39294884fcde06ac7e3bb2a9eab94ecf6e8ab5f5119e77b420a38c5cd0c634ea

Analysis

max time kernel
148s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0f6f38e4b86506db3693830c859086b_JaffaCakes118.exe
Size

168KB
MD5

b0f6f38e4b86506db3693830c859086b
SHA1

eb4a26d8fe794f5a16700d0c91def7117c4ab98c
SHA256

39294884fcde06ac7e3bb2a9eab94ecf6e8ab5f5119e77b420a38c5cd0c634ea
SHA512

c205885d3e89a5777f785e26f6e01ab6f99f050ed8170ff153fb94529505eb4464f9596f43b2e6d1e5b326e0a914267b4d39ca3b5a6f70c3564c3ab1d1d90577
SSDEEP

1536:KgIM5N4czoLRpCt98SaE4cku5V72OXZR1VuCEWWAEbIge3+T:7BeRzSaEkuj728ZR1VuzWWpF

Score

8^/10

defense_evasion discovery evasion persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3780	attrib.exe
1776	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	b0f6f38e4b86506db3693830c859086b_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	inlBF89.tmp

Executes dropped EXE 1 IoCs

pid	Process
2876	inlBF89.tmp

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inlBF89.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0f6f38e4b86506db3693830c859086b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 43 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31126346"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31126346"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3138306964"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d010e8d04af3da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31126346"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003f945ed72d44d3489ac9a36be9e2e8b1000000000200000000001066000000010000200000004e8bfd410f6bd14ed3ab3c76a12060047b557420d3ea322d2b45b675ac4f1d61000000000e80000000020000200000000c702322ba8c36d7367c79e803f70f28c34b6c7556ced482a7d464f74b5eebcd20000000c7f017b2a99c57f769c3d6bd30345648e0d301fd19d736a1a8a71c8c5ef1e97540000000bc68345177de821e45f46aa4f7681be4019f6de433a27fcd692f744cf0547a9906491f961335d5da74e40c9e764be2a608abde6be5355c16c6fd8a889af6e89e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003f945ed72d44d3489ac9a36be9e2e8b1000000000200000000001066000000010000200000001b2319148292e2d3bd54634d9763489ee5d36c1539a5ec59fd72d8baa26fd716000000000e8000000002000020000000663917c059211e1ab04ec59fba36b937872375ddbc9297430f2db1326a598cd1200000003ceea907a37356a7b93c46d2dbbc7e2b3f44a385aa052dab311941544edeb81640000000372edf2287859cb5bbdf9fa259794ec3bd8baaacafbcadf3474b428d20845b0e4d0c1fe86a4c0c9f81eed4abf6e7ba65b8bf0bf79384f3c8bcf35ff8a6195016	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E65B4F65-5F3D-11EF-9A03-D6586EC96307} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3139869633"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430955468"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3138306964"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b015efd04af3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.71628.com/?i"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.71628.com/?i"	reg.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\3.bat\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3832	b0f6f38e4b86506db3693830c859086b_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2876	inlBF89.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1948	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1948	iexplore.exe
1948	iexplore.exe
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 3316	3832	b0f6f38e4b86506db3693830c859086b_JaffaCakes118.exe	95
PID 3832 wrote to memory of 3316	3832	b0f6f38e4b86506db3693830c859086b_JaffaCakes118.exe	95
PID 3832 wrote to memory of 3316	3832	b0f6f38e4b86506db3693830c859086b_JaffaCakes118.exe	95
PID 3316 wrote to memory of 4304	3316	cmd.exe	97
PID 3316 wrote to memory of 4304	3316	cmd.exe	97
PID 3316 wrote to memory of 4304	3316	cmd.exe	97
PID 4304 wrote to memory of 1948	4304	cmd.exe	99
PID 4304 wrote to memory of 1948	4304	cmd.exe	99
PID 4304 wrote to memory of 964	4304	cmd.exe	100
PID 4304 wrote to memory of 964	4304	cmd.exe	100
PID 4304 wrote to memory of 964	4304	cmd.exe	100
PID 4304 wrote to memory of 4788	4304	cmd.exe	101
PID 4304 wrote to memory of 4788	4304	cmd.exe	101
PID 4304 wrote to memory of 4788	4304	cmd.exe	101
PID 4788 wrote to memory of 3380	4788	cmd.exe	103
PID 4788 wrote to memory of 3380	4788	cmd.exe	103
PID 4788 wrote to memory of 3380	4788	cmd.exe	103
PID 1948 wrote to memory of 1964	1948	iexplore.exe	104
PID 1948 wrote to memory of 1964	1948	iexplore.exe	104
PID 1948 wrote to memory of 1964	1948	iexplore.exe	104
PID 4788 wrote to memory of 1824	4788	cmd.exe	105
PID 4788 wrote to memory of 1824	4788	cmd.exe	105
PID 4788 wrote to memory of 1824	4788	cmd.exe	105
PID 4788 wrote to memory of 3312	4788	cmd.exe	106
PID 4788 wrote to memory of 3312	4788	cmd.exe	106
PID 4788 wrote to memory of 3312	4788	cmd.exe	106
PID 4788 wrote to memory of 4852	4788	cmd.exe	107
PID 4788 wrote to memory of 4852	4788	cmd.exe	107
PID 4788 wrote to memory of 4852	4788	cmd.exe	107
PID 4788 wrote to memory of 3844	4788	cmd.exe	109
PID 4788 wrote to memory of 3844	4788	cmd.exe	109
PID 4788 wrote to memory of 3844	4788	cmd.exe	109
PID 4788 wrote to memory of 3780	4788	cmd.exe	110
PID 4788 wrote to memory of 3780	4788	cmd.exe	110
PID 4788 wrote to memory of 3780	4788	cmd.exe	110
PID 3832 wrote to memory of 2876	3832	b0f6f38e4b86506db3693830c859086b_JaffaCakes118.exe	108
PID 3832 wrote to memory of 2876	3832	b0f6f38e4b86506db3693830c859086b_JaffaCakes118.exe	108
PID 3832 wrote to memory of 2876	3832	b0f6f38e4b86506db3693830c859086b_JaffaCakes118.exe	108
PID 4788 wrote to memory of 1776	4788	cmd.exe	111
PID 4788 wrote to memory of 1776	4788	cmd.exe	111
PID 4788 wrote to memory of 1776	4788	cmd.exe	111
PID 4788 wrote to memory of 4552	4788	cmd.exe	112
PID 4788 wrote to memory of 4552	4788	cmd.exe	112
PID 4788 wrote to memory of 4552	4788	cmd.exe	112
PID 4788 wrote to memory of 1032	4788	cmd.exe	113
PID 4788 wrote to memory of 1032	4788	cmd.exe	113
PID 4788 wrote to memory of 1032	4788	cmd.exe	113
PID 4552 wrote to memory of 4388	4552	rundll32.exe	114
PID 4552 wrote to memory of 4388	4552	rundll32.exe	114
PID 4552 wrote to memory of 4388	4552	rundll32.exe	114
PID 3832 wrote to memory of 1300	3832	b0f6f38e4b86506db3693830c859086b_JaffaCakes118.exe	115
PID 3832 wrote to memory of 1300	3832	b0f6f38e4b86506db3693830c859086b_JaffaCakes118.exe	115
PID 3832 wrote to memory of 1300	3832	b0f6f38e4b86506db3693830c859086b_JaffaCakes118.exe	115
PID 4388 wrote to memory of 1040	4388	runonce.exe	117
PID 4388 wrote to memory of 1040	4388	runonce.exe	117
PID 4388 wrote to memory of 1040	4388	runonce.exe	117
PID 2876 wrote to memory of 5084	2876	inlBF89.tmp	123
PID 2876 wrote to memory of 5084	2876	inlBF89.tmp	123
PID 2876 wrote to memory of 5084	2876	inlBF89.tmp	123

