Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
09-07-2024 17:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
31404212cba318f2a7556105075f71b3_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
31404212cba318f2a7556105075f71b3_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
31404212cba318f2a7556105075f71b3_JaffaCakes118.exe
-
Size
640KB
-
MD5
31404212cba318f2a7556105075f71b3
-
SHA1
10bf447cb459eb24ef5a84530d5a9c19a5dcf3d6
-
SHA256
713fdf5caffe2138e076c1b25193cf8dea8c1ff74e72178598da0af5209fbd2e
-
SHA512
3190576f24576b847797b4d6ed0e2dfd7ee3774d6049bb87727557c24d8f717aea88947e4a4c114ee0fedcbf5e1fcb50de85742269b9735bce132339faa02971
-
SSDEEP
6144:d91sHI+Ri09LzS8Xghw67smirGaf6cNkJI/iU4Bm:dj0BzBCw6cf3RiU4
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2952 RpcS.exe -
Drops file in System32 directory 39 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\IECompatUaCache\Low IEXPLORE.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 IEXPLORE.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{37E0A696-3E20-11EF-B355-F2AA40FE1C9B}.dat IEXPLORE.EXE File opened for modification C:\Windows\SysWOW64\RpcS.exe 31404212cba318f2a7556105075f71b3_JaffaCakes118.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\suggestions[1].en-US IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Low IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Virtualized IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E162B8FC-3E1F-11EF-B355-F2AA40FE1C9B}.dat IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\Favorites IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\Favorites\desktop.ini IEXPLORE.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D IEXPLORE.EXE File created C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico IEXPLORE.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F9462808-3E1F-11EF-B355-F2AA40FE1C9B}.dat IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1 IEXPLORE.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{0E1DF6D5-3E20-11EF-B355-F2AA40FE1C9B}.dat IEXPLORE.EXE File created C:\Windows\SysWOW64\RpcS.exe RpcS.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\Low IEXPLORE.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E162B8FE-3E1F-11EF-B355-F2AA40FE1C9B}.dat IEXPLORE.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\favicon[2].ico IEXPLORE.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1 IEXPLORE.EXE File created C:\Windows\SysWOW64\RpcS.exe 31404212cba318f2a7556105075f71b3_JaffaCakes118.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE\Low IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\IECompatCache\Low IEXPLORE.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE IEXPLORE.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{22FF4FE7-3E20-11EF-B355-F2AA40FE1C9B}.dat IEXPLORE.EXE File created C:\Windows\SysWOW64\RpcS.dll RpcS.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\DNTException\Low IEXPLORE.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies IEXPLORE.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\favicon[1].ico IEXPLORE.EXE File opened for modification C:\Windows\SysWOW64\RpcS.dll RpcS.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E162B900-3E1F-11EF-B355-F2AA40FE1C9B}.dat IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico IEXPLORE.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\known_providers_download_v1[1].xml IEXPLORE.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E162B8FC-3E1F-11EF-B355-F2AA40FE1C9B}.dat IEXPLORE.EXE -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Edge IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Time = e8070700020009001200140012002500 IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff580000005800000078030000b0020000 IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore\Count = "6" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Zones IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore\LoadTimeArray = 1700000003000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Setup IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\SearchScopesUpgradeVersion = "1" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021493-0000-0000-C000-000000000046} IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Count = "6" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Time = e807070002000900120015001c006300 IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore\Count = "5" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\LoadTimeArray = 01000000040000000d0000000e000000ffffffffffffffffffffffffffffffffffffffffffffffff IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation\UnattendLoaded = "1" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e0000005e03000096020000 IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\LoadTimeArray = 0800000001000000040000000d0000000e000000ffffffffffffffffffffffffffffffffffffffff IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\F12 IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Edge\IEToEdge IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\iexplore\Time = e807070002000900120014000d00ab01 IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021494-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e807070002000900120014001600920000000000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Count = "4" IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Flags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Edge\IEToEdge IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Suggested Sites IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}\Enum IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021493-0000-0000-C000-000000000046}\Enum IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\Time = e8070700020009001200160026009200 IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a60ff3af6dfeb140ae32d0515eaadf8300000000020000000000106600000001000020000000478c6842718b391d9335c426fa18a20c3bb88de52da070e77032bbdc4dd5b0b5000000000e8000000002000020000000453e907297abb5e64facb3c5f813fa4eb1c8ce873a3d568ead2dde7383339dc550000000937d4aafca7e4f2adf85c776f3ab9b0175179b35c1f18b7073d8739652b2fcf93af1d6bb29bf5c6e58c4aa045e0f56d158ec09a6c92c5730e2fd846704c28f41851acc37dcd15b241e7924649d8a734140000000194221da303e705540988957b99921e23b439464c3488ee9ea3557a750acfe829b889616c21ae50299ca250ca86a6b0954f640112ccd9deee8194fa7adf6f387 IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffa6000000a6000000c6030000fe020000 IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a60ff3af6dfeb140ae32d0515eaadf830000000002000000000010660000000100002000000080a377bf4b43d38d3b6d0ffe8f43eb6f2061861581b91cfb30ddd6f14f4a8697000000000e800000000200002000000031a73ec34d1cf64c26d262ed39e4c8e38a298ed5a573d948b75510247219ac3610000000063ee15e08ee23f5e6291effca0ccb834000000036d717066b3728e6e8f457b9484588c8df6c5406640da7d13c438fa8b759e154d079fbac713fb6604ec4157f930d6efdc4e24821b14c4b63dca01074357adb12 IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\iexplore\LoadTimeArray = 0e000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a60ff3af6dfeb140ae32d0515eaadf8300000000020000000000106600000001000020000000c3d830e8a81b331baa1473cd0455188b337f01563f294640224804d5677eb3ec000000000e80000000020000200000008feb0da6edc38dad475fcd4d5bede215a720c4bafbf7cf13543683a3e8e154f7500000003aee3ef1025bc2dbf6b3a9d4fc61607799e650bd200eb6004819b505819f966354738ec79a6e31470644456ba9d70567d0755d976c41a42f30d234823541c67fa682b65453295758a1b76cf6c8475124400000007b83d1d0be18a7ad1c73af3cfd084599e53e4869d14233feb6640f07adbc26fc6543ba3423dc50ab877c6abd980ee3c8eb57d961cb3a2a3b081afd4c156df603 IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2952 RpcS.exe Token: SeDebugPrivilege 2952 RpcS.exe Token: SeDebugPrivilege 2952 RpcS.exe Token: SeDebugPrivilege 2952 RpcS.exe Token: SeDebugPrivilege 2952 RpcS.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 4488 IEXPLORE.EXE 4488 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1168 IEXPLORE.EXE 1168 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 3548 IEXPLORE.EXE 3548 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 3716 IEXPLORE.EXE 3716 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 1168 IEXPLORE.EXE 1168 IEXPLORE.EXE 1424 IEXPLORE.EXE 1424 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2412 2968 31404212cba318f2a7556105075f71b3_JaffaCakes118.exe 85 PID 2968 wrote to memory of 2412 2968 31404212cba318f2a7556105075f71b3_JaffaCakes118.exe 85 PID 2968 wrote to memory of 2412 2968 31404212cba318f2a7556105075f71b3_JaffaCakes118.exe 85 PID 2952 wrote to memory of 4388 2952 RpcS.exe 84 PID 2952 wrote to memory of 4388 2952 RpcS.exe 84 PID 2952 wrote to memory of 4388 2952 RpcS.exe 84 PID 4388 wrote to memory of 1424 4388 IEXPLORE.EXE 88 PID 4388 wrote to memory of 1424 4388 IEXPLORE.EXE 88 PID 1424 wrote to memory of 4488 1424 IEXPLORE.EXE 89 PID 1424 wrote to memory of 4488 1424 IEXPLORE.EXE 89 PID 1424 wrote to memory of 4488 1424 IEXPLORE.EXE 89 PID 2952 wrote to memory of 1136 2952 RpcS.exe 90 PID 2952 wrote to memory of 1136 2952 RpcS.exe 90 PID 2952 wrote to memory of 1136 2952 RpcS.exe 90 PID 1136 wrote to memory of 764 1136 IEXPLORE.EXE 