Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 17:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe
-
Size
86KB
-
MD5
25aae6ba9b88f8cb3d49fe0f78827fe8
-
SHA1
0164e22a977189ad02dfeeff0c346d3fceb5bae9
-
SHA256
be13c234396cdf8735450786edb014517352e7896646c6639e05367f5abf9e29
-
SHA512
7d43f8cd0e1a08add7651acf5fe14fd6e1c6573786cff2f1de081a6aa62a301ff3449e92ef8be640c22e744f1f6231bc02f574dfc8acfdb2af5b1848c621fdd7
-
SSDEEP
1536:Za3+ddygX7y9v7Z+NoykJHBOAFRfBjG3EdoIX:w8dfX7y9DZ+N7eB+hIX
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe -
Executes dropped EXE 12 IoCs
pid Process 2552 SVCHOST.EXE 2340 SVCHOST.EXE 4484 SVCHOST.EXE 3980 SVCHOST.EXE 1020 SVCHOST.EXE 216 SPOOLSV.EXE 656 SVCHOST.EXE 996 SVCHOST.EXE 3432 SPOOLSV.EXE 1404 SPOOLSV.EXE 2016 SVCHOST.EXE 2012 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe File opened for modification F:\Recycled\desktop.ini 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\M: 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe File opened (read-only) \??\P: 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\E: 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe File opened (read-only) \??\W: 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\N: 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\T: 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe File opened (read-only) \??\Y: 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\G: 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe File opened (read-only) \??\H: 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe File opened (read-only) \??\X: 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\I: 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe File opened (read-only) \??\Q: 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\K: 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe File opened (read-only) \??\L: 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\Y: SPOOLSV.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\*\QuickTip = "prop:Type;Size" 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\*\TileInfo = "prop:Type;Size" 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3168 WINWORD.EXE 3168 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 2552 SVCHOST.EXE 2552 SVCHOST.EXE 2552 SVCHOST.EXE 2552 SVCHOST.EXE 2552 SVCHOST.EXE 2552 SVCHOST.EXE 2552 SVCHOST.EXE 2552 SVCHOST.EXE 2552 SVCHOST.EXE 2552 SVCHOST.EXE 2552 SVCHOST.EXE 2552 SVCHOST.EXE 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 216 SPOOLSV.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 4484 SVCHOST.EXE 2552 SVCHOST.EXE 2552 SVCHOST.EXE 2552 SVCHOST.EXE 2552 SVCHOST.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 2552 SVCHOST.EXE 2340 SVCHOST.EXE 4484 SVCHOST.EXE 3980 SVCHOST.EXE 1020 SVCHOST.EXE 216 SPOOLSV.EXE 656 SVCHOST.EXE 996 SVCHOST.EXE 3432 SPOOLSV.EXE 1404 SPOOLSV.EXE 2016 SVCHOST.EXE 2012 SPOOLSV.EXE 3168 WINWORD.EXE 3168 WINWORD.EXE 3168 WINWORD.EXE 3168 WINWORD.EXE 3168 WINWORD.EXE 3168 WINWORD.EXE 3168 WINWORD.EXE -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 4920 wrote to memory of 2552 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 80 PID 4920 wrote to memory of 2552 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 80 PID 4920 wrote to memory of 2552 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 80 PID 2552 wrote to memory of 2340 2552 SVCHOST.EXE 81 PID 2552 wrote to memory of 2340 2552 SVCHOST.EXE 81 PID 2552 wrote to memory of 2340 2552 SVCHOST.EXE 81 PID 2552 wrote to memory of 4484 2552 SVCHOST.EXE 82 PID 2552 wrote to memory of 4484 2552 SVCHOST.EXE 82 PID 2552 wrote to memory of 4484 2552 SVCHOST.EXE 82 PID 4484 wrote to memory of 3980 4484 SVCHOST.EXE 83 PID 4484 wrote to memory of 3980 4484 SVCHOST.EXE 83 PID 4484 wrote to memory of 3980 4484 SVCHOST.EXE 83 PID 4484 wrote to memory of 1020 4484 SVCHOST.EXE 84 PID 4484 wrote to memory of 1020 4484 SVCHOST.EXE 84 PID 4484 wrote to memory of 1020 4484 SVCHOST.EXE 84 PID 4484 wrote to memory of 216 4484 SVCHOST.EXE 85 PID 4484 