8fc59c7fbcd4c1bd326184686e4ac04a043ecd197737041eb2e08eb0a25bc614

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 07:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe
Size

66KB
MD5

2b77a1505a498981468dfd6023249e4f
SHA1

5b552c2bdd3b0a8349ebe4a8c09bcf7d9af1a284
SHA256

8fc59c7fbcd4c1bd326184686e4ac04a043ecd197737041eb2e08eb0a25bc614
SHA512

7f54ab9cef7dfc17c360054d9896d19519383555fedf50787146813e39b44347938e28bfc1518ae0e14929798d029ca4aba370068e1a391bfcb7172b7c459daa
SSDEEP

1536:vBdghLygW+pHhV7xvpeYBmSzpd6HCI+Pd+pi2Krznouy8fRDBB:JdOLybKTpeKmSOiIgd+pi2ALoutfRDBB

Score

10^/10

evasion persistence privilege_escalation upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\WINDOWS\\Cursors\\csrss.exe"	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1144	netsh.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2524	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
2112	csrss.exe

Loads dropped DLL 7 IoCs

pid	Process
2952	regsvr32.exe
1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe
1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe
2112	csrss.exe
2112	csrss.exe
2112	csrss.exe
2112	csrss.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1232-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/files/0x00080000000174a8-11.dat	upx
behavioral1/memory/1232-25-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/2112-26-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\ setup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe"	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\ setup = "C:\\WINDOWS\\Cursors\\csrss.exe"	csrss.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MSWINSCK.OCX	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSWINSCK.OCX	attrib.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\Cursors\csrss.exe	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\Cursors\csrss.exe	attrib.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497"	regsvr32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe
1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe
2112	csrss.exe
2112	csrss.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2952	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	30
PID 1232 wrote to memory of 2952	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	30
PID 1232 wrote to memory of 2952	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	30
PID 1232 wrote to memory of 2952	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	30
PID 1232 wrote to memory of 2952	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	30
PID 1232 wrote to memory of 2952	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	30
PID 1232 wrote to memory of 2952	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	30
PID 1232 wrote to memory of 2524	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	31
PID 1232 wrote to memory of 2524	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	31
PID 1232 wrote to memory of 2524	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	31
PID 1232 wrote to memory of 2524	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	31
PID 1232 wrote to memory of 2524	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	31
PID 1232 wrote to memory of 2524	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	31
PID 1232 wrote to memory of 2524	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	31
PID 1232 wrote to memory of 1144	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	33
PID 1232 wrote to memory of 1144	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	33
PID 1232 wrote to memory of 1144	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	33
PID 1232 wrote to memory of 1144	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	33
PID 1232 wrote to memory of 1144	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	33
PID 1232 wrote to memory of 1144	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	33
PID 1232 wrote to memory of 1144	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	33
PID 1232 wrote to memory of 2080	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	34
PID 1232 wrote to memory of 2080	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	34
PID 1232 wrote to memory of 2080	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	34
PID 1232 wrote to memory of 2080	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	34
PID 1232 wrote to memory of 2080	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	34
PID 1232 wrote to memory of 2080	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	34
PID 1232 wrote to memory of 2080	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	34
PID 1232 wrote to memory of 2112	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	37
PID 1232 wrote to memory of 2112	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	37
PID 1232 wrote to memory of 2112	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	37
PID 1232 wrote to memory of 2112	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	37
PID 1232 wrote to memory of 2112	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	37
PID 1232 wrote to memory of 2112	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	37
PID 1232 wrote to memory of 2112	1232	2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe	37

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2524	attrib.exe
2080	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2b77a1505a498981468dfd6023249e4f_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s C:\Windows\system32\MSWINSCK.OCX
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:2952
- C:\Windows\SysWOW64\attrib.exe
  attrib +S +H C:\Windows\system32\MSWINSCK.OCX
  2⤵
  - Sets file to hidden
  - Drops file in System32 directory
  - Views/modifies file attributes
  PID:2524
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram program =C:\WINDOWS\Cursors\csrss.exename = WinUpdate = ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1144
- C:\Windows\SysWOW64\attrib.exe
  attrib +h C:\WINDOWS\Cursors\csrss.exe
  2⤵
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:2080
- C:\WINDOWS\Cursors\csrss.exe
  C:\WINDOWS\Cursors\csrss.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\MSWINSCK.OCX

Filesize
105KB

MD5
9484c04258830aa3c2f2a70eb041414c

SHA1
b242a4fb0e9dcf14cb51dc36027baff9a79cb823

SHA256
bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

SHA512
9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

Download Submit
\Windows\Cursors\csrss.exe

Filesize
66KB

MD5
804a83d96974b5ae0826c5af8bd5844b

SHA1
a13a4d84a535ce865240ab7653a8f68c4fbcb280

SHA256
ac164a87ce18773af8f6c47b11fc13d2e87e0c174ffd89756b21e85adad60c3b

SHA512
9814c428a272b7c05a6f03a640ca6678669fb63bbdf07dc853e17a441678597f95a419231ed153ed33124455876840b2b87b4ab5d1cb9c7701ed7d525accc591

Download Submit
memory/1232-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1232-3-0x0000000000230000-0x000000000025D000-memory.dmp

Filesize
180KB

Download
memory/1232-2-0x0000000000230000-0x000000000025D000-memory.dmp

Filesize
180KB

Download
memory/1232-25-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2112-23-0x0000000000230000-0x000000000025D000-memory.dmp

Filesize
180KB

Download
memory/2112-26-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads