Analysis
-
max time kernel
140s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 04:31
Behavioral task
behavioral1
Sample
830bab33862ef86f8ec0652d0d7d4037_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
830bab33862ef86f8ec0652d0d7d4037_JaffaCakes118.exe
-
Size
53KB
-
MD5
830bab33862ef86f8ec0652d0d7d4037
-
SHA1
5f7e3adcb35669c5d728aa66546a7fe362366d50
-
SHA256
a5edbd77f736158bb67e8dd56a7b1ab1bf9ba208985203f0cf02ec7c0f46eaa0
-
SHA512
95b17836223eb918815eb7f5675e6facc5a61b171d6172054961a7331b3d5b98fba3fe1f098e34a53e6b0dcfea49d55abae8776946352338ec22c64bbbaaf530
-
SSDEEP
1536:hEMZKQVbJCgIl0ePGJUkMNmWr5XL+zQTgGEc/W/:hxZKQRMmyGQ9L/W
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2520 wincom.exe -
resource yara_rule behavioral1/memory/2232-0-0x0000000013140000-0x0000000013169000-memory.dmp upx behavioral1/files/0x0008000000012119-2.dat upx behavioral1/memory/2520-3-0x0000000013140000-0x0000000013169000-memory.dmp upx behavioral1/memory/2232-5-0x0000000013140000-0x0000000013169000-memory.dmp upx behavioral1/memory/2520-6-0x0000000013140000-0x0000000013169000-memory.dmp upx behavioral1/memory/2520-23-0x0000000013140000-0x0000000013169000-memory.dmp upx behavioral1/memory/2520-701-0x0000000013140000-0x0000000013169000-memory.dmp upx -
Drops file in System32 directory 46 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low iexplore.exe File opened for modification C:\Windows\System32\config\systemprofile\Favorites\Links\desktop.ini iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 iexplore.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat IEXPLORE.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ieonline.microsoft[1] iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\Favorites\desktop.ini iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\favicon[1].ico iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatCache\Low iexplore.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ie4uinit.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch ie4uinit.exe File opened for modification C:\Windows\system32\config\systemprofile\Favorites iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~ iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~ iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{36343C3C-5088-11EF-B0EB-7699BFC84B14}.dat iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 iexplore.exe File created C:\Windows\SysWOW64\wincom.exe 830bab33862ef86f8ec0652d0d7d4037_JaffaCakes118.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\Low iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{36343C31-5088-11EF-B0EB-7699BFC84B14}.dat iexplore.exe File created C:\Windows\system32\config\systemprofile\Favorites\Links\Suggested Sites.url iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms iexplore.exe File created C:\Windows\SysWOW64\wincom.exe wincom.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized iexplore.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{36343C33-5088-11EF-B0EB-7699BFC84B14}.dat iexplore.exe File opened for modification C:\Windows\System32\config\systemprofile\Favorites\Links iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\Favorites\Links\Suggested Sites.url iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{36343C31-5088-11EF-B0EB-7699BFC84B14}.dat iexplore.exe File opened for modification C:\Windows\SysWOW64\wincom.exe 830bab33862ef86f8ec0652d0d7d4037_JaffaCakes118.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk ie4uinit.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\DNTException\Low iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 iexplore.