Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-08-2024 22:24

General

  • Target

    a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe

  • Size

    252KB

  • MD5

    a02b961480e8b7fc9313c6e2ae480442

  • SHA1

    fa6243f289015a1a78a5fd28f3eba56d07c33f6b

  • SHA256

    be090c085eab0d51085dbb9f2db28a5f117351ebb980b372efc2ce2cf419b120

  • SHA512

    c721a7eb719be9b57716f9ab739a65cf89bf88db2681964017a41c84fc734954b1d87b30881631f355f82c2dab1dff3d209d078e490960dc0e1691c6d1505792

  • SSDEEP

    6144:b1Wj/JCXHjMc5qKeMuFFKN0jb2ZlhdBJVjY/eRUExoJyOYHB7qY8zIK0GznuAXyk:pWj

Malware Config

Signatures

  • Andromeda, Gamarue

    Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

  • Detects Andromeda payload. 2 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 29 IoCs
  • Maps connected drives based on registry 3 TTPs 58 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 58 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: MapViewOfSection 58 IoCs
  • Suspicious use of SetWindowsHookEx 30 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2396
    • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
      "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
      2⤵
      • Executes dropped EXE
      • Maps connected drives based on registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\syswow64\svchost.exe
        3⤵
        • Adds policy Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        PID:3152
    • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:4456
    • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
      "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
      2⤵
      • Executes dropped EXE
      • Maps connected drives based on registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4300
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\syswow64\svchost.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1428
    • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3468
    • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
      "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
      2⤵
      • Executes dropped EXE
      • Maps connected drives based on registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2384
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\syswow64\svchost.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4976
    • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:4996
    • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
      "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
      2⤵
      • Executes dropped EXE
      • Maps connected drives based on registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1932
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\syswow64\svchost.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:536
    • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3552
    • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
      "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
      2⤵
      • Executes dropped EXE
      • Maps connected drives based on registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3256
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\syswow64\svchost.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5076
    • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1728
    • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
      "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
      2⤵
      • Executes dropped EXE
      • Maps connected drives based on registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4748
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\syswow64\svchost.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:224
    • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3432
    • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
      "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
      2⤵
      • Executes dropped EXE
      • Maps connected drives based on registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2772
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\syswow64\svchost.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1636
    • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:636
    • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
      "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
      2⤵
      • Executes dropped EXE
      • Maps connected drives based on registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2556
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\syswow64\svchost.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4384
    • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1968
    • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
      "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
      2⤵
      • Executes dropped EXE
      • Maps connected drives based on registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:976
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\syswow64\svchost.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2576
    • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1324
    • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
      "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
      2⤵
      • Executes dropped EXE
      • Maps connected drives based on registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:744
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\syswow64\svchost.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3992
    • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3232
    • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
      "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
      2⤵
      • Executes dropped EXE
      • Maps connected drives based on registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2308
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\syswow64\svchost.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2980
    • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4668
    • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
      "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
      2⤵
      • Executes dropped EXE
      • Maps connected drives based on registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3780
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\syswow64\svchost.exe
        3⤵
          PID:4504
      • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:2528
      • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
        "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
        2⤵
        • Executes dropped EXE
        • Maps connected drives based on registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:4288
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\syswow64\svchost.exe
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3316
      • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1336
      • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
        "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
        2⤵
        • Executes dropped EXE
        • Maps connected drives based on registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:1288
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\syswow64\svchost.exe
          3⤵
            PID:1948
        • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:1916
        • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
          "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
          2⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          PID:2976
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\syswow64\svchost.exe
            3⤵
              PID:728
          • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4540
          • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
            "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
            2⤵
            • Executes dropped EXE
            • Maps connected drives based on registry
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:2240
            • C:\Windows\SysWOW64\svchost.exe
              C:\Windows\syswow64\svchost.exe
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2064
          • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
            2⤵
            • Suspicious use of SetWindowsHookEx
            PID:1744
          • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
            "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
            2⤵
            • Executes dropped EXE
            • Maps connected drives based on registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:2260
            • C:\Windows\SysWOW64\svchost.exe
              C:\Windows\syswow64\svchost.exe
              3⤵
                PID:4256
            • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
              2⤵
              • Suspicious use of SetWindowsHookEx
              PID:2568
            • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
              "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
              2⤵
              • Executes dropped EXE
              • Maps connected drives based on registry
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              PID:2220
              • C:\Windows\SysWOW64\svchost.exe
                C:\Windows\syswow64\svchost.exe
                3⤵
                • System Location Discovery: System Language Discovery
                PID:4704
            • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:764
            • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
              "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
              2⤵
              • Executes dropped EXE
              • Maps connected drives based on registry
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              PID:624
              • C:\Windows\SysWOW64\svchost.exe
                C:\Windows\syswow64\svchost.exe
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2904
            • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
              2⤵
              • Suspicious use of SetWindowsHookEx
              PID:2148
            • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
              "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
              2⤵
              • Executes dropped EXE
              • Maps connected drives based on registry
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              PID:4216
              • C:\Windows\SysWOW64\svchost.exe
                C:\Windows\syswow64\svchost.exe
                3⤵
                • System Location Discovery: System Language Discovery
                PID:4848
            • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2992
            • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
              "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
              2⤵
              • Executes dropped EXE
              • Maps connected drives based on registry
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              PID:4984
              • C:\Windows\SysWOW64\svchost.exe
                C:\Windows\syswow64\svchost.exe
                3⤵
                  PID:4272
              • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
                "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
                2⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1508
              • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
                "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
                2⤵
                • Executes dropped EXE
                • Maps connected drives based on registry
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                PID:884
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\syswow64\svchost.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4516
              • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
                "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
                2⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:416
              • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
                "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
                2⤵
                • Executes dropped EXE
                • Maps connected drives based on registry
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                PID:3028
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\syswow64\svchost.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4276
              • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
                "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
                2⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1552
              • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
                "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
                2⤵
                • Executes dropped EXE
                • Maps connected drives based on registry
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                PID:3192
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\syswow64\svchost.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:532
              • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
                "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
                2⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2604
              • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
                "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
                2⤵
                • Executes dropped EXE
                • Maps connected drives based on registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                PID:2868
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\syswow64\svchost.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4676
              • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
                "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
                2⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4476
              • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
                "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
                2⤵
                • Executes dropped EXE
                • Maps connected drives based on registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                PID:3864
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\syswow64\svchost.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:4516
              • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
                "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
                2⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1948
              • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
                "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
                2⤵
                • Executes dropped EXE
                • Maps connected drives based on registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                PID:3920
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\syswow64\svchost.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2928
              • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
                "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
                2⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1804
              • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
                "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
                2⤵
                • Executes dropped EXE
                • Maps connected drives based on registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                PID:3928
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\syswow64\svchost.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2228
              • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
                "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
                2⤵
                • Suspicious use of SetWindowsHookEx
                PID:3436
              • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
                "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
                2⤵
                • Executes dropped EXE
                • Maps connected drives based on registry
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                PID:4972
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\syswow64\svchost.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2908
              • C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
                "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
                2⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3132
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4460,i,4174666705242427184,7333705955694532165,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:8
              1⤵
                PID:2408

