67c5cf4ef1f40ebb9e3d0d7406306e1f25227b8e4e014ec7573edb5d85df0fb4

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
Size

395KB
MD5

71999a8d62e79b89ff7a0c2df8fe9fd9
SHA1

fd91edaf9f4d280f06a017b33d00bd5dc359ee45
SHA256

67c5cf4ef1f40ebb9e3d0d7406306e1f25227b8e4e014ec7573edb5d85df0fb4
SHA512

e0ff5100fa1787b8c7194a1e2ab0140ff6cc806bfc241e8b977ed1cb4a2bb3ad2567588cb7e4d0431e08908e3028a9fa9bda7ea138cca30631e4780098fb267a
SSDEEP

12288:YYT96JJ558EHwiQLykataz+wZT0Msxyj/LErqOUW9BH:1IJJ558EHwiQLykataz+wZT0Msxyj/L

Score

10^/10

discovery evasion persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\Svcspool.exe, "	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe C:\\Windows\\system32\\pubshr.exe"	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2692	debug_71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.plu

Loads dropped DLL 2 IoCs

pid	Process
3048	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
3048	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pluto! Pager = "C:\\Users\\Admin\\AppData\\Local\\Temp\\71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe"	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Program Files (x86)\\Common Files\\Services\\SrvHandle.exe"	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ReportBootOk = "0"	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Debug\230605197.dbg	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\pubshr.exe	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Debug\230601179.dbg	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\about.htm	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Debug\230607193.dbg	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Debug\23060911.dbg	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\notepad.exe	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\url.dll	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gcc.exe	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Debug\230602136.dbg	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Debug\23060576.dbg	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\lcc.exe	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dllcache\Svcspool.exe	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\taskmgr.exe	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Debug\2306053.dbg	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Debug\230601179.dbg	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Debug\23060573.dbg	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\pluto.bmp	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\SrvHandle.exe	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Debug\230604147.dbg	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ctfmon.exe	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mspaint.exe	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Debug\230609207.dbg	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Debug\230610201.dbg	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\system32\\pluto.bmp"	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Services\Svcspool.exe	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSACCESS.EXE	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	debug_71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.plu
File opened for modification	C:\Windows\Debug\debug_71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.plu	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\Windows\setup32i.exe	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
File opened for modification	C:\Windows\notepad.exe	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	debug_71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.plu
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	csrss.exe

Enumerates system info in registry 2 TTPs 32 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Control Panel\Desktop	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "C:\\Windows\\system32\\about.htm"	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "C:\\Windows\\system32\\about.htm"	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager	winlogon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\Windows\\system32\\pluto.bmp"	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize"	winlogon.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Wow6432Node	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Wow6432Node\CLSID	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ = "My Cömputër"	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3048	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
3048	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
3048	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
3048	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
3048	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
3048	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
3048	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3048	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2912	LogonUI.exe
Token: SeShutdownPrivilege	2912	LogonUI.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3048	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3048	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
2692	debug_71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.plu
2692	debug_71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.plu

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2692	3048	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2692	3048	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2692	3048	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe	31
PID 3048 wrote to memory of 2692	3048	71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe	31
PID 2040 wrote to memory of 2912	2040	csrss.exe	37
PID 2040 wrote to memory of 2912	2040	csrss.exe	37
PID 1972 wrote to memory of 2912	1972	winlogon.exe	37
PID 1972 wrote to memory of 2912	1972	winlogon.exe	37
PID 1972 wrote to memory of 2912	1972	winlogon.exe	37
PID 2040 wrote to memory of 2912	2040	csrss.exe	37
PID 2040 wrote to memory of 2912	2040	csrss.exe	37
PID 2040 wrote to memory of 2912	2040	csrss.exe	37
PID 2040 wrote to memory of 2912	2040	csrss.exe	37
PID 2040 wrote to memory of 2912	2040	csrss.exe	37
PID 2040 wrote to memory of 2912	2040	csrss.exe	37
PID 2040 wrote to memory of 2912	2040	csrss.exe	37
PID 2040 wrote to memory of 2912	2040	csrss.exe	37

C:\Users\Admin\AppData\Local\Temp\71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\Debug\debug_71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.plu
  C:\Windows\Debug\debug_71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.plu
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2692

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1660

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\LogonUI.exe
  "LogonUI.exe" /flags:0x0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Debug\230601179.dbg

Filesize
189KB

MD5
f2c7bb8acc97f92e987a2d4087d021b1

SHA1
7eb0139d2175739b3ccb0d1110067820be6abd29

SHA256
142e1d688ef0568370c37187fd9f2351d7ddeda574f8bfa9b0fa4ef42db85aa2

SHA512
2f37a2e503cffbd7c05c7d8a125b55368ce11aad5b62f17aaac7aaf3391a6886fa6a0fd73223e9f30072419bf5762a8af7958e805a52d788ba41f61eb084bfe8

Download Submit
C:\Windows\SysWOW64\Debug\230602136.dbg

Filesize
175KB

MD5
d378bffb70923139d6a4f546864aa61c

SHA1
f00aa51c2ed8b2f656318fdc01ee1cf5441011a4

SHA256
c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102

SHA512
7c09ec193d91d3cadb7e58c634b8666d8d6243b3ee7d4d4755eeb82bac62b9508e78aa3c53106bfe72d7a437f650b29a54116663e1b4da11613a30656cccc663

Download Submit
C:\Windows\SysWOW64\Debug\230604147.dbg

Filesize
161KB

MD5
a80c173ac5c75706bb74ae4d78f2a53d

SHA1
ac4440d2d6844b624abd095fc9ece4409c2031c3

SHA256
a9bb4b452729f8b231892b41a796fb936a01c3b4af4365977f27f0d8524b3cbd

SHA512
34d12db3193b8cefba60f64a58ef38803d96078a4ad00ad6baa1baf4fedb3183d1a7f9e2a94bd81c7efdf3012d8ee6d296bfcffb62aad6e7ebce0d6bb40672a5

