Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11-08-2024 12:12
Static task
static1
Behavioral task
behavioral1
Sample
8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe
-
Size
135KB
-
MD5
8a509e5f493cdcd4cd302e365bbf9b6b
-
SHA1
41f181bbd640cd1740dad7eb49dfd61012b71e22
-
SHA256
7a1b6a053defc0b65e2f0f41caf7c6b0d87e74e2af862c2133a804368d705679
-
SHA512
4271500e19665e0e22475171890bceea8519c207a67a6a3cdf14214a18e8ed0d57c4d137795af9b98a27879b6f8914aa33947332ada989d8f428fcb5347983a7
-
SSDEEP
3072:m2X41AbXSsQt2i8V1+6BC1u088dmX6vhcGF5d:mM41A7WteI8AnikT
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2680 51b75.exe 2540 gggg22.exe 2528 ddddy1.exe -
Loads dropped DLL 14 IoCs
pid Process 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2680 51b75.exe 2680 51b75.exe 2680 51b75.exe 2680 51b75.exe 2680 51b75.exe 2680 51b75.exe 2680 51b75.exe 2680 51b75.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\gggg22.exe 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ddddy1.exe 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSWINSCK.OCX 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSINET.OCX 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\51b75.exe 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51b75.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gggg22.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddy1.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main gggg22.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main 51b75.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main ddddy1.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0" 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908} 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1" 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\1\ = "132497" 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control 51b75.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908} 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\ = "Internet Control General Property Page Object" 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\ = "Internet Control URL Property Page Object" 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\HELPDIR 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0" 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\ = "Microsoft Internet Transfer Control, version 6.0" 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497" 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\FLAGS 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}" 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2" 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\CLSID 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib 51b75.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908} 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908} 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0" 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWOW64\\MSWINSCK.OCX" 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ProgID 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908} 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}" 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\HELPDIR\ 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908} 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID 51b75.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\ = "Microsoft Internet Transfer Control, version 6.0" 51b75.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Windows\\SysWOW64\\MSINET.OCX" 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ = "DInetEvents" 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock" 51b75.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 51b75.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSystemtimePrivilege 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe Token: SeSystemtimePrivilege 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 2680 51b75.exe 2680 51b75.exe 2680 51b75.exe 2540 gggg22.exe 2540 gggg22.exe 2540 gggg22.exe 2528 ddddy1.exe 2528 ddddy1.exe 2528 ddddy1.