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3780	attrib.exe
1776	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b0f6f38e4b86506db3693830c859086b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b0f6f38e4b86506db3693830c859086b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\julia_fun219.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\1.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://WWw.cnkankan.com/?71628
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1948
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:17410 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1964
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\1.inf
      4⤵
      System Location Discovery: System Language Discovery
      PID:964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\2.bat
      4⤵
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4788
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?i"" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:3380
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.71628.com/?i"" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:1824
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\tmp" /v "key" /d ""http://www.71628.com/?i"" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3312
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4852
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\PPLive\3.bat""" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3844
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3780
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:1776
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\2.inf
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4552
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1040
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 D:\VolumeDH\inj.dat,MainLoad
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1032
- C:\Users\Admin\AppData\Local\Temp\inlBF89.tmp
  C:\Users\Admin\AppData\Local\Temp\inlBF89.tmp
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inlBF89.tmp > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B0F6F3~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\favicon[1].htm

Filesize
802B

MD5
b4f7d6a0d3f6605440a1f5574f90a30c

SHA1
9d91801562174d73d77f1f10a049c594f969172a

SHA256
e3b1510526757baa753c916ababce951be64146e04f74c631c6503531d83c6cd

SHA512
c852ff3b51db00184bcfb0d6609a2791cb81efdb0d8d5aaed1c5b9e576b17b19804affe6ea7b5db575179c166543db5dcd828b3fcbd90e8baabb47c166da7c3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BOIFDBOU\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\julia_fun219.bat

Filesize
53B

MD5
23962a245f75fe25510051582203aff1

SHA1
20832a3a1179bb2730194d2f7738d41d5d669a43

SHA256
1abcea214b9b2bd76cc04be07ae2d4d70371e6ca443d99f4f1327afe7a5fc647

SHA512
dc36b64f2dbb710652900a31295c148760b0c44eae13515aa29613916c9dffe3d8e55ba61568f7c27b43bf0c341f7dcd4b9c721f81627fc6bb915b15c358fe80

Download Submit
C:\Users\Admin\AppData\Local\Temp\winrar_config.tmp

Filesize
660B

MD5
d980f89e4088711df685a0aa09e8f5a7

SHA1
dde805f4fa5e016e122e4240e20ff844113717d7

SHA256
28f62bd59962d06d903ea079466c66985caa306251717235a0d470a1b0f62d09

SHA512
fa2a669d846081d71dcada405d3c4bdb92229ba2b4a9f8fd4e461d7c4d51012d3d3b893466f814c8178b9980119703d1a3f7eafeff281a2eb75465e504df9ee9

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\1.bat

Filesize
3KB

MD5
286fe459674aef6eee17f6ac79a15fdb

SHA1
233dc43099c575a67b05fc1076e676324fd6e63d

SHA256
872cc596dc1fe6d5a131129bd84c2a76d6874e9c57ab2cd792d4d12b6f014fd2

SHA512
c9acc4a134001da76e7ae6aa5ae65ce58501942dfc1f80959ae4db27c06010db753c9d115eedbe0b2b0e30dd5c4dcd1d32816493b053c65cee81d3a343c87314

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\1.inf

Filesize
492B

MD5
34c14b8530e1094e792527f7a474fe77

SHA1
f71c4e9091140256b34c18220d1dd1efab1f301d

SHA256
fe0dfb3458bfe2a3632d365e00765fa10f14d62e7dfa8b70a055c7eb9fdb6713

SHA512
25bb09b526e1e9f5c6052f1f7c36b37c956c1b5649936af8df3abfcf120c931f3d2603e17a061cb99d8c8074bfb1973a5423cce89762fca53cd46aeb3e8944a2

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\2.bat

Filesize
3KB

MD5
d4917ae9072a10d8e12ef3b282b25b3b

SHA1
bd9ec6c6395997525ec7c15ecca2f115573cc14c

SHA256
6f7649988962c61ac7644262ee6082ef352bbb00cb155a3f4ef0467fbdf1c67b

SHA512
c6ed3119e008191ad56050f6b72a2d64e908c57e80fd0c252b8b1947cf091644c83b6bc16c56d6e2153579eb3e8711c8cd608977426a0906d56a7713bfca309d

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\2.inf

Filesize
247B

MD5
ca436f6f187bc049f9271ecdcbf348fa

SHA1
bf8a548071cfc150f7affb802538edf03d281106

SHA256
6cdfa9b7f0e1e4ee16bc8ce5d7448d47ea8866c1f55f3e56be5c2a4d183ca534

SHA512
d19e20aabddad6b0284f8c1d473e9180f30b49d4d8b54f26e7c8630228e16b1f6ba04023c5e8b1993d8a10d97adcfff683b216f79b9981bf16181641aebdd591

Download Submit
C:\Users\Admin\AppData\Roaming\PPLive\4.bat

Filesize
5.8MB

MD5
ee348a4a27f2a35a1cd2293f30382e01

SHA1
036e05197cc2c1d8a44fc91a1504d3b2f6f9be98

SHA256
f0045b094189c62d2858f8f56a7ec26a1e0c02750ec9f2753c6ddab5f8037715

SHA512
d0af02b39f0a9d9a864495a3d8dde2a87b435a9b80e4fdf4dd3ced01b3836c51f94c3d7874ea74d53d8c31b5e4a84eb639d22fff64e2da32485b8545dfb90132

Download Submit
memory/1948-44-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-102-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-80-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-81-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-83-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-88-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-87-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-90-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-93-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-94-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-92-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-91-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-85-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-78-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-77-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-76-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-72-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-61-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-60-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-58-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-50-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-74-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-95-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-97-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-96-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-79-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-98-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-103-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-105-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-109-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-115-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-110-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-119-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-122-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-120-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-118-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-117-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-116-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-71-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-55-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-63-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-147-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-148-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-149-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-154-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-153-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-152-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-151-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/1948-156-0x00007FFBDF5F0000-0x00007FFBDF65E000-memory.dmp

Filesize
440KB

Download
memory/3832-137-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3832-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads