Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/08/2024, 14:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe
-
Size
488KB
-
MD5
9683b5a5db7ef90997e75defa03bee46
-
SHA1
2c335dea0aec7c40365e5e7e4b392463ef667480
-
SHA256
247f07cc6c486b74c0c7af12f9b1c41385c691e77ae7c3d0c4ec0d242745d020
-
SHA512
9907e15365f968b77ced26fdd5580b255767352014bb8ac50544532b73f6bfd356af8ded60ee472e25e77d248a2017125b7cf17468ab18e31eeca3159705db86
-
SSDEEP
12288:sgHsqmAdjxORA4GTe2Pr9hroyCMJOcddfm+YPk:gqmwjfz79iSJOUYPk
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" rsgszysrbcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" rsgszysrbcq.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" luyyfk.exe -
Adds policy Run key to start application 2 TTPs 29 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skxgwkasftlqiyj = "xqeofuleshagzqcg.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\peouhsfuepeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xqeofuleshagzqcg.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skxgwkasftlqiyj = "ayrgcwsqjdbmkgxgktomf.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skxgwkasftlqiyj = "yulyskearjfoketacjc.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\peouhsfuepeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\niykduniypksnguabh.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\peouhsfuepeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yulyskearjfoketacjc.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skxgwkasftlqiyj = "niykduniypksnguabh.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\peouhsfuepeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ayrgcwsqjdbmkgxgktomf.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skxgwkasftlqiyj = "liaojcxumfcmjeucfnhe.exe" rsgszysrbcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\peouhsfuepeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yulyskearjfoketacjc.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\peouhsfuepeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liaojcxumfcmjeucfnhe.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\peouhsfuepeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liaojcxumfcmjeucfnhe.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skxgwkasftlqiyj = "ayrgcwsqjdbmkgxgktomf.exe" luyyfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run rsgszysrbcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skxgwkasftlqiyj = "liaojcxumfcmjeucfnhe.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\peouhsfuepeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ayrgcwsqjdbmkgxgktomf.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\peouhsfuepeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liaojcxumfcmjeucfnhe.exe" rsgszysrbcq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run rsgszysrbcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\peouhsfuepeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eynyqgyshxryskxcc.exe" rsgszysrbcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skxgwkasftlqiyj = "yulyskearjfoketacjc.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skxgwkasftlqiyj = "eynyqgyshxryskxcc.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\peouhsfuepeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\niykduniypksnguabh.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skxgwkasftlqiyj = "niykduniypksnguabh.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skxgwkasftlqiyj = "xqeofuleshagzqcg.exe" rsgszysrbcq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skxgwkasftlqiyj = "liaojcxumfcmjeucfnhe.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skxgwkasftlqiyj = "eynyqgyshxryskxcc.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\peouhsfuepeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eynyqgyshxryskxcc.exe" luyyfk.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" luyyfk.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" luyyfk.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" rsgszysrbcq.exe Set value (int) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" luyyfk.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation rsgszysrbcq.exe -
