Analysis
- max time kernel
149s - max time network
110s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
19/07/2024, 04:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
21 signatures
150 seconds
General
- Target 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe
- Size 1.6MB
- Sample240719-ek648avepc
- SHA256 96d6553cefc3e62741da5075c8cf651dbf2590bc89be0e03848bf428465525b4
- MD5 5a6277b26ac10b1c32f17a6981c00e09
- SHA1 157565cfd9a2aa677fc71000e54649618a9f2ade
- SHA512 756f551ffb22cc6ddbd8c48e52a8b3ca409fe7276b511d53e79c463fe5807f19166b8e49af916efece9f81eccd99ec69056917485f144e279bb375de9be21095
- SSDEEP 24576:oCwMV6flveP8NA2i2UtrqlcjTuZ1iuF7hEm90a6tElipicaGZak5R3115b+ZDymE:oCwhfl20CdvGi67KREYgcDj3ZbC/5J6X
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Ardamax main executable 1 IoCs
resource yara_rule behavioral2/files/0x00070000000234c7-43.dat family_ardamax - Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" lncom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" services.exe - Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run lncom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" lncom.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" services.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} lncom.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ lncom.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" lncom.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" services.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation lncom_.exe - Executes dropped EXE 5 IoCs
pid Process 3300 lncom_.exe 4064 lncom.exe 3464 CYWA.exe 2460 fservice.exe 728 services.exe - Loads dropped DLL 22 IoCs
pid Process 3300 lncom_.exe 728 services.exe 728 services.exe 728 services.exe 2460 fservice.exe 4064 lncom.exe 3464 CYWA.exe 3464 CYWA.exe 3464 CYWA.exe 3464 CYWA.exe 3464 CYWA.exe 3468 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe 3468 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe 3468 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe 4064 lncom.exe 4064 lncom.exe 728 services.exe 728 services.exe 4064 lncom.exe 4064 lncom.exe 3468 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe 3468 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe -
resource yara_rule behavioral2/files/0x00110000000234bf-23.dat upx behavioral2/memory/4064-38-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral2/memory/2460-59-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral2/memory/728-70-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral2/memory/2460-85-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral2/memory/4064-109-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral2/memory/728-113-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral2/memory/728-117-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral2/memory/728-119-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral2/memory/728-121-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral2/memory/728-123-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral2/memory/728-125-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral2/memory/728-127-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral2/memory/728-129-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral2/memory/728-131-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral2/memory/728-133-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral2/memory/728-135-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral2/memory/728-137-0x0000000000400000-0x00000000005FF000-memory.dmp upx behavioral2/memory/728-141-0x0000000000400000-0x00000000005FF000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CYWA Agent = "C:\\Windows\\SysWOW64\\28463\\CYWA.exe" CYWA.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ lncom.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ services.exe - Drops file in System32 directory 19 IoCs
description ioc Process File created C:\Windows\SysWOW64\28463\CYWA.009 CYWA.exe File opened for modification C:\Windows\SysWOW64\fservice.exe lncom.exe File created C:\Windows\SysWOW64\28463\AKV.exe lncom_.exe File opened for modification C:\Windows\SysWOW64\fservice.exe fservice.exe File created C:\Windows\SysWOW64\winkey.dll services.exe File created C:\Windows\SysWOW64\lncom.exe.bat lncom.exe File created C:\Windows\SysWOW64\lncom.exe 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe File created C:\Windows\SysWOW64\reginv.dll services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\28463 CYWA.exe File created C:\Windows\SysWOW64\28463\CYWA.001 lncom_.exe File created C:\Windows\SysWOW64\28463\CYWA.007 lncom_.exe File created C:\Windows\SysWOW64\28463\CYWA.exe lncom_.exe File created C:\Windows\SysWOW64\fservice.exe lncom.exe File created C:\Windows\SysWOW64\fservice.exe fservice.exe File created C:\Windows\SysWOW64\lncom_.exe 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe File created C:\Windows\SysWOW64\28463\CYWA.006 lncom_.exe File created C:\Windows\SysWOW64\28463\key.bin lncom_.exe File opened for modification C:\Windows\SysWOW64\28463\CYWA.009 CYWA.exe - Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\services.exe fservice.exe File opened for modification C:\Windows\services.exe fservice.exe File created C:\Windows\system\sservice.exe fservice.exe File opened for modification C:\Windows\system\sservice.exe fservice.exe File created C:\Windows\system\sservice.exe services.exe File created C:\Windows\system\sservice.exe lncom.exe File opened for modification C:\Windows\system\sservice.exe lncom.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 42 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF381ABE-751B-D899-9753-95BB4E7E793E} 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\Implemented Categories CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\InprocServer32\ = "C:\\Windows\\SysWOW64\\msvidctl.dll" CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\Programmable\ CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70A8227D-8B25-9655-9C11-AFC67A516AC5}\1.0\0\win32\ CYWA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\TypeLib CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\Version\ CYWA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\Programmable CYWA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70A8227D-8B25-9655-9C11-AFC67A516AC5}\1.0\FLAGS CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\VersionIndependentProgID\ CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF381ABE-751B-D899-9753-95BB4E7E793E}\ = "Key Change Provider Monitor" 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70A8227D-8B25-9655-9C11-AFC67A516AC5} CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70A8227D-8B25-9655-9C11-AFC67A516AC5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\\1" CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70A8227D-8B25-9655-9C11-AFC67A516AC5}\1.0\FLAGS\ CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\ = "Adajhac.Ojalive.Ogixap object" CYWA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\InprocServer32 CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\ProgID\ CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70A8227D-8B25-9655-9C11-AFC67A516AC5}\1.0\0\ CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70A8227D-8B25-9655-9C11-AFC67A516AC5}\1.0\FLAGS\ = "0" CYWA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70A8227D-8B25-9655-9C11-AFC67A516AC5}\1.0 CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70A8227D-8B25-9655-9C11-AFC67A516AC5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013" CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\TypeLib\ = "{70A8227D-8B25-9655-9C11-AFC67A516AC5}" CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\Implemented Categories\ CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70A8227D-8B25-9655-9C11-AFC67A516AC5}\ CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70A8227D-8B25-9655-9C11-AFC67A516AC5}\1.0\ CYWA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70A8227D-8B25-9655-9C11-AFC67A516AC5}\1.0\HELPDIR CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70A8227D-8B25-9655-9C11-AFC67A516AC5}\1.0\HELPDIR\ CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\TypeLib\ CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF381ABE-751B-D899-9753-95BB4E7E793E}\InProcServer32\ = "%SystemRoot%\\SysWow64\\SettingSyncCore.dll" 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F} CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70A8227D-8B25-9655-9C11-AFC67A516AC5}\1.0\ = "SyncEngineStorageProviderHandlerLibrary 1.0 Type Library" CYWA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70A8227D-8B25-9655-9C11-AFC67A516AC5}\1.0\0 CYWA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{70A8227D-8B25-9655-9C11-AFC67A516AC5}\1.0\0\win32 CYWA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\Version CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\VersionIndependentProgID\ = "BDATuner.MPEG2ComponentType" CYWA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF381ABE-751B-D899-9753-95BB4E7E793E}\InProcServer32 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF381ABE-751B-D899-9753-95BB4E7E793E}\InProcServer32\ThreadingModel = "Both" 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\InprocServer32\ CYWA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\ProgID CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\ProgID\ = "BDATuner.MPEG2ComponentType.1" CYWA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\Version\ = "1.0" CYWA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F8973902-3245-42A5-6390-C4A9460C4D0F}\VersionIndependentProgID CYWA.