Download Submit
C:\Windows\SysWOW64\Debug\230605197.dbg

Filesize
222KB

MD5
545bf7eaa24a9e062857d0742ec0b28a

SHA1
d748d5b325e5dd4fadeb837a59f61e55d2636d31

SHA256
50f2abb613df4813ce74f3b0df080497f689dfcad11f0fc7cd5ea4cdaf093bdf

SHA512
b132a23f443a75deb7bd10415efb871524b63860b2eb30a198dea2f7e67a1fa3bcdc5344dc98f306c8b93452329d6422d5264c1d64a403abeaf7db1662980f1a

Download Submit
C:\Windows\SysWOW64\Debug\2306053.dbg

Filesize
6.1MB

MD5
e97295de2a9fde547feab4fe41df16ca

SHA1
de87c513e32b4b72edd990b93c8854205f634771

SHA256
0ed49ca80d2a71a7be4905a8a1042f25b0bd4f87da9c63dd8bb4949e18b51cf6

SHA512
fff1606b11932818fdb84b1706cdc7a87a7e339a172033525d695337a6bef8a8f6c4ed1648df51a9307e3c4d39b578f5a24cd56f60f10e07a91dad7bdd0c089d

Download Submit
C:\Windows\SysWOW64\Debug\23060573.dbg

Filesize
389KB

MD5
8a4883f5e7ac37444f23279239553878

SHA1
682214961228453c389854e81e6786df92bbfa67

SHA256
f318c94a46dbca88eefc3e28be51d27e5f91029dc062f56faaa995f0b5f8e518

SHA512
7f51e5278aaa5babfa8eb48fc414bf985775b39e1a94b84faffd995e82781dec87c54945edc6ae7570810c646f9f50256713d96ee7c4197a82a30e51145baa4a

Download Submit
C:\Windows\SysWOW64\Debug\230607193.dbg

Filesize
228KB

MD5
cfce4eff1d6d909ee2ea3afcb8f1e677

SHA1
f90a3a8faf91aad5beec1a363e1f90a91adc9b9b

SHA256
89dbb821bacaac09ac072dfae87db8207c696a545aa2dafa387bfc1d81b54d11

SHA512
c982c9bb9e40b928f9ee1f7efd8bdba2e66bc58193b297d5560946cc2a2d546cb64f29a3edc587808a05bbfa4ad745a9b9ed6fd5efa4e39ca3b678a565d7b38b

Download Submit
C:\Windows\SysWOW64\Debug\23060911.dbg

Filesize
13.3MB

MD5
87232c8139f1cd82a2c3e39070d30b52

SHA1
13e2beede1ab86a3a12277893570c320e375d191

SHA256
8b8ad6ac7501d2c82eca1197c0310fa306b05d313d1b75c1020bc2b2965272c9

SHA512
e0032aa0182b66e3edbb7b76dd9411a6839e10cd3749337449dedd706ec8ff387042349fbe56c9d4b76a1aa095d750b6bd5e4a180ba7c70c144bf0fe697846f0

Download Submit
C:\Windows\SysWOW64\Debug\230609207.dbg

Filesize
1.4MB

MD5
15e52f52ed2b8ed122fae897119687c4

SHA1
6e35ae1d5b6f192109d7a752acd939f5ca2b97a6

SHA256
8cfb55087fa8e4c1e7bcc580d767cf2c884c1b8c890ad240c1e7009810af6736

SHA512
338c12af5af509c19932619007ab058e0e97b65fe32609f14d29f6cc7818814dbdbb8613f81146a10a78197b3f6fbc435fab9fe1537d1eb83c30b9f4487b6aea

Download Submit
C:\Windows\SysWOW64\Debug\230610201.dbg

Filesize
19.8MB

MD5
a53cc4c0fa7da7cdc8dddf4a0e6123f9

SHA1
09aeb141350d8d3ca91ac4cf902af9d6b2de3bf9

SHA256
ead4783058efc1fca6e92266cca02ae8ab79105405775208167d280c14d98914

SHA512
32a383f768d90c1eb5ffb8fffe6810ad90d76e6c65716819d4296344b31a3858db528eebc40d0561ae2be9d5f14533ecd44a0a783164b6b57e2588788209f665

Download Submit
C:\Windows\SysWOW64\lcc.exe

Filesize
63KB

MD5
9ac7947440b292df56b33960f43c720e

SHA1
a9de002d125bebfb94557977aa469368da4f1716

SHA256
41733e46ce481dbe454ee81f9307c5fd63f594c76272d1076a5285438eb66516

SHA512
295ede2614d2eb0cb00047a79e186e13b9c64fdcfb2be29f7436bcf8fb09fcae8813f65a10a587b6cfacbe6b3e96954ea10427597f253f324eb79775ef668c60

Download Submit
\Windows\debug\debug_71999a8d62e79b89ff7a0c2df8fe9fd9_JaffaCakes118.plu

Filesize
332KB

MD5
19d7285c744fe18326a665aa33eaba35

SHA1
48366a0ee4a3fbae86771a22a350941655190fcc

SHA256
addb4e33a11d70f4add9744c95ee96f52b107ccd0f78b820e0e5d7fce95f2167

SHA512
cafcf7b960d2b6e8a3b8915074f1a88334d396b9c8d0510fa2960635c38137dd2b0635c9d47c71968cea69e6744f4630b3f2b116f432ab53e9be949bc621836e

Download Submit
memory/1660-2242-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/2912-2243-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/2912-2244-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/3048-2241-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download