Executes dropped EXE 4 IoCs
pid Process 4452 rsgszysrbcq.exe 2632 luyyfk.exe 4844 luyyfk.exe 4140 rsgszysrbcq.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys luyyfk.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc luyyfk.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power luyyfk.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys luyyfk.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc luyyfk.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager luyyfk.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pgsapcriuhycti = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yulyskearjfoketacjc.exe ." luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pgsapcriuhycti = "C:\\Users\\Admin\\AppData\\Local\\Temp\\niykduniypksnguabh.exe ." luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\eynyqgyshxryskxcc = "yulyskearjfoketacjc.exe ." luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eynyqgyshxryskxcc.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "xqeofuleshagzqcg.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yulyskearjfoketacjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ayrgcwsqjdbmkgxgktomf.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pgsapcriuhycti = "xqeofuleshagzqcg.exe ." luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\eynyqgyshxryskxcc = "liaojcxumfcmjeucfnhe.exe ." rsgszysrbcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\niykduniypksnguabh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xqeofuleshagzqcg.exe ." rsgszysrbcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pgsapcriuhycti = "ayrgcwsqjdbmkgxgktomf.exe ." luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pgsapcriuhycti = "niykduniypksnguabh.exe ." luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\eynyqgyshxryskxcc = "niykduniypksnguabh.exe ." luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yulyskearjfoketacjc.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "liaojcxumfcmjeucfnhe.exe" rsgszysrbcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yulyskearjfoketacjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\niykduniypksnguabh.exe" luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liaojcxumfcmjeucfnhe.exe" luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pgsapcriuhycti = "C:\\Users\\Admin\\AppData\\Local\\Temp\\niykduniypksnguabh.exe ." rsgszysrbcq.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xqeofuleshagzqcg = "xqeofuleshagzqcg.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "ayrgcwsqjdbmkgxgktomf.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pgsapcriuhycti = "liaojcxumfcmjeucfnhe.exe ." luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xqeofuleshagzqcg = "liaojcxumfcmjeucfnhe.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yulyskearjfoketacjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ayrgcwsqjdbmkgxgktomf.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\niykduniypksnguabh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liaojcxumfcmjeucfnhe.exe ." luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xqeofuleshagzqcg = "yulyskearjfoketacjc.exe" luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\eynyqgyshxryskxcc = "liaojcxumfcmjeucfnhe.exe ." luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "xqeofuleshagzqcg.exe" luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\eynyqgyshxryskxcc = "eynyqgyshxryskxcc.exe ." luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liaojcxumfcmjeucfnhe.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yulyskearjfoketacjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liaojcxumfcmjeucfnhe.exe" luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\eynyqgyshxryskxcc = "eynyqgyshxryskxcc.exe ." luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\niykduniypksnguabh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eynyqgyshxryskxcc.exe ." luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "liaojcxumfcmjeucfnhe.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "niykduniypksnguabh.