Overview
overview
8Static
static
31a5709a9fa...18.exe
windows7-x64
81a5709a9fa...18.exe
windows10-2004-x64
8$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3C:/windows/bch.exe
windows7-x64
C:/windows/bch.exe
windows10-2004-x64
$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3C:/windows/cdi.exe
windows7-x64
C:/windows/cdi.exe
windows10-2004-x64
$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3C:/windows/dss.exe
windows7-x64
C:/windows/dss.exe
windows10-2004-x64
$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3C:/windows/hti.exe
windows7-x64
C:/windows/hti.exe
windows10-2004-x64
$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3C:/windows/xtr.exe
windows7-x64
C:/windows/xtr.exe
windows10-2004-x64
$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 13:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
C:/windows/bch.exe
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
C:/windows/bch.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
C:/windows/cdi.exe
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
C:/windows/cdi.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
C:/windows/dss.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
C:/windows/dss.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
C:/windows/hti.exe
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
C:/windows/hti.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral23
Sample
C:/windows/xtr.exe
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
C:/windows/xtr.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe
-
Size
125KB
-
MD5
1a5709a9fa14ec04f92422407f5f246e
-
SHA1
fe7e13edfdd092a11f21489de845eb4f6c1ac0b5
-
SHA256
1c3669d375ddc4dbb85d8c98959ccebc65173009779b19ce8256e6d971baebe7
-
SHA512
5c599af9790d5567576dce554dc77004d7d2ac4297318224e15062745c83382d7d15f3d7c90a7e642cc9f56d8bae1fa497bab91c9af059ba76ad8fb81762867f
-
SSDEEP
3072:AQIURTXJwVp5lL8RDRBXUlSdW9cpK4vwbxrG:Asml45PXUlSdWOpfWxrG
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe -
Loads dropped DLL 6 IoCs
pid Process 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File created C:\windows\cdi.exe 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe File opened for modification C:\windows\cdi.exe 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe File created C:\windows\dss.exe 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe File opened for modification C:\windows\dss.exe 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe File created C:\windows\xtr.exe 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe File opened for modification C:\windows\xtr.exe 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe File created C:\windows\bch.exe 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe File opened for modification C:\windows\bch.exe 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe File created C:\windows\hti.exe 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe File opened for modification C:\windows\hti.exe 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x0007000000014b63-6.dat nsis_installer_1 behavioral1/files/0x0007000000014b63-6.dat nsis_installer_2 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\SystemCertificates\CA\Certificates\33E4E80807204C2B6182A3A14B591ACD25B5F0DB\Blob = 03000000010000001400000033e4e80807204c2b6182a3a14b591acd25b5f0db1400000001000000140000008d8c5ec454ad8ae177e99bf99b05e1b8018d61e1040000000100000010000000adab5c4df031fb9299f71ada7e18f6130f00000001000000300000008b612b2190a95b28b866b9be5d0b95f368c17534ab1da61a42dfb32766f9ae2908fe6bfd1669be140eddaf0d33e95235190000000100000010000000fc741b3b78cfb31e075744fe5d0eeb96180000000100000010000000ea6089055218053dd01e37e1d806eedf4b0000000100000044000000300037004300450046003200460036003500340045003300450044003600300035003000460046004300390042003600450042003800340034003200350030005f00000020000000010000001706000030820613308203fba00302010202107d5b5126b476ba11db74160bbc530da7300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3138313130323030303030305a170d3330313233313233353935395a30818f310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313730350603550403132e5365637469676f2052534120446f6d61696e2056616c69646174696