgk.exe jrzznr.exe File opened for modification C:\Windows\SysWOW64\pnlbfzprgexvepgqbcvtrh.exe jrzznr.exe File opened for modification C:\Windows\SysWOW64\jfbprjxxkgxtajygpofb.exe jrzznr.exe File opened for modification C:\Windows\SysWOW64\pnlbfzprgexvepgqbcvtrh.exe jrzznr.exe File opened for modification C:\Windows\SysWOW64\qdqvoxctxksfddjiiygtglensjnaivttz.yow jrzznr.exe File opened for modification C:\Windows\SysWOW64\vnfpnblhqivnqvgk.exe mzxxdccswjh.exe File opened for modification C:\Windows\SysWOW64\pnlbfzprgexvepgqbcvtrh.exe mzxxdccswjh.exe File opened for modification C:\Windows\SysWOW64\jfbprjxxkgxtajygpofb.exe mzxxdccswjh.exe File opened for modification C:\Windows\SysWOW64\jfbprjxxkgxtajygpofb.exe jrzznr.exe File created C:\Windows\SysWOW64\qdqvoxctxksfddjiiygtglensjnaivttz.yow jrzznr.exe File opened for modification C:\Windows\SysWOW64\lfzllbnlwqfzelyeli.exe mzxxdccswjh.exe File opened for modification C:\Windows\SysWOW64\wrmzaredpkavbjxemka.exe jrzznr.exe File opened for modification C:\Windows\SysWOW64\yvshkdsthewtblbkuumjg.exe mzxxdccswjh.exe File opened for modification C:\Windows\SysWOW64\vnfpnblhqivnqvgk.exe mzxxdccswjh.exe File opened for modification C:\Windows\SysWOW64\yvshkdsthewtblbkuumjg.exe jrzznr.exe File opened for modification C:\Windows\SysWOW64\jfbprjxxkgxtajygpofb.exe mzxxdccswjh.exe File opened for modification C:\Windows\SysWOW64\vnfpnblhqivnqvgk.exe jrzznr.exe File opened for modification C:\Windows\SysWOW64\lfzllbnlwqfzelyeli.exe jrzznr.exe File opened for modification C:\Windows\SysWOW64\cvozynyvfymfjpbgm.exe jrzznr.exe File opened for modification C:\Windows\SysWOW64\lfzllbnlwqfzelyeli.exe jrzznr.exe File opened for modification C:\Windows\SysWOW64\wrmzaredpkavbjxemka.exe jrzznr.exe File opened for modification C:\Windows\SysWOW64\yvshkdsthewtblbkuumjg.exe mzxxdccswjh.exe File opened for modification C:\Windows\SysWOW64\zbdxfdxdwyvxkzuixczbdx.dxd jrzznr.exe File opened for modification C:\Windows\SysWOW64\lfzllbnlwqfzelyeli.exe mzxxdccswjh.exe File opened for modification C:\Windows\SysWOW64\cvozynyvfymfjpbgm.exe jrzznr.exe File created C:\Windows\SysWOW64\zbdxfdxdwyvxkzuixczbdx.dxd jrzznr.exe File opened for modification C:\Windows\SysWOW64\wrmzaredpkavbjxemka.exe mzxxdccswjh.exe File opened for modification C:\Windows\SysWOW64\cvozynyvfymfjpbgm.exe mzxxdccswjh.exe File opened for modification C:\Windows\SysWOW64\pnlbfzprgexvepgqbcvtrh.exe mzxxdccswjh.exe File opened for modification C:\Windows\SysWOW64\yvshkdsthewtblbkuumjg.exe jrzznr.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\zbdxfdxdwyvxkzuixczbdx.dxd jrzznr.exe File opened for modification C:\Program Files (x86)\qdqvoxctxksfddjiiygtglensjnaivttz.yow jrzznr.exe File created C:\Program Files (x86)\qdqvoxctxksfddjiiygtglensjnaivttz.yow jrzznr.exe File opened for modification C:\Program Files (x86)\zbdxfdxdwyvxkzuixczbdx.dxd jrzznr.exe -
Drops file in Windows directory 32 IoCs
