Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
23/07/2024, 01:40
Behavioral task
behavioral1
Sample
65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe
- Size 765KB
- Sample240723-b3teaszfrf
- SHA256 e9645314b2c109b7a990f521f949e1b9da833c1760010106670b028600a9ffca
- MD5 65a6e82237151f623b03ab3791c5767d
- SHA1 ec9dbdd6bd941257f197da0ba6421d79af6da618
- SHA512 726dfe101f73de9ea85f2d3d87d56775ed4fc0a50aa4ae630c57e4228902bd1032ab652fef666ed41741ac8b0f0aadfdde22b9d6abece1a39251f42373a3da02
- SSDEEP 12288:cfbh3edoSdPDze9LBApPsKNoeP313umLcUmyqC+N/jXI0j:GR8oYzS12PVaA3LLRHqC+ljX
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe,C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe - Checks computer location settings 2 TTPs 24 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation winupdate.exe - Executes dropped EXE 23 IoCs
pid Process 4268 winupdate.exe 220 winupdate.exe 4364 winupdate.exe 1680 winupdate.exe 3544 winupdate.exe 544 winupdate.exe 1596 winupdate.exe 4644 winupdate.exe 4160 winupdate.exe 3388 winupdate.exe 3596 winupdate.exe 1676 winupdate.exe 660 winupdate.exe 1988 winupdate.exe 1372 winupdate.exe 3428 winupdate.exe 4984 winupdate.exe 1220 winupdate.exe 3568 winupdate.exe 3500 winupdate.exe 660 winupdate.exe 1900 winupdate.exe 2860 winupdate.exe - Adds Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ClientAccess.exe = "C:\\Windows\\system32\\WINDOWS_Update\\winupdate.exe" winupdate.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\ winupdate.exe File opened for modification C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe winupdate.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winupdate.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeSecurityPrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeLoadDriverPrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeSystemProfilePrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeSystemtimePrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeBackupPrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeRestorePrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeShutdownPrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeDebugPrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeUndockPrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeManageVolumePrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeImpersonatePrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: 33 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: 34 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: 35 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: 36 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 4268 winupdate.exe Token: SeSecurityPrivilege 4268 winupdate.exe Token: SeTakeOwnershipPrivilege 4268 winupdate.exe Token: SeLoadDriverPrivilege 4268 winupdate.exe Token: SeSystemProfilePrivilege 4268 winupdate.exe Token: SeSystemtimePrivilege 4268 winupdate.exe Token: SeProfSingleProcessPrivilege 4268 winupdate.exe Token: SeIncBasePriorityPrivilege 4268 winupdate.exe Token: SeCreatePagefilePrivilege 4268 winupdate.exe Token: SeBackupPrivilege 4268 winupdate.exe Token: SeRestorePrivilege 4268 winupdate.exe Token: SeShutdownPrivilege 4268 winupdate.exe Token: SeDebugPrivilege 4268 winupdate.exe Token: SeSystemEnvironmentPrivilege 4268 winupdate.exe Token: SeChangeNotifyPrivilege 4268 winupdate.exe Token: SeRemoteShutdownPrivilege 4268 winupdate.exe Token: SeUndockPrivilege 4268 winupdate.exe Token: SeManageVolumePrivilege 4268 winupdate.exe Token: SeImpersonatePrivilege 4268 winupdate.exe Token: SeCreateGlobalPrivilege 4268 winupdate.exe Token: 33 4268 winupdate.exe Token: 34 4268 winupdate.exe Token: 35 4268 winupdate.exe Token: 36 4268 winupdate.exe Token: SeIncreaseQuotaPrivilege 220 winupdate.exe Token: SeSecurityPrivilege 220 winupdate.exe Token: SeTakeOwnershipPrivilege 220 winupdate.exe Token: SeLoadDriverPrivilege 220 winupdate.exe Token: SeSystemProfilePrivilege 220 winupdate.exe Token: SeSystemtimePrivilege 220 winupdate.exe Token: SeProfSingleProcessPrivilege 220 winupdate.exe Token: SeIncBasePriorityPrivilege 220 winupdate.exe Token: SeCreatePagefilePrivilege 220 winupdate.exe Token: SeBackupPrivilege 220 winupdate.exe Token: SeRestorePrivilege 220 winupdate.exe Token: SeShutdownPrivilege 220 winupdate.exe Token: SeDebugPrivilege 220 winupdate.exe Token: SeSystemEnvironmentPrivilege 220 winupdate.exe Token: SeChangeNotifyPrivilege 220 winupdate.exe Token: SeRemoteShutdownPrivilege 220 winupdate.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3620 wrote to memory of 4268 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe 92 PID 3620 wrote to memory of 4268 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe 92 PID 3620 wrote to memory of 4268 3620 65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe 92 PID 4268 wrote to memory of 220 4268 winupdate.exe 95 PID 4268 wrote to memory of 220 4268 winupdate.exe 95 PID 4268 wrote to memory of 220 4268 winupdate.exe 95 PID 220 wrote to memory of 4364 220 winupdate.exe 96 PID 220 wrote to memory of 4364 220 winupdate.exe 96 PID 220 wrote to memory of 4364 220 winupdate.exe 96 PID 4364 wrote to memory of 1680 4364 winupdate.exe 97 PID 4364 wrote to memory of 1680 4364 winupdate.exe 97 PID 4364 wrote to memory of 1680 4364 winupdate.exe 97 PID 1680 wrote to memory of 3544 1680 winupdate.exe 99 PID 1680 wrote to memory of 3544 1680 winupdate.exe 99 PID 1680 wrote to memory of 3544 1680 winupdate.exe 99 PID 3544 wrote to memory of 544 3544 winupdate.exe 103 PID 3544 wrote to memory of 544 3544 winupdate.exe 103 PID 3544 wrote to memory of 544 3544 winupdate.exe 103 PID 544 wrote to memory of 1596 544 winupdate.exe 104 PID 544 wrote to memory of 1596 544 winupdate.exe 104 PID 544 wrote to memory of 1596 544 winupdate.exe 104 PID 1596 wrote to memory of 4644 1596 winupdate.exe 105 PID 1596 wrote to memory of 4644 1596 winupdate.exe 105 PID 1596 wrote to memory of 4644 1596 winupdate.exe 105 PID 4644 wrote to memory of 4160 4644 winupdate.exe 106 PID 4644 wrote to memory of 4160 4644 winupdate.exe 106 PID 4644 wrote to memory of 4160 4644 winupdate.exe 106 PID 4160 wrote to memory of 3388 4160 winupdate.exe 107 PID 4160 wrote to memory of 3388 4160 winupdate.exe 107 PID 4160 wrote to memory of 3388 4160 winupdate.exe 107 PID 3388 wrote to memory of 3596 3388 winupdate.exe 109 PID 3388 wrote to memory of 3596 3388 winupdate.exe 109 PID 3388 wrote to memory of 3596 3388 winupdate.exe 109 PID 3596 wrote to memory of 1676 3596 winupdate.exe 110 PID 3596 wrote to memory of 1676 3596 winupdate.exe 110 PID 3596 wrote to memory of 1676 3596 winupdate.exe 110 PID 1676 wrote to memory of 660 1676 winupdate.exe 111 PID 1676 wrote to memory of 660 1676 winupdate.exe 111 PID 1676 wrote to memory of 660 1676 winupdate.exe 111 PID 660 wrote to memory of 1988 660 winupdate.exe 112 PID 660 wrote to memory of 1988 660 winupdate.exe 112 PID 660 wrote to memory of 1988 660 winupdate.exe 112 PID 1988 wrote to memory of 1372 1988 winupdate.exe 113 PID 1988 wrote to memory of 1372 1988 winupdate.exe 113 PID 1988 wrote to memory of 1372 1988 winupdate.exe 113 PID 1372 wrote to memory of 3428 1372 winupdate.exe 116 PID 1372 wrote to memory of 3428 1372 winupdate.exe 116 PID 1372 wrote to memory of 3428 1372 winupdate.exe 116 PID 3428 wrote to memory of 4984 3428 winupdate.exe 123 PID 3428 wrote to memory of 4984 3428 winupdate.exe 123 PID 3428 wrote to memory of 4984 3428 winupdate.exe 123 PID 4984 wrote to memory of 1220 4984 winupdate.exe 124 PID 4984 wrote to memory of 1220 4984 winupdate.exe 124 PID 4984 wrote to memory of 1220 4984 winupdate.exe 124 PID 1220 wrote to memory of 3568 1220 winupdate.exe 125 PID 1220 wrote to memory of 3568 1220 winupdate.exe 125 PID 1220 wrote to memory of 3568 1220 winupdate.exe 125 PID 3568 wrote to memory of 3500 3568 winupdate.exe 126 PID 3568 wrote to memory of 3500 3568 winupdate.exe 126 PID 3568 wrote to memory of 3500 3568 winupdate.exe 126 PID 3500 wrote to memory of 660 3500 winupdate.exe 127 PID 3500 wrote to memory of 660 3500 winupdate.exe 127 PID 3500 wrote to memory of 660 3500 winupdate.exe 127 PID 660 wrote to memory of 1900 660 winupdate.exe 128
Processes
-
C:\Users\Admin\AppData\Local\Temp\65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65a6e82237151f623b03ab3791c5767d_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"3⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"4⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"5⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"6⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"7⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"8⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"9⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"10⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"11⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"12⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"13⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"14⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"15⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"16⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"17⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"18⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"19⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"20⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"21⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"22⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"23⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:1900 -
C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe"C:\Windows\system32\WINDOWS_Update\winupdate.exe"24⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
PID:2860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\WINDOWS_Update\winupdate.exe
- Size 765KB
- SHA256 e9645314b2c109b7a990f521f949e1b9da833c1760010106670b028600a9ffca
- MD5 65a6e82237151f623b03ab3791c5767d
- SHA1 ec9dbdd6bd941257f197da0ba6421d79af6da618
- SHA512 726dfe101f73de9ea85f2d3d87d56775ed4fc0a50aa4ae630c57e4228902bd1032ab652fef666ed41741ac8b0f0aadfdde22b9d6abece1a39251f42373a3da02
- SSDEEP 12288:cfbh3edoSdPDze9LBApPsKNoeP313umLcUmyqC+N/jXI0j:GR8oYzS12PVaA3LLRHqC+ljX
- MD5 SHA1 SHA512 SSDEEP