Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 01:41
Static task
static1
Behavioral task
behavioral1
Sample
24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe
-
Size
844KB
-
MD5
24324b4f141efbcee94b278fef963e5c
-
SHA1
4a2737127a99cc0c87d4f6914198fff6225cf1bf
-
SHA256
80ea7700f0bf3ce805448aa904fe6eedef23fb5c94c963304a22f196ec00462d
-
SHA512
192ce308b122e584359ba8963a45a5503435b09c71224daaa67c2d00a1eb2f8504a5e2c0deec45c3f5160e465e23209a4c25b8d4a8d2eef04a83a5aae195e3bf
-
SSDEEP
24576:fvX0CqJm7lpD2KXQztsFvKlH0jmr5WisTzjle5U5TIDV+DwLQk9Qd:3X05Jm7sAKF0GELm8IDVGqQV
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\252884a2\\X" Explorer.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" srRTMxaDv9.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sakeg.exe -
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/files/0x003700000001489f-28.dat modiloader_stage2 behavioral1/memory/2712-45-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 844 cmd.exe -
Executes dropped EXE 10 IoCs
pid Process 1804 srRTMxaDv9.exe 2352 sakeg.exe 2712 amhost.exe 2560 amhost.exe 2680 bmhost.exe 336 csrss.exe 1996 cmhost.exe 1312 X 1212 Explorer.EXE 2492 dmhost.exe -
Loads dropped DLL 16 IoCs
pid Process 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 1804 srRTMxaDv9.exe 1804 srRTMxaDv9.exe 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 1996 cmhost.exe 1996 cmhost.exe 1996 cmhost.exe 1312 X 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2560-44-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2560-40-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2560-38-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2560-49-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2560-50-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2560-52-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2560-51-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /j" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /e" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /M" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /T" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /z" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /n" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /w" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /A" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /g" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /d" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /R" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /E" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /F" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /b" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /L" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /B" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /p" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /a" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /O" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /c" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /m" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /W" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /f" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /H" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /N" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /J" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /S" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /x" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /t" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /u" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /C" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /P" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /r" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /k" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /I" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /U" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /q" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /Z" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /Y" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /l" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /X" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /a" srRTMxaDv9.