Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 18:59
Static task
static1
Behavioral task
behavioral1
Sample
754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe
-
Size
496KB
-
MD5
754f4b4b8c5bf99811d763aead5814e7
-
SHA1
669f394e94610b21475651b342409864580cee84
-
SHA256
0d7c4222c0e481315f7c929b265bedb3880a97f5d741d05365078b8c3f095ff3
-
SHA512
d8ec7481c98ed73fe1b6a093e6f45142730dce811f3f530496ec0f49e0fa24436e48d6f15aa18ea7903871e79eaeaf5c5c48c5422cda526f02689be1bb014905
-
SSDEEP
12288:ZDCPENnBV5jaHBoFvZstQW012B04Ngjw5qu8jxTQlDrLOM:ZEEZBV5jCoFvZsSWG2BdN+w2+O
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" 3men.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" j29oAE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" luofol.exe -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
pid Process 1720 cmd.exe -
Executes dropped EXE 12 IoCs
pid Process 2812 j29oAE.exe 2840 luofol.exe 2672 2men.exe 2668 2men.exe 1960 2men.exe 2492 2men.exe 2968 2men.exe 2964 2men.exe 1628 3men.exe 700 3men.exe 3016 3men.exe 1512 BFB7.tmp -
Loads dropped DLL 10 IoCs
pid Process 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 2812 j29oAE.exe 2812 j29oAE.exe 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 1628 3men.exe 1628 3men.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2668-50-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1960-57-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1960-65-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1960-63-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1960-62-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1960-60-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1960-55-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2492-76-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2492-77-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2968-82-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2968-89-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2968-87-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2968-85-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2968-80-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2492-75-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2492-73-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2492-70-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2492-68-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2668-49-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2668-48-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2668-43-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2668-41-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2668-103-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2968-112-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2492-111-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1628-115-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/700-127-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1628-132-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /s" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /K" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /G" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /M" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /E" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /b" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /L" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /F" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /t" luofol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\857.exe = "C:\\Program Files (x86)\\LP\\ABD1\\857.exe" 3men.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /m" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /v" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /N" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /W" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /S" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /i" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /a" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /T" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /A" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /I" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /x" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /h" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /o" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /k" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /e" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /O" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /y" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /j" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /z" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /C" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /f" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /w" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /u" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /V" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /r" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /n" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /g" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /B" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /D" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /P" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /J" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /Q" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /q" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /H" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /l" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /U" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /c" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /X" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /Z" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /p" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /G" j29oAE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /d" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /Y" luofol.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\luofol = "C:\\Users\\Admin\\luofol.exe /R" luofol.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2men.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 2men.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2788 tasklist.exe 2276 tasklist.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 2672 set thread context of 2668 2672 2men.exe 36 PID 2672 set thread context of 1960 2672 2men.exe 37 PID 2672 set thread context of 2492 2672 2men.exe 38 PID 2672 set thread context of 2968 2672 2men.exe 39 PID 2672 set thread context of 2964 2672 2men.exe 40 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\ABD1\857.exe 3men.exe File opened for modification C:\Program Files (x86)\LP\ABD1\857.exe 3men.exe File opened for modification C:\Program Files (x86)\LP\ABD1\BFB7.tmp 3men.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3men.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2men.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3men.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language luofol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2men.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3men.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language j29oAE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2men.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2812 j29oAE.exe 2812 j29oAE.exe 1960 2men.exe 2492 2men.exe 2840 luofol.exe 2840 luofol.exe 2840 luofol.exe 1960 2men.exe 2840 luofol.exe 2492 2men.exe 2840 luofol.exe 2840 luofol.exe 2840 luofol.exe 1960 2men.exe 2840 luofol.exe 1960 2men.exe 1960 2men.exe 2840 luofol.exe 2840 luofol.exe 2840 luofol.exe 1960 2men.exe 1628 3men.exe 1628 3men.exe 1628 3men.exe 1628 3men.exe 1628 3men.exe 1628 3men.exe 1960 2men.exe 2840 luofol.exe 1960 2men.exe 2840 luofol.exe 2840 luofol.exe 1960 2men.exe 2840 luofol.exe 1960 2men.exe 2840 luofol.exe 1960 2men.exe 2840 luofol.exe 1960 2men.exe 1960 2men.exe 2840 luofol.exe 1960 2men.exe 2840 luofol.exe 1960 2men.exe 2840 luofol.exe 1960 2men.exe 2840 luofol.exe 1960 2men.exe 2840 luofol.exe 1960 2men.exe 1960 2men.exe 2840 luofol.exe 1960 2men.exe 1960 2men.exe 2840 luofol.exe 2840 luofol.exe 2840 luofol.exe 1960 2men.exe 1960 2men.exe 1960 2men.exe 1960 2men.exe 1960 2men.exe 2840 luofol.exe 1960 2men.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1640 explorer.