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "yulyskearjfoketacjc.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "eynyqgyshxryskxcc.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "niykduniypksnguabh.exe" luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pgsapcriuhycti = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xqeofuleshagzqcg.exe ." luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xqeofuleshagzqcg = "niykduniypksnguabh.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yulyskearjfoketacjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liaojcxumfcmjeucfnhe.exe" rsgszysrbcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pgsapcriuhycti = "eynyqgyshxryskxcc.exe ." luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yulyskearjfoketacjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liaojcxumfcmjeucfnhe.exe" luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pgsapcriuhycti = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ayrgcwsqjdbmkgxgktomf.exe ." luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pgsapcriuhycti = "yulyskearjfoketacjc.exe ." luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yulyskearjfoketacjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xqeofuleshagzqcg.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pgsapcriuhycti = "yulyskearjfoketacjc.exe ." luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "eynyqgyshxryskxcc.exe" luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\niykduniypksnguabh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yulyskearjfoketacjc.exe ." luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\eynyqgyshxryskxcc = "yulyskearjfoketacjc.exe ." luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pgsapcriuhycti = "yulyskearjfoketacjc.exe ." rsgszysrbcq.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pgsapcriuhycti = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eynyqgyshxryskxcc.exe ." luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xqeofuleshagzqcg = "eynyqgyshxryskxcc.exe" luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pgsapcriuhycti = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liaojcxumfcmjeucfnhe.exe ." luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\niykduniypksnguabh.exe" luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\eynyqgyshxryskxcc = "niykduniypksnguabh.exe ." luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\niykduniypksnguabh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ayrgcwsqjdbmkgxgktomf.exe ." luyyfk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\niykduniypksnguabh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xqeofuleshagzqcg.exe ." luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ayrgcwsqjdbmkgxgktomf.exe" luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pgsapcriuhycti = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eynyqgyshxryskxcc.exe ." rsgszysrbcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yulyskearjfoketacjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eynyqgyshxryskxcc.exe" luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\eynyqgyshxryskxcc = "eynyqgyshxryskxcc.exe ." rsgszysrbcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\niykduniypksnguabh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\liaojcxumfcmjeucfnhe.exe ." luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xqeofuleshagzqcg.exe" luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pgsapcriuhycti = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eynyqgyshxryskxcc.exe ." luyyfk.exe Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oepwkwkalxnqg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\niykduniypksnguabh.exe" luyyfk.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" luyyfk.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" luyyfk.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rsgszysrbcq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rsgszysrbcq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rsgszysrbcq.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" luyyfk.exe -