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 830bab33862ef86f8ec0652d0d7d4037_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wincom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\LinksBar\LinksFolderMigrate = b049e9f894e4da01 iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs iexplore.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Windows\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Blocked = "2" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B4F3A835-0E21-4959-BA22-42B3008E02FF} iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Count = "2" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\Internet Explorer iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Suggested Sites iexplore.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\LinksBar\MarketingLinksMigrate = b049e9f894e4da01 iexplore.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004771a6a80a5073479e7651fa27c2ebbf00000000020000000000106600000001000020000000a16bb53bb898296ad775397e90c591c105160e183127662c381cb94987e0dbe5000000000e8000000002000020000000fd147b228953b15b20c04c935d1cfadfa4b922adee92cbbe703343d219f205181000000078bbd8ab8f4843c570b77b0877653f1c400000005aea718930ec227f49eb3cd7e94bd28ff791246ffaed2f15d6de5eb683bc8c44d07d5bcf82012c44eb98e941665b92369687979dd771c733e5da9b5d9ad7661b iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\Flags = "512" iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" iexplore.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore iexplore.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021493-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e807080005000200040020001e00370302000000e11a542af65b6546a8a3cfa9672e4291644ea2ef78b0d01189e400c04fc9e26e iexplore.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\LoadTimeArray = 00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Recovery iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5BE32CDC-2319-49F2-A4CF-4820F404DFE5}\WpadDecision = "0" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" iexplore.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e807080005000200040020001b00eb0000000000 IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-5c-ef-19-e9-1e\WpadDecision = "0" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates iexplore.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021494-0000-0000-C000-000000000046} iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\Flags = "512" iexplore.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\Flags = "1024" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Blocked = "1" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046} IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Time = e807080005000200040020001700bf03 iexplore.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\Version = "*" iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software iexplore.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe = "1" iexplore.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f018f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs iexplore.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}\Enum IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\RepService iexplore.