wrote to memory of 216 4484 SVCHOST.EXE 85 PID 4484 wrote to memory of 216 4484 SVCHOST.EXE 85 PID 216 wrote to memory of 656 216 SPOOLSV.EXE 86 PID 216 wrote to memory of 656 216 SPOOLSV.EXE 86 PID 216 wrote to memory of 656 216 SPOOLSV.EXE 86 PID 216 wrote to memory of 996 216 SPOOLSV.EXE 87 PID 216 wrote to memory of 996 216 SPOOLSV.EXE 87 PID 216 wrote to memory of 996 216 SPOOLSV.EXE 87 PID 216 wrote to memory of 3432 216 SPOOLSV.EXE 88 PID 216 wrote to memory of 3432 216 SPOOLSV.EXE 88 PID 216 wrote to memory of 3432 216 SPOOLSV.EXE 88 PID 2552 wrote to memory of 1404 2552 SVCHOST.EXE 89 PID 2552 wrote to memory of 1404 2552 SVCHOST.EXE 89 PID 2552 wrote to memory of 1404 2552 SVCHOST.EXE 89 PID 4920 wrote to memory of 2016 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 90 PID 4920 wrote to memory of 2016 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 90 PID 4920 wrote to memory of 2016 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 90 PID 4920 wrote to memory of 2012 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 91 PID 4920 wrote to memory of 2012 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 91 PID 4920 wrote to memory of 2012 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 91 PID 4920 wrote to memory of 3168 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 92 PID 4920 wrote to memory of 3168 4920 25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2340
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3980
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1020
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:216 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:656
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:996
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3432
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1404
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2016
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2012
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\25aae6ba9b88f8cb3d49fe0f78827fe8_JaffaCakes118.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3168
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5522ffaf2918251f934653b5095a39977
SHA1b26051fe3101d2dcb25911179af7001457972c5f
SHA256daf346af2c8523e90eabe2275527669a1dfbef7a1b50a76e1f0b18423705508a
SHA512bd5174c36a16c1c8adb0ef17fa6c7eb0dedc643da64510e73a66f9386a73ee92aef623ae5554456e66c2dd10b173360b5f0842ae31f6fd7db61ff63c925b50aa
-
Filesize
86KB
MD54d9bb5fae8deb06ff8525afaeba3d1fe
SHA1a5128d69d7ac3fd9f1188fdcbda6fc1b906212eb
SHA25696c797abfc60fc8205ad8e5be6dc7bef51a45369c5f7beb93d483408e94b4788
SHA51296966b6e3a3d002aebc173dcf8a34acc3c2f30d0f6a2ea9c83a897daa6601f3f0e5e1585c7073804b10022206e7f5c8a578a50148a21607562f0c1b2e84385c7
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
86KB
MD5e78c78b539e46f12580bf310adf35a06
SHA1a109b20c2a64cfa0b16c75bb25e7d45d673cc238
SHA25697cb831ae79c0461abfa215b860c3374fa06c94959aaa183daee3cb7a206b9da
SHA51272c9d6a9be1270677e7d77f5f6597e208084a92ac99975875d780ea7b9153006b9192c72911c1e01504c4546e658a91138cb1aee70b799c6b3fe5bca8bcdac9c
-
Filesize
86KB
MD5d4b6f5c9fe85290c50bde6aaeb9c8b79
SHA10e96f105ce3abc601557f80348fb139f3586a169
SHA25624c79921755f753b224cbcb5aed3713addcf308b13bc0d98686eed8c0d13ed0d
SHA51256fdc71e2d8323d98adc2eed53e3b2f3a70c303148d1472797958d81b3011f438e973fa9d35a79173ea58e430ef4d65578f9dff70ff812881200a3d4b4b2bcef
-
Filesize
86KB
MD5e7dfcae24ad55f2386f46463b1b94954
SHA1a2b3e57968de1d0a5839b7389299f22117081a49
SHA2568e25b301825618c606cce26279c616dbc4042571cfdcbdd3bed8767cb73eb6c2
SHA51224f62acb4e59f3df35566a15c61d7a464212f50f56203688947a4e89684feadf5173e9d0a8235c363e85ecfdde7d83c5bd4b2249c8fe6b0c4cf69af649d9a494
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
86KB
MD5e88413e67964cfdafb7e4e43c6953064
SHA10cb13aaf206bf551cce20121b43804f6951d7edf
SHA2569d041915b206434c119df67a30e7f51ecfb7d297ea56ac3f2a093f6363188f94
SHA512b17e1e7358c65cfb3f9775944ed7582560f28d2a16fd9f44b33fa7b0f136f92b1c455f13783deb88678a267d1327fc3b961ad1e1ddaa90dbb607cc6a59e0e7fa