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 2788 tasklist.exe Token: SeRestorePrivilege 2420 msiexec.exe Token: SeTakeOwnershipPrivilege 2420 msiexec.exe Token: SeSecurityPrivilege 2420 msiexec.exe Token: SeDebugPrivilege 2276 tasklist.exe Token: SeShutdownPrivilege 1640 explorer.exe Token: SeShutdownPrivilege 1640 explorer.exe Token: SeShutdownPrivilege 1640 explorer.exe Token: SeShutdownPrivilege 1640 explorer.exe Token: SeShutdownPrivilege 1640 explorer.exe Token: SeShutdownPrivilege 1640 explorer.exe Token: SeShutdownPrivilege 1640 explorer.exe Token: SeShutdownPrivilege 1640 explorer.exe Token: SeShutdownPrivilege 1640 explorer.exe Token: SeShutdownPrivilege 1640 explorer.exe Token: 33 1972 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1972 AUDIODG.EXE Token: 33 1972 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1972 AUDIODG.EXE Token: SeShutdownPrivilege 1640 explorer.exe Token: SeShutdownPrivilege 1640 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe 1640 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 2812 j29oAE.exe 2840 luofol.exe 2672 2men.exe 2668 2men.exe 2968 2men.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2812 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 29 PID 2264 wrote to memory of 2812 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 29 PID 2264 wrote to memory of 2812 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 29 PID 2264 wrote to memory of 2812 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 29 PID 2812 wrote to memory of 2840 2812 j29oAE.exe 30 PID 2812 wrote to memory of 2840 2812 j29oAE.exe 30 PID 2812 wrote to memory of 2840 2812 j29oAE.exe 30 PID 2812 wrote to memory of 2840 2812 j29oAE.exe 30 PID 2812 wrote to memory of 2188 2812 j29oAE.exe 31 PID 2812 wrote to memory of 2188 2812 j29oAE.exe 31 PID 2812 wrote to memory of 2188 2812 j29oAE.exe 31 PID 2812 wrote to memory of 2188 2812 j29oAE.exe 31 PID 2188 wrote to memory of 2788 2188 cmd.exe 33 PID 2188 wrote to memory of 2788 2188 cmd.exe 33 PID 2188 wrote to memory of 2788 2188 cmd.exe 33 PID 2188 wrote to memory of 2788 2188 cmd.exe 33 PID 2264 wrote to memory of 2672 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 35 PID 2264 wrote to memory of 2672 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 35 PID 2264 wrote to memory of 2672 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 35 PID 2264 wrote to memory of 2672 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 35 PID 2672 wrote to memory of 2668 2672 2men.exe 36 PID 2672 wrote to memory of 2668 2672 2men.exe 36 PID 2672 wrote to memory of 2668 2672 2men.exe 36 PID 2672 wrote to memory of 2668 2672 2men.exe 36 PID 2672 wrote to memory of 2668 2672 2men.exe 36 PID 2672 wrote to memory of 2668 2672 2men.exe 36 PID 2672 wrote to memory of 2668 2672 2men.exe 36 PID 2672 wrote to memory of 2668 2672 2men.exe 36 PID 2672 wrote to memory of 1960 2672 2men.exe 37 PID 2672 wrote to memory of 1960 2672 2men.exe 37 PID 2672 wrote to memory of 1960 2672 2men.exe 37 PID 2672 wrote to memory of 1960 2672 2men.exe 37 PID 2672 wrote to memory of 1960 2672 2men.exe 37 PID 2672 wrote to memory of 1960 2672 2men.exe 37 PID 2672 wrote to memory of 1960 2672 2men.exe 37 PID 2672 wrote to memory of 1960 2672 2men.exe 37 PID 2672 wrote to memory of 2492 2672 2men.exe 38 PID 2672 wrote to memory of 2492 2672 2men.exe 38 PID 2672 wrote to memory of 2492 2672 2men.exe 38 PID 2672 wrote to memory of 2492 2672 2men.exe 38 PID 2672 wrote to memory of 2492 2672 2men.exe 38 PID 2672 wrote to memory of 2492 2672 2men.exe 38 PID 2672 wrote to memory of 2492 2672 2men.exe 38 PID 2672 wrote to memory of 2492 2672 2men.exe 38 PID 2672 wrote to memory of 2968 2672 2men.exe 39 PID 2672 wrote to memory of 2968 2672 2men.exe 39 PID 2672 wrote to memory of 2968 2672 2men.exe 39 PID 2672 wrote to memory of 2968 2672 2men.exe 39 PID 2672 wrote to memory of 2968 2672 2men.exe 39 PID 2672 wrote to memory of 2968 2672 2men.exe 39 PID 2672 wrote to memory of 2968 2672 2men.exe 39 PID 2672 wrote to memory of 2968 2672 2men.exe 39 PID 2672 wrote to memory of 2964 2672 2men.exe 40 PID 2672 wrote to memory of 2964 2672 2men.exe 40 PID 2672 wrote to memory of 2964 2672 2men.exe 40 PID 2672 wrote to memory of 2964 2672 2men.exe 40 PID 2672 wrote to memory of 2964 2672 2men.exe 40 PID 2264 wrote to memory of 1628 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 42 PID 2264 wrote to memory of 1628 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 42 PID 2264 wrote to memory of 1628 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 42 PID 2264 wrote to memory of 1628 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 42 PID 2264 wrote to memory of 1720 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 44 PID 2264 wrote to memory of 1720 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 44 PID 2264 wrote to memory of 1720 2264 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe 44 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 3men.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" 3men.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\j29oAE.exeC:\Users\Admin\j29oAE.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\luofol.exe"C:\Users\Admin\luofol.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2840