91 PID 1136 wrote to memory of 764 1136 IEXPLORE.EXE 91 PID 1424 wrote to memory of 1168 1424 IEXPLORE.EXE 92 PID 1424 wrote to memory of 1168 1424 IEXPLORE.EXE 92 PID 1424 wrote to memory of 1168 1424 IEXPLORE.EXE 92 PID 2952 wrote to memory of 4176 2952 RpcS.exe 94 PID 2952 wrote to memory of 4176 2952 RpcS.exe 94 PID 2952 wrote to memory of 4176 2952 RpcS.exe 94 PID 4176 wrote to memory of 2184 4176 IEXPLORE.EXE 95 PID 4176 wrote to memory of 2184 4176 IEXPLORE.EXE 95 PID 1424 wrote to memory of 3548 1424 IEXPLORE.EXE 96 PID 1424 wrote to memory of 3548 1424 IEXPLORE.EXE 96 PID 1424 wrote to memory of 3548 1424 IEXPLORE.EXE 96 PID 2952 wrote to memory of 2752 2952 RpcS.exe 97 PID 2952 wrote to memory of 2752 2952 RpcS.exe 97 PID 2952 wrote to memory of 2752 2952 RpcS.exe 97 PID 2752 wrote to memory of 4060 2752 IEXPLORE.EXE 98 PID 2752 wrote to memory of 4060 2752 IEXPLORE.EXE 98 PID 1424 wrote to memory of 3716 1424 IEXPLORE.EXE 99 PID 1424 wrote to memory of 3716 1424 IEXPLORE.EXE 99 PID 1424 wrote to memory of 3716 1424 IEXPLORE.EXE 99 PID 2952 wrote to memory of 1712 2952 RpcS.exe 100 PID 2952 wrote to memory of 1712 2952 RpcS.exe 100 PID 2952 wrote to memory of 1712 2952 RpcS.exe 100 PID 1712 wrote to memory of 4952 1712 IEXPLORE.EXE 101 PID 1712 wrote to memory of 4952 1712 IEXPLORE.EXE 101 PID 2952 wrote to memory of 5084 2952 RpcS.exe 102 PID 2952 wrote to memory of 5084 2952 RpcS.exe 102 PID 2952 wrote to memory of 5084 2952 RpcS.exe 102 PID 5084 wrote to memory of 544 5084 IEXPLORE.EXE 103 PID 5084 wrote to memory of 544 5084 IEXPLORE.EXE 103 PID 1424 wrote to memory of 2648 1424 IEXPLORE.EXE 104 PID 1424 wrote to memory of 2648 1424 IEXPLORE.EXE 104 PID 1424 wrote to memory of 2648 1424 IEXPLORE.EXE 104 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\31404212cba318f2a7556105075f71b3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\31404212cba318f2a7556105075f71b3_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\\delmeexe.bat2⤵PID:2412
-
-
C:\Windows\SysWOW64\RpcS.exeC:\Windows\SysWOW64\RpcS.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" about:blank2⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:17410 /prefetch:24⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4488
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:82948 /prefetch:24⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1168
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:82952 /prefetch:24⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3548
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:82956 /prefetch:24⤵
- Suspicious use of SetWindowsHookEx
PID:3716
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:82962 /prefetch:24⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2648
-
-
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" about:blank2⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank3⤵PID:764
-
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" about:blank2⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank3⤵PID:2184
-
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" about:blank2⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank3⤵PID:4060
-
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" about:blank2⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank3⤵PID:4952
-
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" about:blank2⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank3⤵PID:544
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231B
MD57f5fbef0220970c57bde73fb08f03d1c
SHA1735ade8cf67647578fd5e68a98604835f4e77c0e
SHA25632b6dfde551c85b44367283cef7c240bbde6c70720e871d098a255ad1260efd8
SHA512b4fe324d03c64acaeb5ca5c0fb772f44c223a65d026de6cc4620210d5f36c0ea2cc028e38fcfc0ea7970e4a90dcf0995a3d81d4c4c1156db48f4e6d05f42d2fd
-
Filesize
640KB
MD531404212cba318f2a7556105075f71b3
SHA110bf447cb459eb24ef5a84530d5a9c19a5dcf3d6
SHA256713fdf5caffe2138e076c1b25193cf8dea8c1ff74e72178598da0af5209fbd2e
SHA5123190576f24576b847797b4d6ed0e2dfd7ee3774d6049bb87727557c24d8f717aea88947e4a4c114ee0fedcbf5e1fcb50de85742269b9735bce132339faa02971
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
402B
MD5881dfac93652edb0a8228029ba92d0f5
SHA15b317253a63fecb167bf07befa05c5ed09c4ccea
SHA256a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
SHA512592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810
-
Filesize
88KB
MD5002d5646771d31d1e7c57990cc020150
SHA1a28ec731f9106c252f313cca349a68ef94ee3de9
SHA2561e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f
SHA512689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6