description ioc Process File opened for modification C:\Windows\lfzllbnlwqfzelyeli.exe jrzznr.exe File opened for modification C:\Windows\pnlbfzprgexvepgqbcvtrh.exe jrzznr.exe File opened for modification C:\Windows\lfzllbnlwqfzelyeli.exe jrzznr.exe File opened for modification C:\Windows\vnfpnblhqivnqvgk.exe mzxxdccswjh.exe File opened for modification C:\Windows\yvshkdsthewtblbkuumjg.exe mzxxdccswjh.exe File opened for modification C:\Windows\lfzllbnlwqfzelyeli.exe mzxxdccswjh.exe File opened for modification C:\Windows\cvozynyvfymfjpbgm.exe mzxxdccswjh.exe File opened for modification C:\Windows\pnlbfzprgexvepgqbcvtrh.exe mzxxdccswjh.exe File opened for modification C:\Windows\cvozynyvfymfjpbgm.exe jrzznr.exe File opened for modification C:\Windows\jfbprjxxkgxtajygpofb.exe jrzznr.exe File opened for modification C:\Windows\wrmzaredpkavbjxemka.exe mzxxdccswjh.exe File opened for modification C:\Windows\vnfpnblhqivnqvgk.exe mzxxdccswjh.exe File opened for modification C:\Windows\wrmzaredpkavbjxemka.exe jrzznr.exe File opened for modification C:\Windows\yvshkdsthewtblbkuumjg.exe jrzznr.exe File opened for modification C:\Windows\pnlbfzprgexvepgqbcvtrh.exe jrzznr.exe File opened for modification C:\Windows\cvozynyvfymfjpbgm.exe mzxxdccswjh.exe File opened for modification C:\Windows\vnfpnblhqivnqvgk.exe jrzznr.exe File created C:\Windows\zbdxfdxdwyvxkzuixczbdx.dxd jrzznr.exe File opened for modification C:\Windows\qdqvoxctxksfddjiiygtglensjnaivttz.yow jrzznr.exe File opened for modification C:\Windows\vnfpnblhqivnqvgk.exe jrzznr.exe File opened for modification C:\Windows\lfzllbnlwqfzelyeli.exe mzxxdccswjh.exe File opened for modification C:\Windows\yvshkdsthewtblbkuumjg.exe mzxxdccswjh.exe File opened for modification C:\Windows\jfbprjxxkgxtajygpofb.exe mzxxdccswjh.exe File opened for modification C:\Windows\pnlbfzprgexvepgqbcvtrh.exe mzxxdccswjh.exe File opened for modification C:\Windows\zbdxfdxdwyvxkzuixczbdx.dxd jrzznr.exe File opened for modification C:\Windows\yvshkdsthewtblbkuumjg.exe jrzznr.exe File opened for modification C:\Windows\jfbprjxxkgxtajygpofb.exe mzxxdccswjh.exe File opened for modification C:\Windows\cvozynyvfymfjpbgm.exe jrzznr.exe File opened for modification C:\Windows\wrmzaredpkavbjxemka.exe jrzznr.exe File opened for modification C:\Windows\jfbprjxxkgxtajygpofb.exe jrzznr.exe File created C:\Windows\qdqvoxctxksfddjiiygtglensjnaivttz.yow jrzznr.exe File opened for modification C:\Windows\wrmzaredpkavbjxemka.exe mzxxdccswjh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2704 jrzznr.exe 2704 jrzznr.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2704 jrzznr.exe 2704 jrzznr.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2704 jrzznr.