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Flags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3024 iexplore.exe 3024 iexplore.exe 3024 iexplore.exe 3024 iexplore.exe 3024 iexplore.exe 3024 iexplore.exe 3024 iexplore.exe 3024 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3024 iexplore.exe 3024 iexplore.exe 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2520 wrote to memory of 3024 2520 wincom.exe 31 PID 2520 wrote to memory of 3024 2520 wincom.exe 31 PID 2520 wrote to memory of 3024 2520 wincom.exe 31 PID 2520 wrote to memory of 3024 2520 wincom.exe 31 PID 3024 wrote to memory of 2152 3024 iexplore.exe 32 PID 3024 wrote to memory of 2152 3024 iexplore.exe 32 PID 3024 wrote to memory of 2152 3024 iexplore.exe 32 PID 3024 wrote to memory of 2600 3024 iexplore.exe 33 PID 3024 wrote to memory of 2600 3024 iexplore.exe 33 PID 3024 wrote to memory of 2600 3024 iexplore.exe 33 PID 3024 wrote to memory of 2600 3024 iexplore.exe 33 PID 2520 wrote to memory of 3024 2520 wincom.exe 31 PID 2520 wrote to memory of 3024 2520 wincom.exe 31 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\830bab33862ef86f8ec0652d0d7d4037_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\830bab33862ef86f8ec0652d0d7d4037_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2232
-
C:\Windows\SysWOW64\wincom.exeC:\Windows\SysWOW64\wincom.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\System32\ie4uinit.exe"C:\Windows\System32\ie4uinit.exe" -ShowQLIcon3⤵
- Drops file in System32 directory
PID:2152
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:23⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2600
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5830bab33862ef86f8ec0652d0d7d4037
SHA15f7e3adcb35669c5d728aa66546a7fe362366d50
SHA256a5edbd77f736158bb67e8dd56a7b1ab1bf9ba208985203f0cf02ec7c0f46eaa0
SHA51295b17836223eb918815eb7f5675e6facc5a61b171d6172054961a7331b3d5b98fba3fe1f098e34a53e6b0dcfea49d55abae8776946352338ec22c64bbbaaf530
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD598b4ec5f2878b97777584331082617a1
SHA14e4c62afd33b66fda501e16d281f99e2175f75ca
SHA2560edf202e975821b51d9af03dbcc9b65997be5bb2b75bbb868fe27e947af52078
SHA5125f64420fa6c8543673e1c042eb48c0012f45936f5d3747718f4d79d916bf9785a3f1d7e4d81b2691b8c4effb2c7804a5b381efaff1c6f86fda035225f7acc803
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564dbe700ede02b463332a0e195397026
SHA1b32660bfd2512f8a16fbfb561a87c085e7d3d475
SHA256af0399d4e89f18a6852d9f861fa2cf9d258bf0c28f798fa5ec5a74825cbe6be7
SHA512c3988a3b85dcc3fdb48864117b4b13caf953b559a570a769b37d4e16765e6e52bc1d542cd70fc54e4aeabca4bbd39c76174e8b27c47e04544058e2b07fb1df6a
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514c30089af1e486e6c20cdb10416326b
SHA1e51a0cb3607c9db62b6ca04279f3183669fbc213
SHA256b6f1700d84f327a01b013abad262a26e325f402423fcc862745f97f2f07111c2
SHA512a654022ecb7deabc208bf6f9447ac1c3f7c7adc07f2a1496e8e2dffe00a4ed90d71603d52b8103ea366b3cdc07e3366a370ab1fcd159fee87094bc465016adce
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD590f8a66f763b5231995ec03df51b97ae
SHA1f654efa09aba636106b6e3342c5ecb1e39921475
SHA256e255adebebb8e3eff7ccb331cc3bb03fc71a89ea4e4ccc4c1a1ac98e6d5d6b4a
SHA512dcfc5a8074bc35c3ea56f726412cd09c3f26396a4ecb985e3e512440bbbe18a52c9d970942bf452a518e82cf5b91afa26f931f3fe8d55eb8825b0adefab65ff9
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5198b279f917a083fde8115077a03ebbe
SHA1ea52134b9d467566e241748f168f339a9508ad2f
SHA256f1279f5e0266170e76bdabfa1a83a37957b4074c0ce5e5b4cdba2b1948d8c285
SHA512c2d766297305b730d1766398b624f7424376596b3aac37fb0008a751839ab0c3872c1ec61d95f2ae1e19360728f16f0099d712c3d0c57261f8efdf7db9be7f47
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55525190408492f230b6e1a0092895026
SHA1fb5b9810837db1258b983a556bf5613c5589e177
SHA25648e5f0da4e8725103fb0fa9592cbe8e0d173df73efcd34df6b451ad9f83c1dd5