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 30 whatismyip.everdot.org 34 www.showmyipaddress.com 40 www.whatismyip.ca 45 whatismyip.everdot.org 50 www.whatismyip.ca 26 whatismyipaddress.com -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf luyyfk.exe File created C:\autorun.inf luyyfk.exe File opened for modification F:\autorun.inf luyyfk.exe File created F:\autorun.inf luyyfk.exe -
Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rqkaxspoidconkcmrbxwqg.exe rsgszysrbcq.exe File opened for modification C:\Windows\SysWOW64\skxgwkasftlqiyjmkncuhqgukcpdvasitwuxm.raq luyyfk.exe File created C:\Windows\SysWOW64\skxgwkasftlqiyjmkncuhqgukcpdvasitwuxm.raq luyyfk.exe File opened for modification C:\Windows\SysWOW64\eynyqgyshxryskxcc.exe rsgszysrbcq.exe File opened for modification C:\Windows\SysWOW64\xqeofuleshagzqcg.exe luyyfk.exe File opened for modification C:\Windows\SysWOW64\ayrgcwsqjdbmkgxgktomf.exe rsgszysrbcq.exe File opened for modification C:\Windows\SysWOW64\liaojcxumfcmjeucfnhe.exe luyyfk.exe File opened for modification C:\Windows\SysWOW64\yulyskearjfoketacjc.exe rsgszysrbcq.exe File opened for modification C:\Windows\SysWOW64\rqkaxspoidconkcmrbxwqg.exe rsgszysrbcq.exe File opened for modification C:\Windows\SysWOW64\ayrgcwsqjdbmkgxgktomf.exe rsgszysrbcq.exe File opened for modification C:\Windows\SysWOW64\ayrgcwsqjdbmkgxgktomf.exe luyyfk.exe File opened for modification C:\Windows\SysWOW64\eynyqgyshxryskxcc.exe luyyfk.exe File opened for modification C:\Windows\SysWOW64\xqeofuleshagzqcg.exe rsgszysrbcq.exe File opened for modification C:\Windows\SysWOW64\xqeofuleshagzqcg.exe rsgszysrbcq.exe File opened for modification C:\Windows\SysWOW64\ayrgcwsqjdbmkgxgktomf.exe luyyfk.exe File created C:\Windows\SysWOW64\ryaydglsuxeyfkkcphlsusxafm.rys luyyfk.exe File opened for modification C:\Windows\SysWOW64\ryaydglsuxeyfkkcphlsusxafm.rys luyyfk.exe File opened for modification C:\Windows\SysWOW64\eynyqgyshxryskxcc.exe rsgszysrbcq.exe File opened for modification C:\Windows\SysWOW64\liaojcxumfcmjeucfnhe.exe luyyfk.exe File opened for modification C:\Windows\SysWOW64\xqeofuleshagzqcg.exe luyyfk.exe File opened for modification C:\Windows\SysWOW64\niykduniypksnguabh.exe luyyfk.exe File opened for modification C:\Windows\SysWOW64\rqkaxspoidconkcmrbxwqg.exe luyyfk.exe File opened for modification C:\Windows\SysWOW64\liaojcxumfcmjeucfnhe.exe rsgszysrbcq.exe File opened for modification C:\Windows\SysWOW64\niykduniypksnguabh.exe rsgszysrbcq.exe File opened for modification C:\Windows\SysWOW64\yulyskearjfoketacjc.exe luyyfk.exe File opened for modification C:\Windows\SysWOW64\rqkaxspoidconkcmrbxwqg.exe luyyfk.exe File opened for modification C:\Windows\SysWOW64\niykduniypksnguabh.exe luyyfk.exe File opened for modification C:\Windows\SysWOW64\yulyskearjfoketacjc.exe luyyfk.exe File opened for modification C:\Windows\SysWOW64\niykduniypksnguabh.exe rsgszysrbcq.exe File opened for modification C:\Windows\SysWOW64\yulyskearjfoketacjc.exe rsgszysrbcq.exe File opened for modification C:\Windows\SysWOW64\liaojcxumfcmjeucfnhe.exe rsgszysrbcq.exe File opened for modification C:\Windows\SysWOW64\eynyqgyshxryskxcc.exe luyyfk.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ryaydglsuxeyfkkcphlsusxafm.rys luyyfk.exe File created C:\Program Files (x86)\ryaydglsuxeyfkkcphlsusxafm.rys luyyfk.exe File opened for modification C:\Program Files (x86)\skxgwkasftlqiyjmkncuhqgukcpdvasitwuxm.raq luyyfk.exe File created C:\Program Files (x86)\skxgwkasftlqiyjmkncuhqgukcpdvasitwuxm.raq luyyfk.exe -
Drops file in Windows directory 32 IoCs