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe 728 services.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 3468 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3468 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe Token: 33 3464 CYWA.exe Token: SeIncBasePriorityPrivilege 3464 CYWA.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 728 services.exe 728 services.exe 3464 CYWA.exe 3464 CYWA.exe 3464 CYWA.exe 3464 CYWA.exe 3464 CYWA.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3468 wrote to memory of 3300 3468 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe 94 PID 3468 wrote to memory of 3300 3468 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe 94 PID 3468 wrote to memory of 3300 3468 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe 94 PID 3468 wrote to memory of 4064 3468 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe 95 PID 3468 wrote to memory of 4064 3468 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe 95 PID 3468 wrote to memory of 4064 3468 5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe 95 PID 3300 wrote to memory of 3464 3300 lncom_.exe 96 PID 3300 wrote to memory of 3464 3300 lncom_.exe 96 PID 3300 wrote to memory of 3464 3300 lncom_.exe 96 PID 4064 wrote to memory of 2460 4064 lncom.exe 97 PID 4064 wrote to memory of 2460 4064 lncom.exe 97 PID 4064 wrote to memory of 2460 4064 lncom.exe 97 PID 2460 wrote to memory of 728 2460 fservice.exe 98 PID 2460 wrote to memory of 728 2460 fservice.exe 98 PID 2460 wrote to memory of 728 2460 fservice.exe 98 PID 728 wrote to memory of 4564 728 services.exe 99 PID 728 wrote to memory of 4564 728 services.exe 99 PID 728 wrote to memory of 4564 728 services.exe 99 PID 728 wrote to memory of 1392 728 services.exe 100 PID 728 wrote to memory of 1392 728 services.exe 100 PID 728 wrote to memory of 1392 728 services.exe 100 PID 4564 wrote to memory of 3408 4564 NET.exe 103 PID 4564 wrote to memory of 3408 4564 NET.exe 103 PID 4564 wrote to memory of 3408 4564 NET.exe 103 PID 1392 wrote to memory of 3964 1392 NET.exe 104 PID 1392 wrote to memory of 3964 1392 NET.exe 104 PID 1392 wrote to memory of 3964 1392 NET.exe 104 PID 4064 wrote to memory of 2972 4064 lncom.exe 105 PID 4064 wrote to memory of 2972 4064 lncom.exe 105 PID 4064 wrote to memory of 2972 4064 lncom.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a6277b26ac10b1c32f17a6981c00e09_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\lncom_.exe"C:\Windows\system32\lncom_.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\28463\CYWA.exe"C:\Windows\system32\28463\CYWA.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3464
-
-
-
C:\Windows\SysWOW64\lncom.exe"C:\Windows\system32\lncom.exe"2⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\fservice.exeC:\Windows\system32\fservice.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\services.exeC:\Windows\services.exe -XP4⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\SysWOW64\NET.exeNET STOP srservice5⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP srservice6⤵PID:3408
-
-
-
C:\Windows\SysWOW64\NET.exeNET STOP navapsvc5⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP navapsvc6⤵PID:3964
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\lncom.exe.bat3⤵PID:2972
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
5Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\@D8CC.tmp
- Size 4KB
- SHA256 8aef975a94c800d0e3e4929999d05861868a7129b766315c02a48a122e3455d6
- MD5 d73d89b1ea433724795b3d2b524f596c
- SHA1 213514f48ece9f074266b122ee2d06e842871c8c
- SHA512 8b73be757ad3e0f2b29c0b130918e8f257375f9f3bf7b9609bac24b17369de2812341651547546af238936d70f38f050d6984afd16d47b467bcbba4992e42f41
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\28463\AKV.exe
- Size 457KB
- SHA256 30df6c8cbd255011d80fa6e959179d47c458bc4c4d9e78c4cf571aa611cd7d24
- MD5 97eee85d1aebf93d5d9400cb4e9c771b
- SHA1 26fa2bf5fce2d86b891ac0741a6999bff31397de
- SHA512 8cecc533c07c91c67b93a7ae46102a0aae7f4d3d88d04c250231f0bcd8e1f173daf06e94b5253a66db3f2a052c51e62154554368929294178d2b3597c1cca7e6