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Roaming\49662594\49662594.exe

                Filesize

                252KB

                MD5

                a02b961480e8b7fc9313c6e2ae480442

                SHA1

                fa6243f289015a1a78a5fd28f3eba56d07c33f6b

                SHA256

                be090c085eab0d51085dbb9f2db28a5f117351ebb980b372efc2ce2cf419b120

                SHA512

                c721a7eb719be9b57716f9ab739a65cf89bf88db2681964017a41c84fc734954b1d87b30881631f355f82c2dab1dff3d209d078e490960dc0e1691c6d1505792

              • memory/536-80-0x0000000000FC0000-0x0000000000FCE000-memory.dmp

                Filesize

                56KB

              • memory/536-79-0x0000000000FC0000-0x0000000000FCE000-memory.dmp

                Filesize

                56KB

              • memory/1428-37-0x0000000000FC0000-0x0000000000FCE000-memory.dmp

                Filesize

                56KB

              • memory/1428-34-0x0000000000FC0000-0x0000000000FCE000-memory.dmp

                Filesize

                56KB

              • memory/2384-54-0x0000000000FC0000-0x0000000000FCE000-memory.dmp

                Filesize

                56KB

              • memory/2800-4-0x0000000000400000-0x0000000000405000-memory.dmp

                Filesize

                20KB

              • memory/3152-43-0x00000000009F0000-0x00000000009F5000-memory.dmp

                Filesize

                20KB

              • memory/3152-15-0x0000000000FC0000-0x0000000000FCE000-memory.dmp

                Filesize

                56KB

              • memory/3152-12-0x0000000000FC0000-0x0000000000FCE000-memory.dmp

                Filesize

                56KB

              • memory/3152-18-0x00000000009F0000-0x00000000009F5000-memory.dmp

                Filesize

                20KB

              • memory/3468-38-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/3552-77-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/4456-44-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/4456-30-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/4456-9-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/4456-7-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/4976-60-0x0000000000FC0000-0x0000000000FCE000-memory.dmp

                Filesize

                56KB

              • memory/4976-59-0x0000000000FC0000-0x0000000000FCE000-memory.dmp

                Filesize

                56KB

              • memory/4996-64-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

              • memory/5076-98-0x0000000000FC0000-0x0000000000FCE000-memory.dmp

                Filesize

                56KB

              • memory/5076-99-0x0000000000FC0000-0x0000000000FCE000-memory.dmp

                Filesize

                56KB