SHA512fbf6a1e5a5ed18b73ef5619b7b04700fd5f9ffbe4d4b4c4f06054c4899bf4338b328ada48e9dd1f7c5221f0306182002e0f1d5d749ef129fcdc150e488d04798
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1869a3cd3645e5cdfcd63a034a306a6
SHA12d0c18f72c0dc1cbfd0fab06bdeae6c50b135270
SHA25637beab324c7ddd1b64a72049747937028beff72c176d955a7e5ebcf032abde28
SHA51263098e10ec9002f9235082ab42edb0cbe2e27f6209df558b831bca66ee871538a9c6ed884fe0cd9206f27f8493591f319c547eeeba7dbd51b8e4e02a3ae00383
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d9dde440750795a9e70354c0a549c5a
SHA142a7e0848326ccd9552a055a551d12217daa3ebb
SHA25647bce80632384071eb64d217ed6d3a34fb012a76b8b47ef33cbadcff80f8b31a
SHA5125d56749c1275789f7ea63081613f5a2e2cc842e01e2de24ee66425241b9fdd55e48041413c83b12fa29ca361af325553bf0be605e8e9c48cb471a8665eec2554
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5143f981dd0412cdba3a854c340a74aff
SHA18d15a4f68c63f98bf5282f18bd57f20ec67b1283
SHA256ed19ca6228b474e2b7087e54a707f566540bcd7096e9e7236204d7941f8d9ae8
SHA512e1b4ec2bb3de7ab5ce18094284298d6e440621b2e4d52dd7c18cafa2a1ac4db704082dc5c7c443e3f1fb23b16645a18a2cdbeeff87268842a4692c505190a212
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9dcfac4f7a26c031a2c5ee9eb264277
SHA1dd349758a7fe7ef9c6f4e4e9d43e559dd5482f95
SHA25664f3958505b0882bc7822101efb17a6d53fb3544ae829ea2788bacad0056a847
SHA5123696395f948240d9a6dc3b1b2d22dc1417c429f8f169ce202b4fde24c6460d971be2087255f4cb21fc3f3f17288fbcf19eee9c0e549b2237c949a06ba1f14010
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd84e63d3cfa51521377e5d1383cf6ef
SHA17ce56c206e22db3185e418706199e80fe2c2e039
SHA2564bf2f9d19c679bb44b9ca8904f21cdb657f50f7645ae5b5a2e7dea2dc92c48bc
SHA51217a3ee5b2e46a0c8c57291f9ced9caf2f00fd40451bb97f6135358f6eb709c378e60f962526b460bf2d37f18d045c82c1afa9cad9be8e7e837890b1b87fe4516
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0b07b105f495f34a2ff5b283246c7cb
SHA19227bb3114eb30c42b638508dd9548ad0905bee8
SHA25622c7398e8a1df9d25fc10e2d698457ff5e6b778582dcfa8fa1b6e63b9e3d4e56
SHA512749483816832f96cbeecb9c4adf5773162c52205fca454308b4cd6ccd2b0d6a987e2c702317a659ee156307b03d6f1570f165561ce59193ed4d8ec87f210f5f6
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56051886ebb5ad07f1b38a9e496772428
SHA19d4fe2ae773dcd25f72beacae0c49d5b92b18fa4
SHA256282aa49ef595c9c533782be9da149c33c41609ccbe55912323731e1a41af4184
SHA51268c71d0ba5e29624c1964f031b48717fc580db85ffed1d7b833128ebaa0ea16dfa2bd81a7975bfdd12b90810e1572911546ce3adf3faaecf8a76337067d45d71
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c13b64d56553d2286c69413283a7a7de
SHA19a050aa184aa21ad5bf39d8db13ddb8de3564584
SHA25600032df24f8b45ce27ae42ff5c911eeae2b24fc404ae9b35d452b19e27fa05ef
SHA512dcf1f7d996e380837cb27315dc9c935e015e2c2a4e21d1163d1f25178c09dc39a9108b75c1f7253ed0af06aadfcf4f04486cae01142a9066498bef177c2f756a
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5540ade893836473b013e56088a3f1722
SHA161beafcd0405db88fa4df0c9b770a0015170d723
SHA2564cb882076e806e647644b7897936dd8d5887b751fb4bf669342dbd89f72711df
SHA5128a9a2a0daa38eb7d9a2dc1b4001f8e98232294bbd226b55fb8592e2fb8da31f0d1c1cdbe1d3883a41519805ea9c27903f8d1406e845b37bd188b4450a5bc85ca
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df3b82dee3644ec17adca63d0b3b80fa
SHA1afce624147e2a620d4c4f38e796b4f826eeb4591
SHA2560e87778c32e328f122105291a9521ed94aae03bdbcec59b9dcd2a5a85854d496
SHA51296279d8ab37c6ecf7c73ea6aab498f84018fe42e488b78ce30fe1957716ba8be8cb83fb60ce36668d991dc565f079f9f2489be192d6ac6ddc82d4dc06d4d1f5d
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8b36c769cc0279f108b51fd5be81308
SHA1e485cb6fb564ea084484309d6eb41c398715ae3d
