e625fe989ea5552a851d4b3653f2ac5145fea82a3aa445634ad9f3b7d94e0f4b

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
Size

133KB
MD5

955220bd1e019cda83bfcc6d9867fee3
SHA1

d35253945001e68ab85fa1fcfc9c291dcf6d86cd
SHA256

e625fe989ea5552a851d4b3653f2ac5145fea82a3aa445634ad9f3b7d94e0f4b
SHA512

a684c887759213c3ed75da6229f6d4655053adcdc1b4ba290ae82f7259616521e2bc157a4ba1ea0be3a5e5e9110cf524d4e88245189d13e0ab0029bf69bca879
SSDEEP

3072:MVeE1KcwD9iWAPT1Ev8mXhWHIutne6pSpSfxCegt4:Bb1kWAPaEmX4H9einpTgy

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2296	51b94.exe
2712	gggg24.exe
2608	ddddy3.exe

Loads dropped DLL 14 IoCs

pid	Process
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
2296	51b94.exe
2296	51b94.exe
2296	51b94.exe
2296	51b94.exe
2296	51b94.exe
2296	51b94.exe
2296	51b94.exe
2296	51b94.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MSWINSCK.OCX	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSINET.OCX	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\51b94.exe	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gggg24.exe	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ddddy3.exe	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51b94.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gggg24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddddy3.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	gggg24.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	51b94.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	ddddy3.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\ = "Internet Control General Property Page Object"	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CurVer\ = "InetCtls.Inet.1"	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object"	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWOW64\\MSWINSCK.OCX"	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Windows\\SysWOW64\\MSINET.OCX"	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}"	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0"	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32\ThreadingModel = "Apartment"	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0"	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0"	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0\win32\ = "C:\\Windows\\SysWOW64\\MSINET.OCX"	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ = "IInet"	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\HELPDIR\	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	51b94.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\ = "0"	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1"	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0\win32	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ = "DInetEvents"	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWOW64\\MSWINSCK.OCX"	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}"	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}"	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\ = "Internet Control URL Property Page Object"	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\FLAGS	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Version	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ = "DInetEvents"	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	51b94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32	51b94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0"	51b94.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
Token: SeSystemtimePrivilege	3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
2296	51b94.exe
2296	51b94.exe
2296	51b94.exe
2712	gggg24.exe
2712	gggg24.exe
2712	gggg24.exe
2608	ddddy3.exe
2608	ddddy3.exe
2608	ddddy3.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2296	3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe	31
PID 3044 wrote to memory of 2296	3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe	31
PID 3044 wrote to memory of 2296	3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe	31
PID 3044 wrote to memory of 2296	3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe	31
PID 3044 wrote to memory of 2712	3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe	32
PID 3044 wrote to memory of 2712	3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe	32
PID 3044 wrote to memory of 2712	3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe	32
PID 3044 wrote to memory of 2712	3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe	32
PID 3044 wrote to memory of 2608	3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe	33
PID 3044 wrote to memory of 2608	3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe	33
PID 3044 wrote to memory of 2608	3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe	33
PID 3044 wrote to memory of 2608	3044	955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\955220bd1e019cda83bfcc6d9867fee3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\51b94.exe
  C:\Windows\system32\51b94.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2296
- C:\Windows\SysWOW64\gggg24.exe
  C:\Windows\system32\gggg24.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712
- C:\Windows\SysWOW64\ddddy3.exe
  C:\Windows\system32\ddddy3.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60ecc75ca8aca759d2bd3bec88959f98

SHA1
5e584f10557c1acd2f50c33e0c1b338d8c4bf600

SHA256
bb799bf2352c4397b45094b8aef2c9993688739844985387ae35caf4e39d466c

SHA512
94b64a5809b514ceafb8eded9ded307363faafbfbb708d978a8b5347c82c935600118d92236681fbedd79e17942a264dd2d9bfc5643eb5108b7c772b2912a47c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b91474681421f86e345dbddb1dcdb907

SHA1
9272049243d384d43a0c7d870fb69fb97d963415

SHA256
d1f667cd643094045cf3557d3affc0ccc90f56724ddcce6cce1b440ade06a603

SHA512
8800e62045b3e94bc4cfe6330bd690561609256f2c4ef3ada839bcb6256437828d4d4f971272eb36a6621110253b83d357784fa6a038cd9401f215c4bc89ed0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
657ff0ea220b98988b780d91fdd3e082