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /i" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /o" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /s" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /D" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /K" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /h" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /Q" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /v" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /y" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /G" sakeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\sakeg = "C:\\Users\\Admin\\sakeg.exe /V" sakeg.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2712 set thread context of 2560 2712 amhost.exe 35 PID 2680 set thread context of 1592 2680 bmhost.exe 37 PID 1996 set thread context of 2008 1996 cmhost.exe 41 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2780 tasklist.exe 2692 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1804 srRTMxaDv9.exe 1804 srRTMxaDv9.exe 2560 amhost.exe 2680 bmhost.exe 2680 bmhost.exe 2680 bmhost.exe 2680 bmhost.exe 2352 sakeg.exe 2352 sakeg.exe 2352 sakeg.exe 1312 X 2352 sakeg.exe 2560 amhost.exe 2352 sakeg.exe 2352 sakeg.exe 2352 sakeg.exe 2560 amhost.exe 2352 sakeg.exe 2560 amhost.exe 2560 amhost.exe 2352 sakeg.exe 2352 sakeg.exe 2352 sakeg.exe 2560 amhost.exe 2352 sakeg.exe 2560 amhost.exe 2352 sakeg.exe 2560 amhost.exe 2352 sakeg.exe 2352 sakeg.exe 2560 amhost.exe 2352 sakeg.exe 2560 amhost.exe 2560 amhost.exe 2352 sakeg.exe 2560 amhost.exe 2560 amhost.exe 2352 sakeg.exe 2352 sakeg.exe 2560 amhost.exe 2560 amhost.exe 2352 sakeg.exe 2560 amhost.exe 2352 sakeg.exe 2352 sakeg.exe 2560 amhost.exe 2560 amhost.exe 2560 amhost.exe 2352 sakeg.exe 2560 amhost.exe 2352 sakeg.exe 2560 amhost.exe 2352 sakeg.exe 2352 sakeg.exe 2560 amhost.exe 2560 amhost.exe 2560 amhost.exe 2352 sakeg.exe 2560 amhost.exe 2560 amhost.exe 2352 sakeg.exe 2560 amhost.exe 2352 sakeg.exe 2352 sakeg.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2780 tasklist.exe Token: SeDebugPrivilege 2680 bmhost.exe Token: SeDebugPrivilege 2680 bmhost.exe Token: SeDebugPrivilege 2692 tasklist.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 1804 srRTMxaDv9.exe 2352 sakeg.exe 2492 dmhost.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 336 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1500 wrote to memory of 1804 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 28 PID 1500 wrote to memory of 1804 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 28 PID 1500 wrote to memory of 1804 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 28 PID 1500 wrote to memory of 1804 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 28 PID 1804 wrote to memory of 2352 1804 srRTMxaDv9.exe 29 PID 1804 wrote to memory of 2352 1804 srRTMxaDv9.exe 29 PID 1804 wrote to memory of 2352 1804 srRTMxaDv9.exe 29 PID 1804 wrote to memory of 2352 1804 srRTMxaDv9.exe 29 PID 1804 wrote to memory of 2656 1804 srRTMxaDv9.exe 30 PID 1804 wrote to memory of 2656 1804 srRTMxaDv9.exe 30 PID 1804 wrote to memory of 2656 1804 srRTMxaDv9.exe 30 PID 1804 wrote to memory of 2656 1804 srRTMxaDv9.exe 30 PID 2656 wrote to memory of 2780 2656 cmd.exe 32 PID 2656 wrote to memory of 2780 2656 cmd.exe 32 PID 2656 wrote to memory of 2780 2656 cmd.exe 32 PID 2656 wrote to memory of 2780 2656 cmd.exe 32 PID 1500 wrote to memory of 2712 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 34 PID 1500 wrote to memory of 2712 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 34 PID 1500 wrote to memory of 2712 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 