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2680 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 30 PID 2636 wrote to memory of 2680 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 30 PID 2636 wrote to memory of 2680 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 30 PID 2636 wrote to memory of 2680 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 30 PID 2636 wrote to memory of 2540 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 31 PID 2636 wrote to memory of 2540 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 31 PID 2636 wrote to memory of 2540 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 31 PID 2636 wrote to memory of 2540 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 31 PID 2636 wrote to memory of 2528 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 32 PID 2636 wrote to memory of 2528 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 32 PID 2636 wrote to memory of 2528 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 32 PID 2636 wrote to memory of 2528 2636 8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8a509e5f493cdcd4cd302e365bbf9b6b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\51b75.exeC:\Windows\system32\51b75.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2680
-
-
C:\Windows\SysWOW64\gggg22.exeC:\Windows\system32\gggg22.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2540
-
-
C:\Windows\SysWOW64\ddddy1.exeC:\Windows\system32\ddddy1.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2528
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UK8J8K8\httpErrorPagesScripts[1]
Filesize8KB
MD53f57b781cb3ef114dd0b665151571b7b
SHA1ce6a63f996df3a1cccb81720e21204b825e0238c
SHA25646e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA5128cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3H1FOMV1\background_gradient[2]
Filesize453B
MD520f0110ed5e4e0d5384a496e4880139b
SHA151f5fc61d8bf19100df0f8aadaa57fcd9c086255
SHA2561471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b
SHA5125f52c117e346111d99d3b642926139178a80b9ec03147c00e27f07aab47fe38e9319fe983444f3e0e36def1e86dd7c56c25e44b14efdc3f13b45ededa064db5a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3H1FOMV1\errorPageStrings[1]
Filesize2KB
MD5e3e4a98353f119b80b323302f26b78fa
SHA120ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA2569466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HTBGGANG\ErrorPageTemplate[1]
Filesize2KB
MD5f4fe1cb77e758e1ba56b8a8ec20417c5
SHA1f4eda06901edb98633a686b11d02f4925f827bf0
SHA2568d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f
SHA51262514ab345b6648c5442200a8e9530dfb88a0355e262069e0a694289c39a4a1c06c6143e5961074bfac219949102a416c09733f24e8468984b96843dc222b436
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X761FPIN\bullet[2]
Filesize447B
MD526f971d87ca00e23bd2d064524aef838
SHA17440beff2f4f8fabc9315608a13bf26cabad27d9
SHA2561d8e5fd3c1fd384c0a7507e7283c7fe8f65015e521b84569132a7eabedc9d41d
SHA512c62eb51be301bb96c80539d66a73cd17ca2021d5d816233853a37db72e04050271e581cc99652f3d8469b390003ca6c62dad2a9d57164c620b7777ae99aa1b15
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X761FPIN\info_48[2]
Filesize4KB
MD55565250fcc163aa3a79f0b746416ce69
SHA1b97cc66471fcdee07d0ee36c7fb03f342c231f8f
SHA25651129c6c98a82ea491f89857c31146ecec14c4af184517450a7a20c699c84859
SHA512e60ea153b0fece4d311769391d3b763b14b9a140105a36a13dad23c2906735eaab9092236deb8c68ef078e8864d6e288bef7ef1731c1e9f1ad9b0170b95ac134
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X761FPIN\navcancl[1]
Filesize2KB
MD54bcfe9f8db04948cddb5e31fe6a7f984
SHA142464c70fc16f3f361c2419751acd57d51613cdf
SHA256bee0439fcf31de76d6e2d7fd377a24a34ac8763d5bf4114da5e1663009e24228
SHA512bb0ef3d32310644285f4062ad5f27f30649c04c5a442361a5dbe3672bd8cb585160187070872a31d9f30b70397d81449623510365a371e73bda580e00eef0e4e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
112KB
MD57bec181a21753498b6bd001c42a42722
SHA13249f233657dc66632c0539c47895bfcee5770cc
SHA25673da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
SHA512d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
Filesize
11KB
MD52335104c8f5ad348abac3e10d634b28a
SHA10a1e126fa2d996fc7bb3c06d08d469979fb0f84f
SHA256fc189fe07991bdcc190a6cabfcb97c65776aca2797fd80b3111f75e825c1ef86
SHA512c520341d0603a53958ac7ecd4c14af8c73e937e04d9726e11f88f47a8454852014e35b9d2ab38873e97ea54f185cbce6c518cd53e2fc1c9d7df2e56a2ec1206b
-
Filesize
30KB
MD595e4be20a88aa07eaebe8f177e4e42e8
SHA1d584720ba4ccab6ff948f4ef50f5fe44ada0dfe3
SHA256f469dff77c24e0c696876c85d7b16cc3db5ce36068b368a0b8c498d330363eb9
SHA5129d06ebe0bfe25104a784c681885274485a3f0ff3962eee2cf7a7cc50afdd06da4b3ba55d071c7e1a0719a5ad579adde110e949592cc2d34ebb87d2a68ae4ed94
-
Filesize
9KB
MD513150fbcd85eb1f6a4a964746a1e353c
SHA12f2d1154cecec2d7e5eb63effb6a382d1ea7a324
SHA256c8e6f1f179ea0daea94f46a620017dbe801e5ee358c0a7cb53b177606241bc94
SHA512c53f54ede0a1697262a268f2f57aa3364d4b036e0287084c67f87532b75197091e5eac20dc62da2c419319222f083dea117c593eb94eccebaf2e3aa1480d252f