SHA1
c3dcccc096a897a410119081626b2910853229c1

SHA256
ae5c388a67ba3704450d00f1d379565d7535c6fb3cad2b026c6e17b4a019744f

SHA512
42292e7c9dce6271ad3382fc19bd4d1f582f9ca6860b53e93b60279b7e0130b64ab977914947a02dac51a88c2a499da833ff50d9216309655105f27f91ff0b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c96757f677a3608c858ecd4a720e5d42

SHA1
1559cde3f6d32f287312acaae8c85b3b8db0cf5a

SHA256
3205a43dd01c5a1dbe643d4ef84bfcee527a93e89d708393688864110fde6569

SHA512
2c3702f9c4c89cb4e99b03e824e71217aa5d2b0462128c03cda306e3b9f4a4a9a3a0305e1595b77011893f2c3af23995b2625ba5189f6d1c2c36fa354462edbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a8cc7632235db3db9bb49cf36ccb4ee

SHA1
e7e394fdfe287df8f91321f091e293dc37868279

SHA256
af42588762d6432fcc8db8161dd44dd59d5cf8271f1d89674bf0e1a977201e41

SHA512
0bb8cc75284dbdc94ce5bb7e68e949c03eeb1274a17fff2ff27989e2412f775c697f5e5901bfedcd762cddad90ef8daff2917eac57c69aa80d3af7ddc9e81246

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
465687c4c0bd111efc080d35520b8000

SHA1
549989c0cc2977b6e6ec2b75af1ab239d37ecbe4

SHA256
1efc4f17df0226b266dd5cdc0e448a92c038af2747cafec4c9e600e580a3e70c

SHA512
a38b067207fe24087f848247c81c686d07cb87a75ec6c1facc476d3dbb160c76cc0b923dc104282ec7038d0bb0e524bfc9a35a977b54dfe355c8637a67da16b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
676832a721f22c9574b81c1ed42afacd

SHA1
fc727282c6a44e658bf09cfb6d221b06c391bdba

SHA256
890534fde4dea448994e09458490386da7fc09e60924df56859d62b9a3c49770

SHA512
e3dd4ffc7e481766079cabf52bd4ee8227beaabf62b00f9531881888cf28878b58f99c4033c56e75928714a6595f7ca2d8c0cafd82acba2527fbb8ed2b44a07e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aef353736a74d84dc83881f388e8a0b5

SHA1
5e66a730c52649c7ef65e88a8d6d9d420c7aa861

SHA256
850f3a6e531889742a68ba30d52bdf0c575664f78cbc69805580a02de2bcbae1

SHA512
a96e0c286adcb2dc163183fe99ea4f38f4e9d848c30cac5b4ffa45a7ad6cc770edba40e289846910488b2544751431ae82c45769167d68d1a8b933e1fed59fa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1685c3249f1e7918196d102981e25142

SHA1
c652e75165d6ca1030859caf9773a5429cdb55d4

SHA256
3b377f3c060437c78382e18ec90171f40e79f3283da19ece9c7d58f394f42d37

SHA512
372b0bc1bbb4b7aaa9b01c2111598c1fdda3786fb2ade4b4895634a08a9af4a0fd78490fadbeff2f64d73eaf0538b4dd7d0ff3d178d5758ad286064470bb60e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95b38c6e37a223eb355af05bbfee2de2

SHA1
45960b2f4cea8b409c83866947e2d957a83a81a2

SHA256
ebf09b9e9a1d27de2d5a410b1ec67103a449604abfed99eccb22d6a525e87596

SHA512
4a2c004860d4be9bf3eacfad5fa2e0045a9785e9799bba42a883fd6e1d7c595849af4f256e80551d67b37804bad6f5e8ff64f8b4d615ff55145608d767291412

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4a82e648ed5b06cc4edc98dcf30e400

SHA1
bf56d12793e01eea4b92636b56afe5b74cf739ba

SHA256
10c92a87526d116cf9e9b63372c29a5b86df52323f5a59934801f5493a7e7e4a

SHA512
2d1d20ce306ef14ed10a29e0ecceb592a751268248f366d35023edc7eb717d2b73106bf33b3ee97b0a21b4b13e8c818d8fd070ef4fe107331069657771f3f30e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7781e3e72a936085fd7ba6e217e1e660

SHA1
1e20eac380c09c77ab16a17c4ef53cd347dc537d

SHA256
a893c053486fde62d0a14e65e0414bf73680f8adb81e7306561283dce6a454bb

SHA512
2ecde6fa574a1839332121e44d5c4d0b138863247735c7a9946d89899bed98d233907fc75d8bad61ac7970e93d5e6bc2f0660fcbdb2099393c91689afd86e66b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0cc74514d508bb150e23ce1bb8f9623