- SSDEEP 6144:AlgwmKd9EEU8Gk9gPD2XlL5YctZx65KSpNceZ/TyGLTz/GVfC1HK:3JEUpkWPD2XlFYct2ouNceNTLC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\28463\CYWA.001
- Size 366B
- SHA256 9e92b61ebcf0af97ac9a30dfb07d0a0037dbba2286c69d307597599ad07d9dc9
- MD5 780834ef10658023ba00cdb58f7467a2
- SHA1 bdeb37822b7d0ab0aefd4f7f7149ce55a902685a
- SHA512 1d32ce3eaf47f1b48d3ae24922a0b223cccc6e90fc89d6817c7527d09c54534db2cd67aa19a1e1b78cc2ca3f78d5cada9c62dc954823bfe7172721aca9261442
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\28463\CYWA.006
- Size 8KB
- SHA256 4530fcc91e4d0697a64f5e24d70e2b327f0acab1a9013102ff04236841c5a617
- MD5 35b24c473bdcdb4411e326c6c437e8ed
- SHA1 ec1055365bc2a66e52de2d66d24d742863c1ce3d
- SHA512 32722f1484013bbc9c1b41b3fdaf5cd244ec67facaa2232be0e90455719d664d65cae1cd670adf5c40c67f568122d910b30e3e50f7cc06b0350a6a2d34d371de
- SSDEEP 192:D/dg5cxPjOhoZHOiX+/yWDpQzWX4M1DOcQQ8OPy:W5cpOhSuK+/ynM4QfQbO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\28463\CYWA.007
- Size 5KB
- SHA256 34856528d8b7e31caa83f350bc4dbc861120dc2da822a9eb896b773bc7e1f564
- MD5 a8e19de6669e831956049685225058a8
- SHA1 6d2546d49d92b18591ad4fedbc92626686e7e979
- SHA512 5c407d4aa5731bd62c2a1756127f794382dc5e2b214298acfa68698c709fbbe3f2aa8dbdcbef02ed2a49f8f35969959946e9f727895bdca4500d16e84f4ef2e8
- SSDEEP 48:6RsQzh+o80EE/KD4XJQK5Gaayko1vmiXdjAECihnm8mMWllo0P:6RxWDMWaavoFRNsECi9mbllo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\28463\CYWA.exe
- Size 646KB
- SHA256 0fe8e3cd44a89c15dec75ff2949bac1a96e1ea7e0040f74df3230569ac9e37b0
- MD5 b863a9ac3bcdcde2fd7408944d5bf976
- SHA1 4bd106cd9aefdf2b51f91079760855e04f73f3b0
- SHA512 4b30c3b119c1e7b2747d2745b2b79c61669a33b84520b88ab54257793e3ed6e76378dea2b8ff048cb1822187ffdc20e921d658bb5b0482c23cfa7d70f4e7aa1a
- SSDEEP 12288:kv5clDBR8cpwj26MBx4iq6xGJOpqCRypiI3WOw:khODYcCC780GkpIpvW5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\28463\key.bin
- Size 105B
- SHA256 172d6f21165fb3ca925e5b000451fd8946920206f7438018c28b158b90cf5ffb
- MD5 27c90d4d9b049f4cd00f32ed1d2e5baf
- SHA1 338a3ea8f1e929d8916ece9b6e91e697eb562550
- SHA512 d73dadb3cf74c647ce5bad5b87d3fb42a212defcba8afb8cf962020b61a0369c0a2b1005797583daf1f1ae88b29b7288bc544a53d643f3519cf604aa0ffd6dae
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\lncom.exe
- Size 341KB
- SHA256 c3f506bfc80912cef87bcc5b99c06469c7325da19a6c6279f815be303349a6df
- MD5 326048283ef1d35674e9e960b5afb4b7
- SHA1 d0a18d934190acad249be51ddacf8ba19892f887
- SHA512 cd9784079585d50348223ebec2dace24e0ccb7f0602de3737ba60ff1cce6c11cb7cbf26b40f6e464ea0585a2bb21339cfdd124b3eee6718e0cbabf2d5b4542d0
- SSDEEP 6144:d36i6htdvIydnCseroPQKvU9wPhFOXQsZrPTeoHm0HhDtdT22CpuvNJSE7V1XDqo:h6/DdQHroPTAwpwXQsBPTeoG0HhDtdCg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\lncom.exe.bat
- Size 99B
- SHA256 3a57d154715459926a51a9e3925687c0c78ec9c88bc39c303b5b93385d34d67e
- MD5 1f73e450d92934cd37c041eb3f1ff51f
- SHA1 f3e9dece5d6b7d7a0e4966c16ffe31437539d4a0
- SHA512 5f982d614e54870ae3ad212f049ca3685602812c1bb066a5f6155e694adb994d6d1608ca7a25bcab605812c6e7e6b22817aaf0dba9e906787add9b0a8e3f32a5
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\lncom_.exe
- Size 783KB
- SHA256 968834342987fc86d7c3176f98b447865d1e39e3a4118bf446b0b02d37d4a038
- MD5 d357a11700e4467ec6598a6514b9fac6
- SHA1 0a54c053e05107e42d868c02d1f352b7a71445c1
- SHA512 a9c09a383135620039a85c29965567ba9717437199ef3739f70118a0d6cb1567b44383e70ef4e243c33dc4e367473eaca568c795abbe363ec1aefb712ffc56a5
- SSDEEP 12288:4EeNl0lD9B8cDwj6KmBwJyFYG/Xhj5Fb2uyIDfRAviIvCO7UtEW6DycQCtJb3Sel:MlGDQc0efFDp1F9VOvnCeVW6DJ9TSeJH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\reginv.dll
- Size 36KB
- SHA256 2200dd5f83d2fb8c5d3994206a4fa9ff34b4cbfe56ed39a9a03c954cf45d8f77
- MD5 d4a3f90e159ffbcbc4f9740de4b7f171
- SHA1 0542f5d1e2c23dca8d90766b3a8537dc3880e5c9
- SHA512 5493beb50b5f7d8ec52f32718d01696916ae173456005d0c1294ce695161ce5004aff58ee3892bf5db0f9b23720146a6d3ae8ffbcbbd81f84d894fdc8cf75a94
- SSDEEP 384:cFqS7spWkPT5NGqu1mlWVtCMv6RyZbWwANgNoUozW+51B:cFNWvT5JOCRsWwA+iUo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\winkey.dll
- Size 24KB
- SHA256 f1b2b0abe844e6ba812c7f8709a463a7f6c56fa6ac38d376a0739cc3469f795b
- MD5 43e7d9b875c921ba6be38d45540fb9dd
- SHA1 f22a73fc0d4aa3ea6c0b8f61d974b028f308acc4
- SHA512 2e74e23c0875b69b82319391c392132f28f4eb45aa412805130382498ae48969a06a2b3a7528b626fa7d7ddb6b006f19f0ef8d73cf73cb9a0c0df44a21077622
- SSDEEP 96:N29vgScOs9K2roji5OLC4PGCq2cfD78uWjJxl:N2NgHOyK2rojiyqPkx
- MD5 SHA1 SHA512 SSDEEP