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del j29oAE.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
-
-
C:\Users\Admin\2men.exeC:\Users\Admin\2men.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\2men.exe"C:\Users\Admin\2men.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2668
-
-
C:\Users\Admin\2men.exe"C:\Users\Admin\2men.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1960
-
-
C:\Users\Admin\2men.exe"C:\Users\Admin\2men.exe"3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2492
-
-
C:\Users\Admin\2men.exe"C:\Users\Admin\2men.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2968
-
-
C:\Users\Admin\2men.exe"C:\Users\Admin\2men.exe"3⤵
- Executes dropped EXE
PID:2964
-
-
-
C:\Users\Admin\3men.exeC:\Users\Admin\3men.exe2⤵
- Modifies security service
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:1628 -
C:\Users\Admin\3men.exeC:\Users\Admin\3men.exe startC:\Users\Admin\AppData\Roaming\17C24\3B0AB.exe%C:\Users\Admin\AppData\Roaming\17C243⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:700
-
-
C:\Users\Admin\3men.exeC:\Users\Admin\3men.exe startC:\Program Files (x86)\24F01\lvvm.exe%C:\Program Files (x86)\24F013⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3016
-
-
C:\Program Files (x86)\LP\ABD1\BFB7.tmp"C:\Program Files (x86)\LP\ABD1\BFB7.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1512
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 754f4b4b8c5bf99811d763aead5814e7_JaffaCakes118.exe2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1720 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1640
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5881⤵
- Suspicious use of AdjustPrivilegeToken
PID:1972
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD56b9ed8570a1857126c8bf99e0663926c
SHA194e08d8a0be09be35f37a9b17ec2130febfa2074
SHA256888e4e571a6f78ee81d94ab56bd033d413f9160f1089073176b03c91878aae2d
SHA51223211a1b71f1d05ad7f003231da826220ac4940e48071135cc3fba14708123fa0292e2e71c294a8086d8dc5f90dd32c4da3b41e6857c56f38cb325d78cb14880
-
Filesize
271KB
MD50d668203e24463de2bf228f00443b7bc
SHA1eacff981d71f6648f6315e508bfd75e11683dba8
SHA256509d530e99839d7dbc8fccac163420d9dc455fb478fa57fdec1b7a2ef629d7bc
SHA5123251bb1341bd466e71468d72723bd5cf545dbd232327f343b44c51daae8755ed3caa02f74adbb0304912769346fa90dfa4c7036c211836e5650bdb06993ba803
-
Filesize
600B
MD5191649cc578c6b4576b8582100b79a8b
SHA168c31c491a9c3c7fcab3fb0edc49eaffd7cbc286
SHA2561b17c6dd1754c9ef7dcf4bb2bb2e9667282cc3e56319ac393c90222d2ff632e4
SHA512937b4befba5f6b86bf7c9a33a95fd0961bfc9d57ca257fa84df99ec31a67783648178a6ba21994e35225502590f3112920bb604a79a6274907866771a053b024
-
Filesize
996B
MD58e74ff3b17be8742bd7d35931f8e04e2
SHA1d772df8b67b734228b7b5f0c59741d8098c53546
SHA256299ecae4ea65f1aa1a80ae08d358d449f7da5a195a568c8fbb19e460b4c42eaf
SHA5125d93f206f3c145f8065cf45e6b8ac095defd34c293d17809c3770c41a9d4777de51b9eb039491714561e55967b234fdf9a14cd48479470d08fec0bdc7d316201
-
Filesize
1KB
MD5232a13c7e445fea6d639b086baa07897
SHA19d550e14bb1fa6892f29e81318d4cebd13d06d2c
SHA256ad5d5c40936141e9ae11e6b15ec2a94a338a0b17df30b2997f69ca03c6a087d8
SHA5125985f03cc4d9de148914cd149d1f1400f2ec2b3ab18cfa36f9f65e1d5135d00ad2e6a164973352e4290919ac5296204cbcd53668eb9bbdd3482e240affa254d4
-
Filesize
176KB
MD537bfa220400174b2e1dd7a3d379a29e8
SHA1733bd24f304cfccf927a03b085d17e380122bfb3
SHA2560a74039afe046390a8a48a26cafca4b1bac986bdd8a81c8806461d0fbb61010e
SHA512d3b062db79b7e0442b9c65b434d96a17d2744be33b93938433ddfb44a7221a18cea22ff75c0dce537089730f318b37fe34f8385b61f9dcd80a9afb6cb79bc191
-
Filesize
132KB
MD5945a713b037b50442ec5d18d3dc0d55e
SHA12c8881b327a79fafcce27479b78f05487d93c802
SHA2562da470571a64bcdeb56f62c916ee2bffa87ccc6c028b7c8cb0132d09bceedd2f
SHA5120eab4bb5d04725cc20e463ae6959f71064674602f8ee7b3c9b2db75e928b9a0b1bdc94233dc261f6277d02e54a443b42a59b12aaebb8bbf243f0940344fbf385
-
Filesize
176KB
MD5c4a634088e095eab98183984bb7252d8
SHA1c205f2c1f8040c9205c6c06accd75c0396c59781
SHA256db345985313397a39cc2817134315c8db71ab4c48680e62c0358db406b0eff6a
SHA512b6a30f6d5cc30bee9b9d483629f16c80c5338360cec629f9ee2a3307b73b9743fd71396e408ac72008b84f4b8fded26002c910421853253b52b8b4d530df7a8e