f6e205365637572652053657276657220434130820122300d06092a864886f70d01010105000382010f003082010a0282010100d67333d6d73c20d000d21745b8d63e07a23fc741ee3230c9b06cfdf49fcb12980f2d3f8d4d010c820f177f622ee9b84879fb16834eadd7322593b707bfb9503fa94cc3402ae939ffd981ca1f163241da8026b9237a87201ee3ff209a3c95446f8775069040b4329316091008233ed2dd870f6f5d51146a0a69c54f017269cfd3934c6d04a0a31b827eb19ab9edc59ec537789f9a0834fb562e58c4090e06645bbc37dcf19f2868a856b092a35c9fbb8898081b241dab3085aeafb02e9e7a9dc1c0421ce202f0eae04ad2ef900eb4c14016f06f85424a64f7a430a0febf2ea3275a8e8b58b8adc319178463ed6f56fd83cb6034c474bee69ddbe1e4e5ca0c5f150203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604148d8c5ec454ad8ae177e99bf99b05e1b8018d61e1300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020130500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443412e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c0500038202010032bf61bd0e48c34fc7ba474df89c781901dc131d806ffcc370b4529a31339a5752fb319e6ba4ef54aa898d401768f811107cd2cab1f15586c7eeb3369186f63951bf46bf0fa0bab4f77e49c42a36179ee468397aaf944e566fb27b3bbf0a86bdcdc5771c03b838b1a21f5f7edb8adc4648b6680acfb2b5b4e234e467a93866095ed2b8fc9d283a174027c2724e29fd213c7ccf13fb962cc53144fd13edd59ba96968777ceee1ffa4f93638085339a284349c19f3be0eacd52437eb23a878d0d3e7ef924764623922efc6f711be2285c6664424268e10328dc893ae079e833e2fd9f9f5468e63bec1e6b4dca6cd21a8860a95d92e85261afdfcb1b657426d95d133f6391406824138f58f58dc805ba4d57d9578fda79bfffdc5a869ab26e7a7a405875ba9b7b8a3200b97a94585ddb38be589378e290dfc0617f638400e42e41206fb7bf3c6116862dfe398f413d8154f8bb169d91060bc642aea31b7e4b5a33a149b26e30b7bfd028eb699c138975936f6a874a286b65eebc664eacfa0a3f96e9eba2d11b6869808582dc9ac2564f25e75b438c1ae7f5a4683ea51cab6f19911356ba56a7bc600b0e7f8be64b2adc8c2f1ace351eaa493e079c8e18140c90a5be1123cc1602ae397c08942ca94cf46981269bb98d0c2d30d724b476ee593c43228638743e4b0323e0ad34bbf239b1429412b9a041f932df1c739483cad5a127f 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe Token: SeBackupPrivilege 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 3020 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 28 PID 2156 wrote to memory of 3020 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 28 PID 2156 wrote to memory of 3020 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 28 PID 2156 wrote to memory of 3020 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 28 PID 2156 wrote to memory of 3020 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 28 PID 2156 wrote to memory of 3020 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 28 PID 2156 wrote to memory of 3020 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 28 PID 3020 wrote to memory of 2644 3020 cmd.exe 30 PID 3020 wrote to memory of 2644 3020 cmd.exe 30 PID 3020 wrote to memory of 2644 3020 cmd.exe 30 PID 3020 wrote to memory of 2644 3020 cmd.exe 30 PID 3020 wrote to memory of 2644 3020 cmd.exe 30 PID 3020 wrote to memory of 2644 3020 cmd.exe 30 PID 3020 wrote to memory of 2644 3020 cmd.exe 30 PID 2156 wrote to memory of 2640 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 31 PID 2156 wrote to memory of 2640 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 31 PID 2156 wrote to memory of 2640 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 31 PID 2156 wrote to memory of 2640 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 31 PID 2156 wrote to memory of 2640 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 31 PID 2156 wrote to memory of 2640 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 31 PID 2156 wrote to memory of 2640 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2564 2640 cmd.exe 33 PID 2640 wrote to memory of 2564 2640 cmd.exe 33 PID 2640 wrote to memory of 2564 2640 cmd.exe 33 PID 2640 wrote to memory of 2564 2640 cmd.exe 33 PID 2640 wrote to memory of 2564 2640 cmd.exe 33 PID 2640 wrote to memory of 2564 2640 cmd.exe 33 PID 2640 wrote to memory of 2564 2640 cmd.exe 33 PID 2156 wrote to memory of 3032 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 34 PID 2156 wrote to memory of 3032 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 34 PID 2156 wrote to memory of 3032 