description ioc Process File opened for modification C:\Windows\niykduniypksnguabh.exe luyyfk.exe File opened for modification C:\Windows\yulyskearjfoketacjc.exe luyyfk.exe File opened for modification C:\Windows\skxgwkasftlqiyjmkncuhqgukcpdvasitwuxm.raq luyyfk.exe File opened for modification C:\Windows\niykduniypksnguabh.exe luyyfk.exe File opened for modification C:\Windows\yulyskearjfoketacjc.exe luyyfk.exe File opened for modification C:\Windows\liaojcxumfcmjeucfnhe.exe luyyfk.exe File opened for modification C:\Windows\yulyskearjfoketacjc.exe rsgszysrbcq.exe File opened for modification C:\Windows\yulyskearjfoketacjc.exe rsgszysrbcq.exe File opened for modification C:\Windows\liaojcxumfcmjeucfnhe.exe rsgszysrbcq.exe File opened for modification C:\Windows\rqkaxspoidconkcmrbxwqg.exe luyyfk.exe File opened for modification C:\Windows\eynyqgyshxryskxcc.exe luyyfk.exe File opened for modification C:\Windows\xqeofuleshagzqcg.exe rsgszysrbcq.exe File opened for modification C:\Windows\rqkaxspoidconkcmrbxwqg.exe rsgszysrbcq.exe File opened for modification C:\Windows\niykduniypksnguabh.exe rsgszysrbcq.exe File opened for modification C:\Windows\ayrgcwsqjdbmkgxgktomf.exe rsgszysrbcq.exe File opened for modification C:\Windows\rqkaxspoidconkcmrbxwqg.exe luyyfk.exe File opened for modification C:\Windows\xqeofuleshagzqcg.exe rsgszysrbcq.exe File opened for modification C:\Windows\rqkaxspoidconkcmrbxwqg.exe rsgszysrbcq.exe File opened for modification C:\Windows\ayrgcwsqjdbmkgxgktomf.exe luyyfk.exe File opened for modification C:\Windows\ryaydglsuxeyfkkcphlsusxafm.rys luyyfk.exe File opened for modification C:\Windows\eynyqgyshxryskxcc.exe rsgszysrbcq.exe File opened for modification C:\Windows\xqeofuleshagzqcg.exe luyyfk.exe File opened for modification C:\Windows\xqeofuleshagzqcg.exe luyyfk.exe File opened for modification C:\Windows\ayrgcwsqjdbmkgxgktomf.exe rsgszysrbcq.exe File opened for modification C:\Windows\eynyqgyshxryskxcc.exe rsgszysrbcq.exe File opened for modification C:\Windows\liaojcxumfcmjeucfnhe.exe luyyfk.exe File opened for modification C:\Windows\ayrgcwsqjdbmkgxgktomf.exe luyyfk.exe File created C:\Windows\skxgwkasftlqiyjmkncuhqgukcpdvasitwuxm.raq luyyfk.exe File opened for modification C:\Windows\niykduniypksnguabh.exe rsgszysrbcq.exe File opened for modification C:\Windows\eynyqgyshxryskxcc.exe luyyfk.exe File created C:\Windows\ryaydglsuxeyfkkcphlsusxafm.rys luyyfk.exe File opened for modification C:\Windows\liaojcxumfcmjeucfnhe.exe rsgszysrbcq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rsgszysrbcq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language luyyfk.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2632 luyyfk.exe 2632 luyyfk.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2632 luyyfk.exe 2632 luyyfk.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2632 luyyfk.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2868 wrote to memory of 4452 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 89 PID 2868 wrote to memory of 4452 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 89 PID 2868 wrote to memory of 4452 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 89 PID 4452 wrote to memory of 2632 4452 rsgszysrbcq.exe 94 PID 4452 wrote to memory of 2632 4452 rsgszysrbcq.exe 94 PID 4452 wrote to memory of 2632 4452 rsgszysrbcq.exe 94 PID 4452 wrote to memory of 4844 4452 rsgszysrbcq.exe 95 PID 4452 wrote to memory of 4844 4452 rsgszysrbcq.exe 95 PID 4452 wrote to memory of 4844 4452 rsgszysrbcq.exe 95 PID 2868 wrote to memory of 4140 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 111 PID 2868 wrote to memory of 4140 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 111 PID 2868 wrote to memory of 4140 2868 9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe 111 -
System policy modification 1 TTPs 38 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" luyyfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rsgszysrbcq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" luyyfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" rsgszysrbcq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" luyyfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" luyyfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer luyyfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer luyyfk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rsgszysrbcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" luyyfk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9683b5a5db7ef90997e75defa03bee46_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\rsgszysrbcq.exe"C:\Users\Admin\AppData\Local\Temp\rsgszysrbcq.exe" "c:\users\admin\appdata\local\temp\9683b5a5db7ef90997e75defa03bee46_jaffacakes118.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\luyyfk.exe"C:\Users\Admin\AppData\Local\Temp\luyyfk.exe" "-C:\Users\Admin\AppData\Local\Temp\xqeofuleshagzqcg.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2632