34 PID 1500 wrote to memory of 2712 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 34 PID 2712 wrote to memory of 2560 2712 amhost.exe 35 PID 2712 wrote to memory of 2560 2712 amhost.exe 35 PID 2712 wrote to memory of 2560 2712 amhost.exe 35 PID 2712 wrote to memory of 2560 2712 amhost.exe 35 PID 2712 wrote to memory of 2560 2712 amhost.exe 35 PID 2712 wrote to memory of 2560 2712 amhost.exe 35 PID 2712 wrote to memory of 2560 2712 amhost.exe 35 PID 2712 wrote to memory of 2560 2712 amhost.exe 35 PID 1500 wrote to memory of 2680 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 36 PID 1500 wrote to memory of 2680 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 36 PID 1500 wrote to memory of 2680 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 36 PID 1500 wrote to memory of 2680 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 36 PID 2680 wrote to memory of 1212 2680 bmhost.exe 21 PID 2680 wrote to memory of 336 2680 bmhost.exe 2 PID 2680 wrote to memory of 1592 2680 bmhost.exe 37 PID 2680 wrote to memory of 1592 2680 bmhost.exe 37 PID 2680 wrote to memory of 1592 2680 bmhost.exe 37 PID 2680 wrote to memory of 1592 2680 bmhost.exe 37 PID 2680 wrote to memory of 1592 2680 bmhost.exe 37 PID 1500 wrote to memory of 1996 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 39 PID 1500 wrote to memory of 1996 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 39 PID 1500 wrote to memory of 1996 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 39 PID 1500 wrote to memory of 1996 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 39 PID 1996 wrote to memory of 1312 1996 cmhost.exe 40 PID 1996 wrote to memory of 1312 1996 cmhost.exe 40 PID 1996 wrote to memory of 1312 1996 cmhost.exe 40 PID 1996 wrote to memory of 1312 1996 cmhost.exe 40 PID 1312 wrote to memory of 1212 1312 X 21 PID 1996 wrote to memory of 2008 1996 cmhost.exe 41 PID 1996 wrote to memory of 2008 1996 cmhost.exe 41 PID 1996 wrote to memory of 2008 1996 cmhost.exe 41 PID 1996 wrote to memory of 2008 1996 cmhost.exe 41 PID 1996 wrote to memory of 2008 1996 cmhost.exe 41 PID 1500 wrote to memory of 2492 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 43 PID 1500 wrote to memory of 2492 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 43 PID 1500 wrote to memory of 2492 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 43 PID 1500 wrote to memory of 2492 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 43 PID 336 wrote to memory of 2284 336 csrss.exe 44 PID 336 wrote to memory of 2284 336 csrss.exe 44 PID 336 wrote to memory of 1840 336 csrss.exe 45 PID 336 wrote to memory of 1840 336 csrss.exe 45 PID 1500 wrote to memory of 844 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 46 PID 1500 wrote to memory of 844 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 46 PID 1500 wrote to memory of 844 1500 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 46
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:856
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵PID:2284
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\srRTMxaDv9.exeC:\Users\Admin\srRTMxaDv9.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\sakeg.exe"C:\Users\Admin\sakeg.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2352
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del srRTMxaDv9.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2780
-
-
-
-
C:\Users\Admin\amhost.exeC:\Users\Admin\amhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\amhost.exeamhost.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2560
-
-
-
C:\Users\Admin\bmhost.exeC:\Users\Admin\bmhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:1592
-
-
-
C:\Users\Admin\cmhost.exeC:\Users\Admin\cmhost.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\252884a2\X176.53.17.24:804⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1312
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:2008
-
-
-
C:\Users\Admin\dmhost.exeC:\Users\Admin\dmhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2492
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe3⤵
- Deletes itself
PID:844 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
-
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:1840
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5f5e66a93bc297ba83db0e7b5564ced3f
SHA1863c519546cfba7531b8ecbf10ae5bede6d2193d
SHA25694257ae4c040d8487cb44bc23030193944c72c12678dcd8b80684a3721b21231
SHA512b7ee82bdc3057df90eed61a9d0d6d52420fb8baf6cc8f12f30144ecdd1f298f13d89e14bfa474ea939bd734440f185d7bba72d1140080a3ef975253191adaea3
-
Filesize
53KB
MD54d7cde615a0f534bd5e359951829554b
SHA1c885d00d9000f2a5dbc78f6193a052b36f4fe968
SHA256414fdf9bdcae5136c1295d6d24740c50a484acd81f1f7d0fb5d5c138607cb80a
SHA51233d632f9fbb694440a1ca568c90518784278efd1dc9ee2b57028149d56ebe1f7346d5b59dcfafee2eeaa10091dda05f48958e909d6bfc891e037ae1cfbd048d4
-
Filesize
2KB
MD5811296d58d3e66816eaabab62ad21603
SHA1b995c5d560808d98aa88732893f0d3cb5162651d
SHA256bf28975439a51b7587c903bbfeaf5f48536ffe3a5336243af1647f94ba1e50b4
SHA5120d4fdc054abc095fb35bcecf6e300baf665313c9dc7c360808e4ca5450e6d83c21e9e6760a91b5fefb0b2f363204ed6c89ac6bfbf91dc01c45478912a1677ce6
-
Filesize
41KB
MD5be40a2578e862f1cecc9b9194f524201
SHA10c379f375f9bcfab2e8d86161cec07fe4a7dbc12
SHA2562c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6
SHA51225fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8
-
Filesize
80KB
MD58ccbe4f27f9710f3e7f75e1d1de57e49
SHA1272e95e476477cd4a1715ee0bcf32318e0351718
SHA2563d36ee15c25b2308f8552e121d885c26b46b4e7fc6dbb41a684bec53e0ae3b5d
SHA512334f56b5158839f521513aff9de334536c86da633bf1a3b78592529275457973ed67fd55a54bef8f88ce918c2863c365cababfbd0ef888a27272906e281105d0
-
Filesize
258KB
MD52da0070a7c50f3a078b73b4fb7ee7c02
SHA1999b4860a80b908622fadfc8fae27db66b200932
SHA256f8a0f1b5b3f320f01173f151305dc780eac51bf78e7405fd2c0b9b3ba58945bf
SHA5122d488508e785d92c5cf9f0abee8153d984d8dd8f1d59880643764f499e151fccc9572a9ad1fe0a82412b8ed230d25bd849a0beeded12325dc21839ed53512630
-
Filesize
358KB
MD503102e4338eb16e0c4dfe106830557e3
SHA14fdb5baf0900e44e95acdeee1c947be3b0518b39
SHA2567dd28bddc46daddc8f7e14906f50ef991d3d7f1ffb785388fb5c42be9e162139
SHA512c7d4b4b3766c0b4cdc3d16f56effe1b36cacd4a48f728cf1a33360eb6c48362587186dc0be45f098cd3117bc10c7113d51262939bfe018c6f963b36d59cd97c9
-
Filesize
32KB
MD53b906143422ff578e4a9bc688441e89c
SHA14164ef104958d715275a85f62603b5118f8a6ebc
SHA256cb6cc4f0050dc045087df49249e1f2d57a86cc332106a904b7d59dff0819aacf
SHA51206b1d0ae7c60565c982feaa6877f6538040b47d27f2b8ea0178ddab9505b5f91f69ac485adfa043747e7d8c8b9b75748dd11699d38eca76124f77ceda0e9daeb
-
Filesize
344KB
MD5d853b95edccee6c0180bc056c2ef0be0
SHA168fdb4fede4e714151e3ac715a84b80e3176ccd4
SHA2564d14dcba3941e5ec355355b8b58e09e7731b0bb0f05b29a7c3b48748c55be0fc
SHA5129c8afa7dc47092ffef5cd3e043197877992ed68a62969db521d5ba2f7b72b441ccd4ca2504541260e646cd58b57f54c15fb195139dba8ad42782fd140a6eca3b
-
Filesize
344KB
MD557a5743f47b3a874773041195600909c
SHA174f5c16a6ca03baea7c684e40d351f1ec484a70d
SHA256eecfb7541cf571d34882ebeb19c3c396ed53243e23060d45e1f1b033e061da90
SHA51266c4621663db921b7a18b843197ea6611e9473abca6b2a653d1f228146129434a7f643f598e0fdfbe300f2ea91168135de59a69f02f52245c71f12e4364e2954
-
Filesize
4KB
MD5878f9b6da85cb98fcbdf6abd1730a32f
SHA1343007e658ea541f4680b4edf4513e69e1cc18a6
SHA25675b5a460ed6f47fca8ec1bcd8a11b22f24fb33de4d5f307b851ad20c7f831b7d
SHA5125425844e34ad5e717b08830020526f5c9465f654f3e9e29967b2983d5cb8dc225be2b89cd29a8e4cc99fcfc99e05556f66eefa0539283ab4569e603413a37293
-
Filesize
5KB
MD59d7ec1e355ac35cbe6991721ef5ae3b8
SHA1c35a00bd35c6e4a7516b93947be08ead966347e8
SHA25668a3cec42215323100398a8eb2cbb37da7d58fe0fa9c6312e954e0f50a95ca98
SHA512b7c4be28d8e179974672205a50e72fa1ec9e2e8170b3b8ee763e1751a3397c35afec7a72c88f0a79a8566749b2af1ff054660a96c3a6d6508c545d316a035dc0