SHA256fdbdac55c2c170b2c6d9ef66c6a7a94058731643ebd235e3b87078c59b6b2442
SHA512c9bc7f005aab084b2a6aa0006616656e115bcd7ca34fc567681a24bd0a19d08e9edb7f90440cca1bd7d78c3c6163f84a72d8f869fa6e6b5a04ab2ccdb8bb2cd3
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b82317c5198999ad09cbfab19a971a5c
SHA10b96ee0ed0b7ddcf9492ed763b0879e1767ccbe1
SHA256bdbf4e18af04a913571d107f72bd93c0bea0c6232681878909ec52cf3b3b6491
SHA5122e024641b0cb1adccc07fef4a7e2ae533d1ef23d138893b9ff43ad2db8b5b9c249b66b5e405a4aa24f942c9a09d30aea516a234e484e19a5b76958e99a63e8d0
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5680aa688065cb2af6a4e6629ebced8ba
SHA1f4695e9a5a9501af3be5b60c2dc8ce7eea6ab40d
SHA256c2858e1939d1528c1e29b8eb2862e6881095e8dc34a0d302a6d0ca8d795e5c87
SHA5123f3e04cfab2e975a416da51bbcdb3416c94d76f75000c4371164d0ec06582b70e64d24ab092a52b138bbb497cde3fcabf686dee2c2058c5ea8bac092218962cb
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5fa8d38079751bfb7ed45c94ef6e160f3
SHA14c5e6566101c97c6d809afb0245ea4d0cff3e1a0
SHA2569517659d3eb570799094e6dc9c639b31e9f72115139bb4ac5f48393a926a71e5
SHA512597709fed7eb23d4e52d22fbb586fb6cf96f7824956662fd12d963b00a6017ec9155ffe8a177ad6c6ae4047f03907f335aaa43e36d65feab12e9117fd55836b7
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
129B
MD52578ef0db08f1e1e7578068186a1be0f
SHA187dca2f554fa51a98726f0a7a9ac0120be0c4572
SHA256bdc63d9fd191114227a6e0ac32aaf4de85b91fc602fcb8555c0f3816ac8620b3
SHA512b42be0e6f438362d107f0f3a7e4809753cf3491ab15145f9ffa4def413606243f4dfffc0449687bd1bb01c653e9339e26b97c286382743d14a2f0ed52e72f7ee
-
Filesize
236B
MD511cede0563d1d61930e433cd638d6419
SHA1366b26547292482b871404b33930cefca8810dbd
SHA256e3ab045d746a0821cfb0c34aee9f98ce658caab2c99841464c68d49ab2cd85d9
SHA512d9a4cdd3d3970d1f3812f7b5d21bb9ae1f1347d0ddfe079a1b5ef15ec1367778056b64b865b21dd52692134771655461760db75309c78dc6f372cc4d0ab7c752
-
Filesize
80B
MD53c106f431417240da12fd827323b7724
SHA12345cc77576f666b812b55ea7420b8d2c4d2a0b5
SHA256e469ed17b4b54595b335dc51817a52b81fcf13aad7b7b994626f84ec097c5d57
SHA512c7391b6b9c4e00494910303e8a6c4dca5a5fc0c461047ef95e3be1c8764928af344a29e2e7c92819174894b51ae0e69b5e11a9dc7cb093f984553d34d5e737bb
-
Filesize
174B
MD51971d71c62ea75c4f433476600caa4f9
SHA1428e9b5498ba9746c123ebf3ffd86a14f73878f3
SHA2563f7e7774532126e2c175de962ce9d620471f4ac75463457e1b93ab615abd4de4
SHA51288667b670c3ffc78b442e0767ca0ea2c1409b8a2c5f18e69496831f7bfa7496e54843819fe725eda06de6deca9ba9dd769d4b5f3ade4126905ed3b1bb6f94422
-
Filesize
402B
MD5881dfac93652edb0a8228029ba92d0f5
SHA15b317253a63fecb167bf07befa05c5ed09c4ccea
SHA256a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
SHA512592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810
-
Filesize
29KB
MD5d59a6b36c5a94916241a3ead50222b6f
SHA1e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA51217012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
-
Filesize
81KB
MD5b13f51572f55a2d31ed9f266d581e9ea
SHA17eef3111b878e159e520f34410ad87adecf0ca92
SHA256725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
195B
MD5a1fd5255ed62e10721ac426cd139aa83
SHA198a11bdd942bb66e9c829ae0685239212e966b9e
SHA256d3b6eea852bacee54fbf4f3d77c6ec6d198bd59258968528a0231589f01b32f4
SHA51251399b4eac1883f0e52279f6b9943d5a626de378105cadff2b3c17473edf0835d67437ae8e8d0e25e5d4b88f924fa3ac74d808123ec2b7f98eff1b248a1ab370
-
Filesize
216B
MD52ce792bc1394673282b741a25d6148a2
SHA15835c389ea0f0c1423fa26f98b84a875a11d19b1
SHA256992031e95ad1e0f4305479e8d132c1ff14ed0eb913da33f23c576cd89f14fa48
SHA512cdcc4d9967570018ec7dc3d825ff96b4817fecfbd424d30b74ba9ab6cc16cb035434f680b3d035f7959ceb0cc9e3c56f8dc78b06adb1dd2289930cc9acc87749