-
-
C:\Users\Admin\AppData\Local\Temp\luyyfk.exe"C:\Users\Admin\AppData\Local\Temp\luyyfk.exe" "-C:\Users\Admin\AppData\Local\Temp\xqeofuleshagzqcg.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:4844
-
-
-
C:\Users\Admin\AppData\Local\Temp\rsgszysrbcq.exe"C:\Users\Admin\AppData\Local\Temp\rsgszysrbcq.exe" "c:\users\admin\appdata\local\temp\9683b5a5db7ef90997e75defa03bee46_jaffacakes118.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:4140
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272B
MD5772553175b1409dab9c7d5fbf12d6b43
SHA182450897b4a2bfed4d629d55e6d5608f9ec3afea
SHA256f8182c2cbfc1dfc3e9b96c7c1b238f55d7cede0b6c0c51e73ddb562f4d36645b
SHA512b07a04cc8ff3bfa87e95166582f1d40481a984f0e58796e23d4dfb632b176d12f797ecc6cb39a5b0184e0ffc492ae8c0c89397adf838eebda5f7ef1212e91075
-
Filesize
272B
MD509fcdd33ce738806fa1d35f9e7f91ee6
SHA1af0a7a64bbb22ebd5c5d657b298f760a22a484b2
SHA256d00811e6c266e3110e43284a3078bb8e8a7c20cb789cb554a993c676e0ebd3c4
SHA51200af288dfe1c105f769815ba708e28a6769b2fc77b1c1dde006fbc6b89cddb8ad83ce8382ebc3ecf1e605914b6b897c6855044ada8c5c705529cb8d8cce460f5
-
Filesize
272B
MD5eda4647e8002051e37923867581f1702
SHA1c0d461b9917222a80a45cfde8d35bb6cf552f253
SHA25665de3f489d016e9ef1cbc1ef90167358304471d274ad4764442b4af2c6e5ad2e
SHA51229684f615414701e573aceb9d3ca3d921acdfe8224cb86c7afb33ca086c6243200161f43eb14836af62d5e94bd7ff5e2b929d52cb0322c345412029b4523d1be
-
Filesize
272B
MD5e0abc76ecf990d677f4418b404d5c0e6
SHA1e16ffb2e3acca179ec63767ee9e2f627df072f64
SHA256ae4beece2e9d2191dc4eda0b32b71deb35298ff0946e59309124c44bb3020164
SHA512f11543ba2ee8b7c812bef49fee3f28deb727b2e0e78bdf1d629b7c855fbafb28dc5ee832c7255c6d9f3110f704bb8c78e738e4548b514d8b38128d1dbb255af6
-
Filesize
272B
MD5be7666637e097e5d8d336cf612ca6d48
SHA1e0baadfeb19fff7bb5719caaaa4d323885463378
SHA256a1572c84c6c984cdda2632232649fa5e971893ecc492faa90e097c24aae63142
SHA5125f2a9bfc0eaa896090b45831bbb81fdd3e96eda16bf8f0ef4085ae340994694a95cbd202ee4b032d54e53aa3d436401667d548a4b2f1138561678cb446394ab7
-
Filesize
700KB
MD52795ef9b26d623ab0229fb1922df0f73
SHA153aec3d71346ec73ade3f2f178c5746505659a5f
SHA2567045e00e95a78430416c76cd18e187d0a08d2e958539b0bfa9ae2903f807e38a
SHA51276b9407bb958ecebce5a04d6b782b10ca6fe0ff0786feba1606800fe2b1067167900cef929f5ce73b2e5d46f3f3f3d3f9938ed1f89162bf8d3bc589b736648aa
-
Filesize
320KB
MD5b92314203327a733531042bc58e54f57
SHA11f3d0081f308a82c9659f4a57fc1ad551167a181
SHA256d936bfd3b4264fe1650dee22119858b9d0cc58598e7e956ebecf72fb82f7c7d3
SHA5122982559183e13830cd795c7badadb15b4dad50315155299d9713970aff034c827ade98c79d6da836aea743890aca71bc0f7d5348a32f2858b4f40884ecccf7f7
-
Filesize
272B
MD574f3b971c627240979f1cbf23196ab21
SHA1ff8b0a537b84df2170f516c5ff6ca197c22b6cda
SHA2563acee41f05f06fd5c86860be03706eb1d09faf380301aba0d5ba3b75de7ce127
SHA5126c90ae8f7678aed5ecda8d25e790b56903fc73037185ab6249e0f63384923607f141e4b28acdf3aac71eb2b653f805044f132d8229ab3fce8cac27c7e89bc5a8
-
Filesize
272B
MD54a4077cc33f3a05235490aaacf69725f
SHA19d1598178e5091bd52827c4e0f2506a49ee953e7
SHA25666f39961e9d517ee463636604fb5fc8769461e1f1966558134fd1ce2f282e2ff
SHA5126a0f95617a73893fbeb1b4f25b5fcd196520a4081aa6a232ef7bbc2a5d93ad0cbf08756d7592f88cfbf2b12fb8ba88da51f7ab01e425a276d2f6d6a02a909de9
-
Filesize
3KB
MD56f8928a29781985a9c661cb875559e9a
SHA12213d4ada486a2986251524588c1b397df4cd036
SHA25602c1e7e7fb01bdb547adb6b386d490ef9fc2590539d0864b83e3131cc86b2276
SHA512b3b2c954e2da1b2109b72243af0767dea0f6f6d3483fd6ba9f9ac4a9a09a0389ff7c0d771c1b706a5c00514cc77335be3b975da018d9a0b3dc486303da8432a5
-
Filesize
488KB
MD59683b5a5db7ef90997e75defa03bee46
SHA12c335dea0aec7c40365e5e7e4b392463ef667480
SHA256247f07cc6c486b74c0c7af12f9b1c41385c691e77ae7c3d0c4ec0d242745d020
SHA5129907e15365f968b77ced26fdd5580b255767352014bb8ac50544532b73f6bfd356af8ded60ee472e25e77d248a2017125b7cf17468ab18e31eeca3159705db86