SHA1
3ea1927af822200a3f7ccac7d92bb575cb7dd35b

SHA256
66b3b670a98c45e1a477f9f01e8d021a7e510455a190f8326ec102878d20290c

SHA512
45cb15cb41ee36741272be36716bf3a42f3b15fe2279cc79f8ae1357aef7e93b46966bf3da54591c9fccae13221eb3d549262ea61afeaf303c77e02fa08b84b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1VX38S3F\app.286e52311fec40b5848b[1].js

Filesize
38KB

MD5
76d2c103b5d53fd3ef735734017e3297

SHA1
c50d8856a54640b7f69215bce93c61e39dba25b9

SHA256
bc602b5786d6401b7ab098b1eba98a30b9f6089f5933287f5b08fc15b9845fa5

SHA512
f47da094cb2892a065c1436bdddd2cbbba88fc2acd87322a21da9fb41b38d92be449d66b091192804dc8692c7c254a8e2588a2f0bdb5afd8aa4926ba376eba7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1VX38S3F\bullet[1]

Filesize
447B

MD5
26f971d87ca00e23bd2d064524aef838

SHA1
7440beff2f4f8fabc9315608a13bf26cabad27d9

SHA256
1d8e5fd3c1fd384c0a7507e7283c7fe8f65015e521b84569132a7eabedc9d41d

SHA512
c62eb51be301bb96c80539d66a73cd17ca2021d5d816233853a37db72e04050271e581cc99652f3d8469b390003ca6c62dad2a9d57164c620b7777ae99aa1b15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1VX38S3F\info_48[2]

Filesize
4KB

MD5
5565250fcc163aa3a79f0b746416ce69

SHA1
b97cc66471fcdee07d0ee36c7fb03f342c231f8f

SHA256
51129c6c98a82ea491f89857c31146ecec14c4af184517450a7a20c699c84859

SHA512
e60ea153b0fece4d311769391d3b763b14b9a140105a36a13dad23c2906735eaab9092236deb8c68ef078e8864d6e288bef7ef1731c1e9f1ad9b0170b95ac134

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1VX38S3F\vendor.3055c5de54d09a441f23[2].js

Filesize
145KB

MD5
1f1b574993608fde0e0cee25e6ea7ba4

SHA1
5e097456a058b2fd709eed7d7eba2551aa928fee

SHA256
0243f7f94209bc07132dddfb5ae163329ee36211326fe6257ba1f5fef1c43c44

SHA512
a2bf140ed520175e698314f8de068875a63a691aa31746a5f7592faf36d56cd9c4dd3ab2daa756ff71a7a3fcd867940099c0e2b51ab789a8eabbf1f7425e124a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BVY7RUMW\app.cf0e39aab4f35197c765f9124e761b51[1].css

Filesize
7KB

MD5
bb922d587caeec89b6ba9cb853bacb67

SHA1
03e0c25feb3e12097d5aac550525b6f5aeaf05fa

SHA256
dcc9fdc4ff4ed762c1a708cdca9d4e8d1ad94856fae572f4effb3b8c3961e801

SHA512
421a8f4b5d8753977e097ec4a30df30d8c84af8bf6c68126fd6cf12616990c0f509c7e733d1764f2809f63914bb540fc9bb8d0bc513f5620c28393e9c4956aa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BVY7RUMW\background_gradient[2]

Filesize
453B

MD5
20f0110ed5e4e0d5384a496e4880139b

SHA1
51f5fc61d8bf19100df0f8aadaa57fcd9c086255

SHA256
1471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b

SHA512
5f52c117e346111d99d3b642926139178a80b9ec03147c00e27f07aab47fe38e9319fe983444f3e0e36def1e86dd7c56c25e44b14efdc3f13b45ededa064db5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HNGGU6NJ\navcancl[1]

Filesize
2KB

MD5
4bcfe9f8db04948cddb5e31fe6a7f984

SHA1
42464c70fc16f3f361c2419751acd57d51613cdf

SHA256
bee0439fcf31de76d6e2d7fd377a24a34ac8763d5bf4114da5e1663009e24228

SHA512
bb0ef3d32310644285f4062ad5f27f30649c04c5a442361a5dbe3672bd8cb585160187070872a31d9f30b70397d81449623510365a371e73bda580e00eef0e4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7GT0RRO\ErrorPageTemplate[1]

