ead1f97c8c31df768fa25b86ecf07260865d4092cba3a9fd0b63195d3374d84b

Analysis

max time kernel
143s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Size

31KB
MD5

2610fc197c97cbd69ddfb46f0b577d2a
SHA1

7a278ae9c1ff1b7b390054d302d0acbeb1ec8e24
SHA256

ead1f97c8c31df768fa25b86ecf07260865d4092cba3a9fd0b63195d3374d84b
SHA512

5131b121c0e042dc6b323b4d10d86db8359334c305d61c212cf90df5e4858883fc08f7d87baa70ae635932fe47caa170574889ff87118317b87d645a7376b889
SSDEEP

768:KVS92A2FlIj0nfFV2rGeqWPy9TH5qxyjt1tHiqS4:KVS92fJNV2rIL9Yot1t9d

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\disdn\Flower.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRun.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShuiNiu.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSET.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.EXE\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sos.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShuiNiu.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Systom.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sos.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe\Debugger = "C:\\Windows\\system32\\Flower.exe"	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\j:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\l:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\o:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\u:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\k:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\q:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\t:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\x:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\y:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\z:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\g:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\h:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\p:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\v:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\w:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\i:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\m:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\n:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\r:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened (read-only)	\??\s:	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	\??\c:\autorun.inf	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened for modification	\??\c:\autorun.inf	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File created	\??\f:\autorun.inf	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened for modification	\??\f:\autorun.inf	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Flower.dll	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Flower.dll	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\a.jpg	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 20 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{692839EB-3A3F-11EF-A01A-E262BE540013} = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 909451424cceda01	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008fcedf5e0d52224baa9638bd05eba5250000000002000000000010660000000100002000000097e5f11c2a88a78987e84093ff4e265a0c0ce76f3e484479a46bac5dd1d86f35000000000e800000000200002000000001215b703f3f2fe5da1e8e7006d0e646fe1a8ce47e3915108376fccdf42b4bbf20000000a205ec8a3896bef2f9b2bd37fcb74e8bec43e2c118242ed4623d1c6bd3fed51e400000009e228a0286b16973f01f3fa21e05e397a2aeaf5213e9357da730e0de8d566b2497f943d1820a749e79619b27036963ed3f45a17b10f5e1a78b85b7c5bfed0693	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01e48424cceda01	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008fcedf5e0d52224baa9638bd05eba52500000000020000000000106600000001000020000000516cffa40c716c0702decc1935b76e5b3dd96b7bd159f2acb56723ac6a0ab285000000000e800000000200002000000077e5b9bde8878647cc34dd0ff78259f8636e6d5d3ab188068b2a3caa254e78f620000000e5cceeb588904465670bd85831deee160cc81eda091c3f769784712de22f6c6c40000000cc0127d3fbf8ad43321f8cb5ea95485e0569a68a198212596954e5a09dedef52c3846b3f8029754e44f3936c35a5a0f030f320f577260e4a7c1d0ec7d0b764c6	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2408	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
2408	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
2408	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
2408	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
2408	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
2408	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
2408	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
2408	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
2408	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
2408	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
2408	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
2408	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3196	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3196	IEXPLORE.EXE
3196	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 3196	2408	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe	83
PID 2408 wrote to memory of 3196	2408	2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe	83
PID 3196 wrote to memory of 2268	3196	IEXPLORE.EXE	84
PID 3196 wrote to memory of 2268	3196	IEXPLORE.EXE	84
PID 3196 wrote to memory of 2268	3196	IEXPLORE.EXE	84

C:\Users\Admin\AppData\Local\Temp\2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2610fc197c97cbd69ddfb46f0b577d2a_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  Open http://219.139.58.141/tj.asp
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3196 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\autorun.inf

Filesize
145B

MD5
049bad4a2c477da04e09d36af81b087e

SHA1
15b18b6bada7d08503ba85261ffc22faf3709d94

SHA256
8e92786680c710e03413f07244bab8943bad3a6247a8103a8d8198c7f7f6db05

SHA512
a783cdb149059a5e18052edb9f32770bf5e85607d46f2359101dc016b5875c326e4708c070d2b1d8134cd7d7261b3f002e4708429ec3cfc9d5e55b0e920d0ad8

Download Submit
C:\test.exe

Filesize
31KB

MD5
2610fc197c97cbd69ddfb46f0b577d2a

SHA1
7a278ae9c1ff1b7b390054d302d0acbeb1ec8e24

SHA256
ead1f97c8c31df768fa25b86ecf07260865d4092cba3a9fd0b63195d3374d84b

SHA512
5131b121c0e042dc6b323b4d10d86db8359334c305d61c212cf90df5e4858883fc08f7d87baa70ae635932fe47caa170574889ff87118317b87d645a7376b889

Download Submit
memory/2408-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2408-1-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2408-2-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2408-4-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2408-11-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2408-30-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2408-48-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2408-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2408-84-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2408-102-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download