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 34 PID 2156 wrote to memory of 3032 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 34 PID 2156 wrote to memory of 3032 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 34 PID 2156 wrote to memory of 3032 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 34 PID 2156 wrote to memory of 3032 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 34 PID 3032 wrote to memory of 2720 3032 cmd.exe 36 PID 3032 wrote to memory of 2720 3032 cmd.exe 36 PID 3032 wrote to memory of 2720 3032 cmd.exe 36 PID 3032 wrote to memory of 2720 3032 cmd.exe 36 PID 3032 wrote to memory of 2720 3032 cmd.exe 36 PID 3032 wrote to memory of 2720 3032 cmd.exe 36 PID 3032 wrote to memory of 2720 3032 cmd.exe 36 PID 2156 wrote to memory of 2244 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 37 PID 2156 wrote to memory of 2244 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 37 PID 2156 wrote to memory of 2244 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 37 PID 2156 wrote to memory of 2244 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 37 PID 2156 wrote to memory of 2244 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 37 PID 2156 wrote to memory of 2244 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 37 PID 2156 wrote to memory of 2244 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 37 PID 2244 wrote to memory of 2552 2244 cmd.exe 39 PID 2244 wrote to memory of 2552 2244 cmd.exe 39 PID 2244 wrote to memory of 2552 2244 cmd.exe 39 PID 2244 wrote to memory of 2552 2244 cmd.exe 39 PID 2244 wrote to memory of 2552 2244 cmd.exe 39 PID 2244 wrote to memory of 2552 2244 cmd.exe 39 PID 2244 wrote to memory of 2552 2244 cmd.exe 39 PID 2156 wrote to memory of 2460 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 40 PID 2156 wrote to memory of 2460 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 40 PID 2156 wrote to memory of 2460 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 40 PID 2156 wrote to memory of 2460 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 40 PID 2156 wrote to memory of 2460 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 40 PID 2156 wrote to memory of 2460 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 40 PID 2156 wrote to memory of 2460 2156 1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe 40 PID 2460 wrote to memory of 2560 2460 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a5709a9fa14ec04f92422407f5f246e_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C at 19:25 /every:M,T,W,Th,F,Sa,Su ""C:\windows\cdi.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\at.exeat 19:25 /every:M,T,W,Th,F,Sa,Su ""C:\windows\cdi.exe""3⤵PID:2644
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C at 19:30 /every:M,T,W,Th,F,Sa,Su ""c:\windows\dss.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\at.exeat 19:30 /every:M,T,W,Th,F,Sa,Su ""c:\windows\dss.exe""3⤵PID:2564
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C at 19:35 /every:M,T,W,Th,F,Sa,Su ""c:\windows\bch.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\at.exeat 19:35 /every:M,T,W,Th,F,Sa,Su ""c:\windows\bch.exe""3⤵PID:2720
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C at 19:40 /every:M,T,W,Th,F,Sa,Su ""c:\windows\hti.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\at.exeat 19:40 /every:M,T,W,Th,F,Sa,Su ""c:\windows\hti.exe""3⤵PID:2552
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C at 19:45 /every:M,T,W,Th,F,Sa,Su ""c:\windows\xtr.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\at.exeat 19:45 /every:M,T,W,Th,F,Sa,Su ""c:\windows\xtr.exe""3⤵PID:2560
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
69KB
MD5b7603c02e4711a0c2ba60165a07913f7
SHA1b604896b3843ae812bac4dd800875d55b710b004
SHA256cc3fb2dc03a5bdc7d5019645c9087f437547b16f877503022c65e5b069ac4276
SHA5124f4127abb5efcad3a26998206bc062a0d9e591d16ae15bb5e6a2123aadc857e007fb237f64e3d4312e474491c20610cb58ec199f84bd0b8ccb0b7025da9d15be
-
Filesize
20KB
MD5f02155fa3e59a8fc48a74a236b2bb42e
SHA16d76ee8f86fb29f3352c9546250d940f1a476fb8
SHA256096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999
SHA5128be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe