Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 05:36
Static task
static1
Behavioral task
behavioral1
Sample
a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe
-
Size
544KB
-
MD5
a9c98904a888933d4d5c966f836e64d1
-
SHA1
9fd5fed2662bc04d4d4cab61a0cb1f4d79b5556f
-
SHA256
46b0d4c55924d1990478c7c8eb252731ecb8770e6bea5ad18ba8c4c6991a1473
-
SHA512
ce7514eb6dc9bc2cbc055d724409a2977e82474fefe576f0236d1ea3effa115b101c395d9d8dcd409d8ad8d4676503405e33becb368ef8d7d9c2189d5b6e21f6
-
SSDEEP
12288:AQIWT/UzJW8ivxh7vHzgryd4GT1QOoJqbbEUqe9mJd/uB28Rr8O9F8/CwM:AQI+cJHiJRTHnxhUqEhe9suB2C8O9O
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rubex.exe Set value (int) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gau5f8p1.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation gau5f8p1.exe Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe -
Executes dropped EXE 10 IoCs
pid Process 1260 gau5f8p1.exe 1128 rubex.exe 3876 2des.exe 3200 2des.exe 2468 2des.exe 4524 2des.exe 2588 2des.exe 1612 2des.exe 1360 3des.exe 2124 X -
resource yara_rule behavioral2/memory/3200-47-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/3200-50-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/3200-52-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2468-53-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/2468-59-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/2468-57-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/2468-56-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4524-68-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2588-70-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2588-71-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2588-66-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4524-65-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/4524-61-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/3200-84-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4524-90-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2588-94-0x0000000000400000-0x0000000000407000-memory.dmp upx -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 31.193.3.240 Destination IP 31.193.3.240 -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /d" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /t" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /G" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /S" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /b" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /f" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /B" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /F" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /l" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /e" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /A" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /Q" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /X" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /V" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /s" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /T" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /i" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /m" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /R" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /k" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /p" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /j" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /N" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /U" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /g" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /q" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /v" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /o" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /C" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /h" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /r" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /I" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /x" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /w" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /W" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /L" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /y" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /a" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /K" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /X" gau5f8p1.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /E" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /n" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /c" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /u" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /J" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /D" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /O" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /H" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /z" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /P" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /Y" rubex.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rubex = "C:\\Users\\Admin\\rubex.exe /M" rubex.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2des.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2des.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 4316 tasklist.exe 4688 tasklist.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 3876 set thread context of 3200 3876 2des.exe 96 PID 3876 set thread context of 2468 3876 2des.exe 98 PID 3876 set thread context of 4524 3876 2des.exe 99 PID 3876 set thread context of 2588 3876 2des.exe 100 PID 3876 set thread context of 1612 3876 2des.exe 101 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1544 1612 WerFault.exe 101 -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2des.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2des.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3des.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rubex.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2des.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gau5f8p1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1260 gau5f8p1.exe 1260 gau5f8p1.exe 1260 gau5f8p1.exe 1260 gau5f8p1.exe 2468 2des.exe 2468 2des.exe 4524 2des.exe 4524 2des.exe 1360 3des.exe 1360 3des.exe 2124 X 2124 X 1128 rubex.exe 1128 rubex.exe 1128 rubex.exe 1128 rubex.exe 2468 2des.exe 2468 2des.exe 4524 2des.exe 4524 2des.exe 1128 rubex.exe 1128 rubex.exe 1128 rubex.exe 1128 rubex.exe 1128 rubex.exe 1128 rubex.exe 1128 rubex.exe 1128 rubex.exe 2468 2des.exe 2468 2des.exe 2468 2des.exe 2468 2des.exe 2468 2des.exe 2468 2des.exe 1128 rubex.exe 1128 rubex.exe 1128 rubex.exe 1128 rubex.exe 1128 rubex.exe 1128 rubex.exe 2468 2des.exe 2468 2des.exe 1128 rubex.exe 1128 rubex.exe 2468 2des.exe 2468 2des.exe 1128 rubex.exe 1128 rubex.exe 2468 2des.exe 2468 2des.exe 1128 rubex.exe 1128 rubex.exe 1128 rubex.exe 1128 rubex.exe 2468 2des.exe 2468 2des.exe 1128 rubex.exe 1128 rubex.exe 2468 2des.exe 2468 2des.exe 1128 rubex.exe 1128 rubex.exe 2468 2des.exe 2468 2des.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 4688 tasklist.exe Token: SeDebugPrivilege 1360 3des.exe Token: SeDebugPrivilege 1360 3des.exe Token: SeShutdownPrivilege 3420 Explorer.EXE Token: SeCreatePagefilePrivilege 3420 Explorer.EXE Token: SeShutdownPrivilege 3420 Explorer.EXE Token: SeCreatePagefilePrivilege 3420 Explorer.EXE Token: SeShutdownPrivilege 3420 Explorer.EXE Token: SeCreatePagefilePrivilege 3420 Explorer.EXE Token: SeShutdownPrivilege 3420 Explorer.EXE Token: SeCreatePagefilePrivilege 3420 Explorer.EXE Token: SeDebugPrivilege 4316 tasklist.exe Token: SeShutdownPrivilege 3420 Explorer.EXE Token: SeCreatePagefilePrivilege 3420 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4440 a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe 1260 gau5f8p1.exe 3876 2des.exe 1128 rubex.exe 3200 2des.exe 2588 2des.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3420 Explorer.EXE -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 4440 wrote to memory of 1260 4440 a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe 87 PID 4440 wrote to memory of 1260 4440 a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe 87 PID 4440 wrote to memory of 1260 4440 a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe 87 PID 1260 wrote to memory of 1128 1260 gau5f8p1.exe 93 PID 1260 wrote to memory of 1128 1260 gau5f8p1.exe 93 PID 1260 wrote to memory of 1128 1260 gau5f8p1.exe 93 PID 4440 wrote to memory of 3876 4440 a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe 94 PID 4440 wrote to memory of 3876 4440 a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe 94 PID 4440 wrote to memory of 3876 4440 a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe 94 PID 1260 wrote to memory of 392 1260 gau5f8p1.exe 95 PID 1260 wrote to memory of 392 1260 gau5f8p1.exe 95 PID 1260 wrote to memory of 392 1260 gau5f8p1.exe 95 PID 3876 wrote to memory of 3200 3876 2des.exe 96 PID 3876 wrote to memory of 3200 3876 2des.exe 96 PID 3876 wrote to memory of 3200 3876 2des.exe 96 PID 3876 wrote to memory of 3200 3876 2des.exe 96 PID 3876 wrote to memory of 3200 3876 2des.exe 96 PID 3876 wrote to memory of 3200 3876 2des.exe 96 PID 3876 wrote to memory of 3200 3876 2des.exe 96 PID 3876 wrote to memory of 3200 3876 2des.exe 96 PID 3876 wrote to memory of 2468 3876 2des.exe 98 PID 3876 wrote to memory of 2468 3876 2des.exe 98 PID 3876 wrote to memory of 2468 3876 2des.exe 98 PID 3876 wrote to memory of 2468 3876 2des.exe 98 PID 3876 wrote to memory of 2468 3876 2des.exe 98 PID 3876 wrote to memory of 2468 3876 2des.exe 98 PID 3876 wrote to memory of 2468 3876 2des.exe 98 PID 3876 wrote to memory of 2468 3876 2des.exe 98 PID 3876 wrote to memory of 4524 3876 2des.exe 99 PID 3876 wrote to memory of 4524 3876 2des.exe 99 PID 3876 wrote to memory of 4524 3876 2des.exe 99 PID 3876 wrote to memory of 4524 3876 2des.exe 99 PID 3876 wrote to memory of 4524 3876 2des.exe 99 PID 3876 wrote to memory of 4524 3876 2des.exe 99 PID 3876 wrote to memory of 4524 3876 2des.exe 99 PID 3876 wrote to memory of 4524 3876 2des.exe 99 PID 3876 wrote to memory of 2588 3876 2des.exe 100 PID 3876 wrote to memory of 2588 3876 2des.exe 100 PID 3876 wrote to memory of 2588 3876 2des.exe 100 PID 3876 wrote to memory of 2588 3876 2des.exe 100 PID 3876 wrote to memory of 2588 3876 2des.exe 100 PID 3876 wrote to memory of 2588 3876 2des.exe 100 PID 3876 wrote to memory of 2588 3876 2des.exe 100 PID 3876 wrote to memory of 2588 3876 2des.exe 100 PID 3876 wrote to memory of 1612 3876 2des.exe 101 PID 3876 wrote to memory of 1612 3876 2des.exe 101 PID 3876 wrote to memory of 1612 3876 2des.exe 101 PID 3876 wrote to memory of 1612 3876 2des.exe 101 PID 392 wrote to memory of 4688 392 cmd.exe 103 PID 392 wrote to memory of 4688 392 cmd.exe 103 PID 392 wrote to memory of 4688 392 cmd.exe 103 PID 4440 wrote to memory of 1360 4440 a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe 106 PID 4440 wrote to memory of 1360 4440 a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe 106 PID 4440 wrote to memory of 1360 4440 a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe 106 PID 1360 wrote to memory of 2124 1360 3des.exe 107 PID 1360 wrote to memory of 2124 1360 3des.exe 107 PID 2124 wrote to memory of 3420 2124 X 56 PID 4440 wrote to memory of 1284 4440 a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe 109 PID 4440 wrote to memory of 1284 4440 a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe 109 PID 4440 wrote to memory of 1284 4440 a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe 109 PID 1284 wrote to memory of 4316 1284 cmd.exe 111 PID 1284 wrote to memory of 4316 1284 cmd.exe 111 PID 1284 wrote to memory of 4316 1284 cmd.exe 111
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\gau5f8p1.exeC:\Users\Admin\gau5f8p1.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\rubex.exe"C:\Users\Admin\rubex.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1128
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del gau5f8p1.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4688
-
-
-
-
C:\Users\Admin\2des.exeC:\Users\Admin\2des.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3200
-
-
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2468
-
-
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:4524
-
-
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2588
-
-
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"4⤵
- Executes dropped EXE
PID:1612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 805⤵
- Program crash
PID:1544
-
-
-
-
C:\Users\Admin\3des.exeC:\Users\Admin\3des.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\5f0d574a\X*0*bc*cf57d47*31.193.3.240:534⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2124
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del a9c98904a888933d4d5c966f836e64d1_JaffaCakes118.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1612 -ip 16121⤵PID:1180
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD5da081a5c83e9130e96acb301295bb14b
SHA14e46aa4b39ea48c86838432e2724d7d3c508ab01
SHA2567ff325379204c4ab4a2a8cd60f5299eba0582c4fe52014689fd69008d1154646
SHA51246c1c1f0121bb1cd75656461a0e8044b665dc3601a79053516f7092b8230fb08be91eca4da1933d0719a78cf91699d1f6e641d06b3f21cdc5f3d97bcc9b381e1
-
Filesize
286KB
MD5cb278b7760c080ea4f57aea471f0f674
SHA12c052b2db7a196d127c2b84b62563d0c98ec0413
SHA25674cb6a456be0e9bad997e8c97475c47ab27c40d3627484f7b38a86bd01c78930
SHA512dbdf6a95b53a53f3a3dd929e0b1d63d512c00e9d28bf2f05c3e63707f0208f4f311adc637bb97a9d05bdb6bad9d6c7021aeec8c99ffe7033212e7763d4046bd3
-
Filesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
Filesize
252KB
MD53e152747de87d4674484a003398db051
SHA182557817b08eb981afa68701092d9f6e0d71ef79
SHA2561d5897272a1b899ce244d0863e9cf743adf4a9f5838bed75b7fc6a6e31a9da3e
SHA512dd726c743cac5696bf225d4b8d5cfa7b28f218eb6e7f2325e4f75d3cc4539e417210d477bafbcd82e7eb9e7b4e8ce20ae6ad30e2e7d36d949223bed0c78dcfa7
-
Filesize
252KB
MD5085ceeb33a9cde0c83ac95b8e8def38e
SHA124e53d70d187ea4b72d7722c49454c6b2a85ac3a
SHA256c59e4c607333299a26eb90a62287ebbee9fa1ad2eb96f20092b340b13461863c
SHA512ed8fb2ce52ddbf0b800f0d5d0a3715c4df84f02548169a324d79392367176ff5e536c255dba15e4667ff91354f20f835a83cf912c963fa93bb4a40cc2ab7a3db