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2368 wrote to memory of 644 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 86 PID 2368 wrote to memory of 644 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 86 PID 2368 wrote to memory of 644 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 86 PID 644 wrote to memory of 2704 644 mzxxdccswjh.exe 92 PID 644 wrote to memory of 2704 644 mzxxdccswjh.exe 92 PID 644 wrote to memory of 2704 644 mzxxdccswjh.exe 92 PID 644 wrote to memory of 2080 644 mzxxdccswjh.exe 93 PID 644 wrote to memory of 2080 644 mzxxdccswjh.exe 93 PID 644 wrote to memory of 2080 644 mzxxdccswjh.exe 93 PID 2368 wrote to memory of 416 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 109 PID 2368 wrote to memory of 416 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 109 PID 2368 wrote to memory of 416 2368 1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe 109 -
System policy modification 1 TTPs 41 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" jrzznr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer jrzznr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mzxxdccswjh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" mzxxdccswjh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" jrzznr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" jrzznr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" jrzznr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System mzxxdccswjh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer mzxxdccswjh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" mzxxdccswjh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1402edfdcc8d1c5f9ec36eba012a8d37_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\mzxxdccswjh.exe"C:\Users\Admin\AppData\Local\Temp\mzxxdccswjh.exe" "c:\users\admin\appdata\local\temp\1402edfdcc8d1c5f9ec36eba012a8d37_jaffacakes118.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:644 -
C:\Users\Admin\AppData\Local\Temp\jrzznr.exe"C:\Users\Admin\AppData\Local\Temp\jrzznr.exe" "-C:\Users\Admin\AppData\Local\Temp\vnfpnblhqivnqvgk.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2704
-
-
C:\Users\Admin\AppData\Local\Temp\jrzznr.exe"C:\Users\Admin\AppData\Local\Temp\jrzznr.exe" "-C:\Users\Admin\AppData\Local\Temp\vnfpnblhqivnqvgk.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2080
-
-
-
C:\Users\Admin\AppData\Local\Temp\mzxxdccswjh.exe"C:\Users\Admin\AppData\Local\Temp\mzxxdccswjh.exe" "c:\users\admin\appdata\local\temp\1402edfdcc8d1c5f9ec36eba012a8d37_jaffacakes118.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:416
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD564814025f1cdb96524d5d0dfa9db0955
SHA1904de8cc347d83f922ee8c74ef2744a0cd6d11ce
SHA256c3f87754f6c9c0f1bd902e2cd9e948a17a37661162cc624ae58399e6aaec29b2
SHA51274441208e71375849a268382cf76e176fa881378276ba8d33a364ad9b3409fd215e2ce453e29814d4f6954a4993ef4d82f2ec2b8629a8898543bf406c006bee6
-
Filesize
280B
MD5799bcd86da8921e7bf5b88bc67f60198
SHA100c46280c1952bdc1da57932b366e993b7aed0ce
SHA2564b089cddd5e042e726c589b83eeb8f185bcffc1a6782500161b5a76882d9849d
SHA51237d565b69dc38fe8df5f8ce6e7c176925b5c2799e3045c7d1f27b93507abf1f6784b81ef013e70afb3cd3f12c198edb5fcb8b1234013bc5c6ef21802199ee9db
-
Filesize
280B
MD58a25d67b1dc82cb6563a6eb2beeaafcc
SHA1c31c5dfa1f21f23a877464a2bd96a2031ba95c25
SHA25650ca49b6491e1f27e0e430ca3529b8fcc0c3fd69890daf618b2969bb4ca95037
SHA512bf379bc858d9a73689449146ff8efc8632760dc84cb681c781837f667908e3984880cac0c976eb0a1d2e43327b8078d49c2f13164628ecb95933e9739d4362f6
-
Filesize
280B
MD5cde79bdda4555b800aa4d1cc00e5c415
SHA19fa0b04dbb61cae742de7791bc7666da4d516126
SHA256ca5450ae48b78e9eb9ce225103d5c0ebc53693220364968858d28f79fc79a427
SHA512e96b02169be8160399dafd9e53329df61bb0d500d1fc44892bf92ee773a111425532b1d89ef79097f4988f60d540f73133b45775478e230cbc4f263ed5898b94
-
Filesize
280B
MD5291960a9af7c524780bef3576fd7d53c
SHA1ad66e4b8375cd70c4534b7a776bc017fa74eb1f3
SHA256a43d64f9a41db0a13dc4f3311ee0999b9a4b1f712d99521a72680b0519b26eeb
SHA5124547fc5293c49b403b5e92518ee4086ab9886d8e75098b21d9eb103a7e52a4369a6fdfb6c323b1d1468bfef6fe03ca3de3dd21b136c0b769083b128f594234fb
-
Filesize
280B
MD5d6b2158244c6cd8d9d2e76f886cf0c45
SHA1f17f62372560bffe2a843210f80907c211933e13
SHA25689534a66ebb144f14dc4474fb6192f4004b0836949704d72ea43d41ad1a1ca15
SHA512590371aabb237f7af43253cbf4cb8d10b07677854f2c796c0c1b056a85f5353215ecac75f406577d9ce3ce0c4d4e1e95dcfb928594136be6ddb55bd9dc59ca22
-
Filesize
280B
MD54a5bd3643ab425590d08fae093ce9691
SHA11945915eae5b4873a970dd048018ee84a6f05108
SHA256d6bf3b96bf1743894436955d575f67f161b02c875520328d090b01d42af18819
SHA512d34de0c0b5879795842ad176e401c5206af9254cb49dcd387a6a58eedce584f2d8e25338e4ed47cb2cbec7cb69235b051f3cc10f0eae06241e13a115915bb69a
-
Filesize
728KB
MD5812a7f266902a0708d3a45f13d56295e
SHA124807ab9314718a1635f94ea37113ef3b6f0348d
SHA256ed693666e371f7704f2d5541c7aeed7fc0b3043608cbac43b7d25ba8f36b2a8b
SHA5129a8edd0565ab91684188133711556e5407f4cf429b19fd823a0e9795873dfc2689649642e2bb3a08150864274177edc73ad9e16fc3190eaeb51f830c46929a2b
-
Filesize
320KB
MD556be524c2d0d736eee7f97eaeac18b8e
SHA1e2376a438df7ac4229e56716b9ec1207bc0abcea
SHA25672b7cd8421c04d1d3b4f46011115cdbba630c2a656baba229ce51c0891d061f7
SHA5129d9ca2415281c5caf8ea596558d430b6405e1e3d8b5e557a211c09dab9eb428fe7ad08d084941d04bfb7705c7efac396335aac57dfc41fae5947f85cf56ba5f5
-
Filesize
4KB
MD57e3903c9f0a3e42bef254721daf74ff8
SHA1229b5e479dcc9c564d5f531a0bbb899f1124336f
SHA25663ef88e924f22a3ce1bebbf668db697ebd126fa9596b2df24232615fcfc1dcb7
SHA5122eab31e30f338cc848a577a3a70fb7ac53a3177feaa27240cdf6980a308a348f9d53a8346e20368edd4c8630bb221821a428fafc35e19713347f0a65d7f42df1
-
Filesize
280B
MD55c414493f2339a3e7c45dad02151c453
SHA17a8e868c2c51668306e9bfa3010b645148160a86
SHA25658356979579d1b9a838e34cac313919cd5efe6e4b44e37e6843379435d453e31
SHA5128210f5a8ca09b987c1ef7ce18477dff90ed7a10790c352711b4625f8733694cef306ce6ad962772ebd43ccb43e1d0fd980914da8f816688267f518c5b9f73dec
-
Filesize
496KB
MD51402edfdcc8d1c5f9ec36eba012a8d37
SHA1cfbe8acbaec2676015c7105032d1da134f31c1ab
SHA25696c5aeea64be8ac8173f07a0f8c7d252a83eb2fad215160f36078829856c0def
SHA512a9baa0af65f8c3893673becc7235a3641ba4db0ac850a120431d85c38768dd10ceeb2becc7b9983088b5c65fa644f9b2b1f72b03ab4893518b1e23263d0856d9