439cc725797edca03b747337a37fe8346c343595ddd13e1be24ac913bf0682fd

Analysis

max time kernel
150s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 14:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
Size

4.3MB
MD5

b3e5e6bd9c69a24ea7f9f4f9981b5c2f
SHA1

d0fd41e0e0c4163ff2243d2107e7f026150bcb29
SHA256

439cc725797edca03b747337a37fe8346c343595ddd13e1be24ac913bf0682fd
SHA512

cfb17cc0d3a22f44e312d4cf6b3475942556a34ece3ea9256c4a9903c7dba553c6db0ba06e9342415a5cea42881387410682332ecaf78ba0353a1f541901459f
SSDEEP

98304:i0qh0r0q2wf02GzMwDws0q40q0qC0FwwRZHwNwYwz0qm0S0qC0mR2wqEwQ0qE0Gm:i7effIPEsy58doQaTzwZ8Jq3QKnqVtxT

Score

10^/10

adware discovery persistence stealer upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,"	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\spools.exe	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\spools.exe	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\spools.exe	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe"	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe"	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe

ACProtect 1.3x - 1.4x DLL software 4 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000900000002348b-9.dat	acprotect
behavioral2/memory/2640-12-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral2/memory/2640-18-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect
behavioral2/memory/2516-35-0x0000000010000000-0x000000001010B000-memory.dmp	acprotect

Loads dropped DLL 2 IoCs

pid	Process
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2516	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2640-0-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/files/0x000b0000000233e2-4.dat	upx
behavioral2/files/0x000900000002348b-9.dat	upx
behavioral2/memory/2640-12-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral2/memory/2640-18-0x0000000010000000-0x000000001010B000-memory.dmp	upx
behavioral2/memory/2640-17-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/files/0x000400000001e74d-19.dat	upx
behavioral2/memory/3808-32-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/2516-33-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/4680-34-0x0000000000400000-0x0000000000426000-memory.dmp	upx
behavioral2/memory/2516-35-0x0000000010000000-0x000000001010B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe"	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe"	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\S:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\T:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\V:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\W:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\W:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\M:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\K:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\N:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\H:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\K:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\E:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\L:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\V:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\J:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\S:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\G:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\M:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\J:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\L:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\P:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\X:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\N:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\R:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\O:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\K:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\R:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\T:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\V:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\O:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\Q:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\W:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\X:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\I:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\S:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\G:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\K:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\P:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\G:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\U:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\S:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\E:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\G:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\I:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\E:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\O:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\Q:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\Q:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\I:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\U:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\N:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\T:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\H:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\J:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\H:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\N:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\R:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\Q:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\O:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\J:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\P:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\M:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\L:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened (read-only)	\??\U:	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	reg.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost = "logonui.exe"	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ftpdll.dll	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ftpdll.dll	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4652	2640	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
3808	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
3808	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
2516	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 3808	2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe	89
PID 2640 wrote to memory of 3808	2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe	89
PID 2640 wrote to memory of 3808	2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe	89
PID 2640 wrote to memory of 3780	2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe	91
PID 2640 wrote to memory of 3780	2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe	91
PID 2640 wrote to memory of 3780	2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe	91
PID 2640 wrote to memory of 2516	2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe	92
PID 2640 wrote to memory of 2516	2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe	92
PID 2640 wrote to memory of 2516	2640	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe	92
PID 3808 wrote to memory of 4680	3808	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe	97
PID 3808 wrote to memory of 4680	3808	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe	97
PID 3808 wrote to memory of 4680	3808	b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Users\Admin\AppData\Local\Temp\b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
    3⤵
    - Enumerates connected drives
    PID:4680
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f
  2⤵
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  PID:3780
- C:\Users\Admin\AppData\Local\Temp\b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\b3e5e6bd9c69a24ea7f9f4f9981b5c2f_JaffaCakes118.exe
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Loads dropped DLL
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 1808
  2⤵
  - Program crash
  PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2640 -ip 2640
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
7fb5fa1534dcf77f2125b2403b30a0ee

SHA1
365d96812a69ac0a4611ea4b70a3f306576cc3ea

SHA256
33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

SHA512
a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
21813b15a671c3eb9876b7f8d9df9102

SHA1
bb1da7b1e3caf0dbe3de72cdf2d59033c4992c96

SHA256
421e85175882c1b5b9c5dd6f0169dcb7a6f8d0ad564f229ddcd01886428f96f7

SHA512
0f2d41aecdefa9362b1b29586f71c963d34fc9503cbf23becbc403e93024cf001ecb073d2e986bb8402ee3b9ad94767aab553ef496139d178968aeb398acc3ba

Download Submit
C:\Users\Admin\AppData\Local\cftmon.exe

Filesize
4.3MB

MD5
d7c659a01dbaafeb9390baa84a039d0b

SHA1
2097c75f2f39f7c11dfef521c8c8848ad0682386

SHA256
0afb1d781eebdd433555bbce27c5b6a6efc7c874d27b476c2ddf01ee15d0f6d2

SHA512
315aa86e61dd7f0e925ba89518e11e10a3b76f5dc4bf6a9d6d066e3e46d3951df3333972863cfb2195d7209b1d61234da20e71b8ca3d39027a01aa4ed38235c0

Download Submit
C:\Windows\SysWOW64\drivers\spools.exe

Filesize
4.3MB

MD5
b209fed8a521cb93044acb0124ecb66a

SHA1
c440d2be140899e27bc19ecaf94f223ac5bd6517

SHA256
41dc7acd9da12f4c61cb59e167e89f038306ca164768afe4d9636c68e1af0da2

SHA512
f6b0072e4ed34bd6b9beca3d3ccfd064513595a14445ed4e2b9ae04ee9ebb0687cd69d310edb53add5344c5e21e04846da67be464064febcafba6e2e6b461866

Download Submit
C:\Windows\SysWOW64\ftpdll.dll

Filesize
5KB

MD5
d807aa04480d1d149f7a4cac22984188

SHA1
ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9

SHA256
eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb

SHA512
875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e

Download Submit
memory/2516-35-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/2516-33-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2640-12-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/2640-17-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2640-18-0x0000000010000000-0x000000001010B000-memory.dmp

Filesize
1.0MB

Download
memory/2640-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3808-32-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4680-34-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download