Filesize
2KB

MD5
f4fe1cb77e758e1ba56b8a8ec20417c5

SHA1
f4eda06901edb98633a686b11d02f4925f827bf0

SHA256
8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f

SHA512
62514ab345b6648c5442200a8e9530dfb88a0355e262069e0a694289c39a4a1c06c6143e5961074bfac219949102a416c09733f24e8468984b96843dc222b436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7GT0RRO\errorPageStrings[2]

Filesize
2KB

MD5
e3e4a98353f119b80b323302f26b78fa

SHA1
20ee35a370cdd3a8a7d04b506410300fd0a6a864

SHA256
9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

SHA512
d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7GT0RRO\httpErrorPagesScripts[1]

Filesize
8KB

MD5
3f57b781cb3ef114dd0b665151571b7b

SHA1
ce6a63f996df3a1cccb81720e21204b825e0238c

SHA256
46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

SHA512
8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7GT0RRO\manifest.ec71b4bd01cda44275b3[1].js

Filesize
1KB

MD5
9652cd459742a0c1073a7e1a79a9d15f

SHA1
cebb2be90c58e1de6f28cfeb57cd76957f4527c8

SHA256
bafaa4c99eefebc2d9e96d57d9fa1d328707f7c4385181c66b7847c04152bf0c

SHA512
f38ffccfac4026c35a7f1c98b315c4807bbebf6d9e3ab95ceeba94de35494842da684eb0f4d039ff91a99a08924218c71ca528ebf1bc92cc695b62b5e9ca4269

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE9F2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEAE1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\SysWOW64\MSINET.OCX

Filesize
112KB

MD5
7bec181a21753498b6bd001c42a42722

SHA1
3249f233657dc66632c0539c47895bfcee5770cc

SHA256
73da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31

SHA512
d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc

Download Submit
C:\Windows\SysWOW64\MSWINSCK.OCX

Filesize
105KB

MD5
9484c04258830aa3c2f2a70eb041414c

SHA1
b242a4fb0e9dcf14cb51dc36027baff9a79cb823

SHA256
bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

SHA512
9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

Download Submit
\Windows\SysWOW64\51b94.exe

Filesize
29KB

MD5
3ba635ddb1d6c35919e9bbee89bef617

SHA1
a582ec789f4d55f5c368a04104e5a2cb99eec5db

SHA256
54ca4f787a2c9b89a128c560fccfd8b1400ca2d3415d11ab8c51e0fe38210cd4

SHA512
9cc5ef657bf1fef6efd2fd76f9d9ef05ae9d4b4c1a3f97018374f1fd505c1e725d0afcbf71591c896c96b35c30f4111fef8b5d2ac1d98c96ee6ffad7bfcb0f0a

Download Submit
\Windows\SysWOW64\ddddy3.exe

Filesize
9KB

MD5
51c431b2e44910a2195ae1f3939621b3

SHA1
9cc1aa3b43ba493e226dafe6b8e5ded48516d488

SHA256
8d8c0ffe5fa9902cdb63fb555a97e29bcd1bd14018dedaf0caeae7b504cdcd6e

SHA512
9989cbbfcbae46eddc5e97c17edf65074e4c9bda3b968fe7f7ba8be5cc136b8fd935f09e39e2a58f97af4793950656103da7558462b4673a139a04df3d37d2ee

Download Submit
\Windows\SysWOW64\gggg24.exe

Filesize
11KB

MD5
23d2e4ca3320b4d9165aa7b21302fdff

SHA1
a3cc522d57a6ff73c5ac4fbb8f520d696aabb385

SHA256
8626771f0b945326f86e27383815a3b0f3268855761b4b08b35b876c82749d53

SHA512
e525c2c641a1106d3450b1a1ff806aac8da96035fc91f82979c1085003404a5b889b3250ab853d62d8e3dfaaabce5863354cd6cfcced249c6081f034a66edda9

Download Submit
memory/2296-99-0x0000000005F20000-0x0000000006267000-memory.dmp

Filesize
3.3MB

Download
memory/2296-97-0x0000000005830000-0x0000000005C42000-memory.dmp

Filesize
4.1MB

Download
memory/2608-299-0x00000000059A0000-0x0000000005CE7000-memory.dmp

Filesize
3.3MB

Download
memory/2608-289-0x00000000052F0000-0x0000000005702000-memory.dmp

Filesize
4.1MB

Download
memory/2712-49-0x0000000005770000-0x0000000005AB7000-memory.dmp

Filesize
3.3MB

Download
memory/2712-47-0x0000000005030000-0x0000000005442000-memory.dmp

Filesize
4.1MB

Download