b8ac239d2c20f6079866de9374ae7ef09546b1f25352a4b1f7ca719329377596

Analysis

max time kernel
31s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe
Size

660KB
MD5

42fa6ad38d412c3a8170326d9aa6aedb
SHA1

d1fd6707e8c272c1df7896cc2f35afa6ed588efd
SHA256

b8ac239d2c20f6079866de9374ae7ef09546b1f25352a4b1f7ca719329377596
SHA512

4ca56349fdd1a777273a43c92bb68a83a5b333c5adc79f29932dbc1655d676f9f53ee35257ca2fa026df7085427a29059910526043c19c20e64c1dd652cc8a6c
SSDEEP

12288:Bp5FTt2Zu2ks2DDD7cMqacjpYbhGki1dlIKo9OG+ZvRl:rT8I2ks2vft0pY9GVdlFUOxvX

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ComodoVPN = "C:\\Program Files (x86)\\svchost\\svchost.exe"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ComodoVPN = "C:\\Program Files (x86)\\svchost\\svchost.exe"	iexplore.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7M3CMS2-AY2Q-6LD3-QGW3-DOUVCCYS1787}	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7M3CMS2-AY2Q-6LD3-QGW3-DOUVCCYS1787}\StubPath = "C:\\Program Files (x86)\\svchost\\svchost.exe Restart"	iexplore.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3916-11-0x0000000010410000-0x00000000104D4000-memory.dmp	upx
behavioral2/memory/3916-13-0x0000000010410000-0x00000000104D4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Antivirus = "C:\\Program Files (x86)\\svchost\\svchost.exe"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Firewall = "C:\\Program Files (x86)\\svchost\\svchost.exe"	iexplore.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4640 set thread context of 1324	4640	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	86
PID 1324 set thread context of 3916	1324	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	87

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\svchost\svchost.exe	iexplore.exe
File opened for modification	C:\Program Files (x86)\svchost\svchost.exe	iexplore.exe
File opened for modification	C:\Program Files (x86)\svchost\plugin.dat	iexplore.exe
File opened for modification	C:\Program Files (x86)\svchost\	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe
3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe
3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe
3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe
Token: SeDebugPrivilege	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe
Token: SeDebugPrivilege	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe
Token: SeDebugPrivilege	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4640	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe
1324	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 1324	4640	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	86
PID 4640 wrote to memory of 1324	4640	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	86
PID 4640 wrote to memory of 1324	4640	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	86
PID 4640 wrote to memory of 1324	4640	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	86
PID 4640 wrote to memory of 1324	4640	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	86
PID 4640 wrote to memory of 1324	4640	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	86
PID 4640 wrote to memory of 1324	4640	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	86
PID 4640 wrote to memory of 1324	4640	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	86
PID 1324 wrote to memory of 3916	1324	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	87
PID 1324 wrote to memory of 3916	1324	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	87
PID 1324 wrote to memory of 3916	1324	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	87
PID 1324 wrote to memory of 3916	1324	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	87
PID 1324 wrote to memory of 3916	1324	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	87
PID 1324 wrote to memory of 3916	1324	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	87
PID 1324 wrote to memory of 3916	1324	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	87
PID 1324 wrote to memory of 3916	1324	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	87
PID 1324 wrote to memory of 3916	1324	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	87
PID 1324 wrote to memory of 3916	1324	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	87
PID 1324 wrote to memory of 3916	1324	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	87
PID 1324 wrote to memory of 3916	1324	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	87
PID 1324 wrote to memory of 3916	1324	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	87
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88
PID 3916 wrote to memory of 3588	3916	42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe	88

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:776
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:384

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:800
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2920
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3752
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3844
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3908
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3980
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2292
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3700
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4464
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:1668
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:772
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:4828
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3144
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1100
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1388
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2060

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2224

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2520

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3396

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3424
- C:\Users\Admin\AppData\Local\Temp\42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Users\Admin\AppData\Local\Temp\42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\42fa6ad38d412c3a8170326d9aa6aedb_JaffaCakes118.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3916
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        Adds policy Run key to start application
        Boot or Logon Autostart Execution: Active Setup
        Adds Run key to start application
        Drops file in Program Files directory
        
        PID:3588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3388

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1324-2-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1324-4-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/1324-715-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/3916-18-0x0000000000510000-0x000000000051A000-memory.dmp

Filesize
40KB

Download
memory/3916-32-0x0000000000530000-0x000000000053A000-memory.dmp

Filesize
40KB

Download
memory/3916-10-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3916-11-0x0000000010410000-0x00000000104D4000-memory.dmp

Filesize
784KB

Download
memory/3916-13-0x0000000010410000-0x00000000104D4000-memory.dmp

Filesize
784KB

Download
memory/3916-7-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3916-25-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download
memory/3916-9-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3916-39-0x0000000000640000-0x000000000064A000-memory.dmp

Filesize
40KB

Download
memory/3916-46-0x00000000020D0000-0x00000000020DA000-memory.dmp

Filesize
40KB

Download
memory/3916-53-0x00000000020E0000-0x00000000020EA000-memory.dmp

Filesize
40KB

Download
memory/3916-60-0x00000000020F0000-0x00000000020FA000-memory.dmp

Filesize
40KB

Download
memory/3916-67-0x00000000104E0000-0x00000000104EA000-memory.dmp

Filesize
40KB

Download
memory/3916-713-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3916-8-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download