Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 01:41
Static task
static1
Behavioral task
behavioral1
Sample
24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe
-
Size
844KB
-
MD5
24324b4f141efbcee94b278fef963e5c
-
SHA1
4a2737127a99cc0c87d4f6914198fff6225cf1bf
-
SHA256
80ea7700f0bf3ce805448aa904fe6eedef23fb5c94c963304a22f196ec00462d
-
SHA512
192ce308b122e584359ba8963a45a5503435b09c71224daaa67c2d00a1eb2f8504a5e2c0deec45c3f5160e465e23209a4c25b8d4a8d2eef04a83a5aae195e3bf
-
SSDEEP
24576:fvX0CqJm7lpD2KXQztsFvKlH0jmr5WisTzjle5U5TIDV+DwLQk9Qd:3X05Jm7sAKF0GELm8IDVGqQV
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jauig.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" srRTMxaDv9.exe -
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/files/0x000a000000009da1-39.dat modiloader_stage2 behavioral2/memory/5036-49-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation srRTMxaDv9.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe -
Executes dropped EXE 8 IoCs
pid Process 4504 srRTMxaDv9.exe 5036 amhost.exe 3404 jauig.exe 3760 amhost.exe 776 bmhost.exe 5028 cmhost.exe 644 X 3804 dmhost.exe -
resource yara_rule behavioral2/memory/3760-46-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3760-45-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3760-51-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3760-53-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3760-52-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /i" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /V" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /n" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /d" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /q" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /Z" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /g" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /N" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /p" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /o" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /x" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /X" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /h" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /w" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /P" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /T" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /L" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /H" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /G" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /S" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /R" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /I" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /u" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /U" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /y" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /z" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /s" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /E" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /v" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /A" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /k" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /D" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /Y" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /K" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /B" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /e" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /C" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /b" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /l" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /f" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /t" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /q" srRTMxaDv9.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /M" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /r" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /Q" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /a" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /c" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /J" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /O" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /F" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /j" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /m" jauig.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jauig = "C:\\Users\\Admin\\jauig.exe /W" jauig.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 5036 set thread context of 3760 5036 amhost.exe 88 PID 776 set thread context of 2636 776 bmhost.exe 93 PID 5028 set thread context of 2076 5028 cmhost.exe 102 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 748 tasklist.exe 1948 tasklist.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4504 srRTMxaDv9.exe 4504 srRTMxaDv9.exe 4504 srRTMxaDv9.exe 4504 srRTMxaDv9.exe 3760 amhost.exe 3760 amhost.exe 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3760 amhost.exe 3760 amhost.exe 644 X 644 X 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3760 amhost.exe 3760 amhost.exe 3404 jauig.exe 3404 jauig.exe 3760 amhost.exe 3760 amhost.exe 3760 amhost.exe 3760 amhost.exe 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3760 amhost.exe 3760 amhost.exe 3404 jauig.exe 3404 jauig.exe 3760 amhost.exe 3760 amhost.exe 3404 jauig.exe 3404 jauig.exe 3760 amhost.exe 3760 amhost.exe 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3404 jauig.exe 3760 amhost.exe 3760 amhost.exe 3404 jauig.exe 3404 jauig.exe 3760 amhost.exe 3760 amhost.exe 3760 amhost.exe 3760 amhost.exe 3404 jauig.exe 3404 jauig.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 748 tasklist.exe Token: SeDebugPrivilege 776 bmhost.exe Token: SeDebugPrivilege 5028 cmhost.exe Token: SeDebugPrivilege 1948 tasklist.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 4504 srRTMxaDv9.exe 3404 jauig.exe 3804 dmhost.exe -
Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 5024 wrote to memory of 4504 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 81 PID 5024 wrote to memory of 4504 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 81 PID 5024 wrote to memory of 4504 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 81 PID 5024 wrote to memory of 5036 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 82 PID 5024 wrote to memory of 5036 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 82 PID 5024 wrote to memory of 5036 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 82 PID 4504 wrote to memory of 3404 4504 srRTMxaDv9.exe 83 PID 4504 wrote to memory of 3404 4504 srRTMxaDv9.exe 83 PID 4504 wrote to memory of 3404 4504 srRTMxaDv9.exe 83 PID 4504 wrote to memory of 4956 4504 srRTMxaDv9.exe 84 PID 4504 wrote to memory of 4956 4504 srRTMxaDv9.exe 84 PID 4504 wrote to memory of 4956 4504 srRTMxaDv9.exe 84 PID 4956 wrote to memory of 748 4956 cmd.exe 86 PID 4956 wrote to memory of 748 4956 cmd.exe 86 PID 4956 wrote to memory of 748 4956 cmd.exe 86 PID 5036 wrote to memory of 3760 5036 amhost.exe 88 PID 5036 wrote to memory of 3760 5036 amhost.exe 88 PID 5036 wrote to memory of 3760 5036 amhost.exe 88 PID 5036 wrote to memory of 3760 5036 amhost.exe 88 PID 5036 wrote to memory of 3760 5036 amhost.exe 88 PID 5036 wrote to memory of 3760 5036 amhost.exe 88 PID 5036 wrote to memory of 3760 5036 amhost.exe 88 PID 5036 wrote to memory of 3760 5036 amhost.exe 88 PID 5024 wrote to memory of 776 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 89 PID 5024 wrote to memory of 776 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 89 PID 5024 wrote to memory of 776 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 89 PID 776 wrote to memory of 2636 776 bmhost.exe 93 PID 776 wrote to memory of 2636 776 bmhost.exe 93 PID 776 wrote to memory of 2636 776 bmhost.exe 93 PID 776 wrote to memory of 2636 776 bmhost.exe 93 PID 5024 wrote to memory of 5028 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 95 PID 5024 wrote to memory of 5028 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 95 PID 5024 wrote to memory of 5028 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 95 PID 5028 wrote to memory of 644 5028 cmhost.exe 96 PID 5028 wrote to memory of 644 5028 cmhost.exe 96 PID 644 wrote to memory of 1720 644 X 97 PID 644 wrote to memory of 1720 644 X 97 PID 644 wrote to memory of 1720 644 X 97 PID 5028 wrote to memory of 2076 5028 cmhost.exe 102 PID 5028 wrote to memory of 2076 5028 cmhost.exe 102 PID 5028 wrote to memory of 2076 5028 cmhost.exe 102 PID 5028 wrote to memory of 2076 5028 cmhost.exe 102 PID 5024 wrote to memory of 3804 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 104 PID 5024 wrote to memory of 3804 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 104 PID 5024 wrote to memory of 3804 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 104 PID 5024 wrote to memory of 4376 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 107 PID 5024 wrote to memory of 4376 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 107 PID 5024 wrote to memory of 4376 5024 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe 107 PID 4376 wrote to memory of 1948 4376 cmd.exe 109 PID 4376 wrote to memory of 1948 4376 cmd.exe 109 PID 4376 wrote to memory of 1948 4376 cmd.exe 109 PID 3404 wrote to memory of 1948 3404 jauig.exe 109 PID 3404 wrote to memory of 1948 3404 jauig.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\srRTMxaDv9.exeC:\Users\Admin\srRTMxaDv9.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\jauig.exe"C:\Users\Admin\jauig.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del srRTMxaDv9.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:748
-
-
-
-
C:\Users\Admin\amhost.exeC:\Users\Admin\amhost.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\amhost.exeamhost.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3760
-
-
-
C:\Users\Admin\bmhost.exeC:\Users\Admin\bmhost.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:2636
-
-
-
C:\Users\Admin\cmhost.exeC:\Users\Admin\cmhost.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\6f42fddf\X176.53.17.24:803⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵
- Modifies registry class
PID:1720
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:2076
-
-
-
C:\Users\Admin\dmhost.exeC:\Users\Admin\dmhost.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3804
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 24324b4f141efbcee94b278fef963e5c_JaffaCakes118.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5be40a2578e862f1cecc9b9194f524201
SHA10c379f375f9bcfab2e8d86161cec07fe4a7dbc12
SHA2562c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6
SHA51225fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8
-
Filesize
80KB
MD58ccbe4f27f9710f3e7f75e1d1de57e49
SHA1272e95e476477cd4a1715ee0bcf32318e0351718
SHA2563d36ee15c25b2308f8552e121d885c26b46b4e7fc6dbb41a684bec53e0ae3b5d
SHA512334f56b5158839f521513aff9de334536c86da633bf1a3b78592529275457973ed67fd55a54bef8f88ce918c2863c365cababfbd0ef888a27272906e281105d0
-
Filesize
258KB
MD52da0070a7c50f3a078b73b4fb7ee7c02
SHA1999b4860a80b908622fadfc8fae27db66b200932
SHA256f8a0f1b5b3f320f01173f151305dc780eac51bf78e7405fd2c0b9b3ba58945bf
SHA5122d488508e785d92c5cf9f0abee8153d984d8dd8f1d59880643764f499e151fccc9572a9ad1fe0a82412b8ed230d25bd849a0beeded12325dc21839ed53512630
-
Filesize
358KB
MD503102e4338eb16e0c4dfe106830557e3
SHA14fdb5baf0900e44e95acdeee1c947be3b0518b39
SHA2567dd28bddc46daddc8f7e14906f50ef991d3d7f1ffb785388fb5c42be9e162139
SHA512c7d4b4b3766c0b4cdc3d16f56effe1b36cacd4a48f728cf1a33360eb6c48362587186dc0be45f098cd3117bc10c7113d51262939bfe018c6f963b36d59cd97c9
-
Filesize
32KB
MD53b906143422ff578e4a9bc688441e89c
SHA14164ef104958d715275a85f62603b5118f8a6ebc
SHA256cb6cc4f0050dc045087df49249e1f2d57a86cc332106a904b7d59dff0819aacf
SHA51206b1d0ae7c60565c982feaa6877f6538040b47d27f2b8ea0178ddab9505b5f91f69ac485adfa043747e7d8c8b9b75748dd11699d38eca76124f77ceda0e9daeb
-
Filesize
344KB
MD5e4d11fbe09b35495bb17a82974385bba
SHA1b086231b6e103c72d2033aee8e99bfe58665909c
SHA256f868771508528711edbd953f1601f838c7ca136d3705b5b535830e468bf3d210
SHA512cb790025e1094842bdc60bd46a42561aede488ccbb1ef119d1f214eca9ca16e5946714e4bcee6db561218fbb0678f00dab34d37735c384e8e0aa46e876cd381c
-
Filesize
344KB
MD557a5743f47b3a874773041195600909c
SHA174f5c16a6ca03baea7c684e40d351f1ec484a70d
SHA256eecfb7541cf571d34882ebeb19c3c396ed53243e23060d45e1f1b033e061da90
SHA51266c4621663db921b7a18b843197ea6611e9473abca6b2a653d1f228146129434a7f643f598e0fdfbe300f2ea91168135de59a69f02f52245c71f12e4364e2954