Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 01:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
20 signatures
150 seconds
General
-
Target
b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe
-
Size
748KB
-
MD5
b9cd956fb3dd23a42d76857294b5c5e5
-
SHA1
a66aaf9d00f74a055476c612bf964931a0127498
-
SHA256
1568bfc419fa7e558d8da48c43c33c420a504578cc691258ec4ded9bbcf55241
-
SHA512
81c77aeaab903e52dbd48be6ec4d2d2e30f911db1452f990c9038c53bd1bb5eb6cefd35ffbb4707ffa4176d85512496cbe079155eb9ecc451476194afe755173
-
SSDEEP
12288:kgHsqmAdjxORA4GTe2Pr9hroyCMJOcddfm+Y5kN:Iqmwjfz79iSJOUY5kN
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" qapkumnpakz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" qapkumnpakz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" nutfen.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" qapkumnpakz.exe -
Adds policy Run key to start application 2 TTPs 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tyvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cymnbzsqpfzydxzkwvrfg.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tyvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\augfrneaxldadvveolf.exe" qapkumnpakz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tyvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pitrcxnieriegxwenj.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tyvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\augfrneaxldadvveolf.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiivvfk = "pitrcxnieriegxwenj.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tyvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pitrcxnieriegxwenj.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiivvfk = "nivvifxushaycvwgrpkx.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tyvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqzvexleyjysshek.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiivvfk = "nivvifxushaycvwgrpkx.exe" qapkumnpakz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiivvfk = "zqzvexleyjysshek.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiivvfk = "cymnbzsqpfzydxzkwvrfg.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiivvfk = "augfrneaxldadvveolf.exe" qapkumnpakz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiivvfk = "gyifpjysnzpklbzgo.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiivvfk = "augfrneaxldadvveolf.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiivvfk = "gyifpjysnzpklbzgo.exe" nutfen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run qapkumnpakz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiivvfk = "pitrcxnieriegxwenj.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tyvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cymnbzsqpfzydxzkwvrfg.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiivvfk = "nivvifxushaycvwgrpkx.exe" nutfen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tyvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gyifpjysnzpklbzgo.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tyvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqzvexleyjysshek.exe" nutfen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run qapkumnpakz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tyvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gyifpjysnzpklbzgo.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiivvfk = "pitrcxnieriegxwenj.exe" qapkumnpakz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tyvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gyifpjysnzpklbzgo.exe" qapkumnpakz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiivvfk = "cymnbzsqpfzydxzkwvrfg.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tyvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\augfrneaxldadvveolf.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tyvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nivvifxushaycvwgrpkx.exe" qapkumnpakz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run nutfen.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nutfen.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nutfen.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" qapkumnpakz.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nutfen.exe -
Executes dropped EXE 4 IoCs
pid Process 936 qapkumnpakz.exe 2532 nutfen.exe 1372 nutfen.exe 2572 qapkumnpakz.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend nutfen.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc nutfen.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power nutfen.exe -
Loads dropped DLL 8 IoCs
pid Process 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 936 qapkumnpakz.exe 936 qapkumnpakz.exe 936 qapkumnpakz.exe 936 qapkumnpakz.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nutfen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nivvifxushaycvwgrpkx.exe ." qapkumnpakz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cigrp = "augfrneaxldadvveolf.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nutfen = "augfrneaxldadvveolf.exe ." nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nutfen = "cymnbzsqpfzydxzkwvrfg.exe ." nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gqshjvcob = "zqzvexleyjysshek.exe ." qapkumnpakz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cigrp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cymnbzsqpfzydxzkwvrfg.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zkndgtboch = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqzvexleyjysshek.exe ." nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zkndgtboch = "C:\\Users\\Admin\\AppData\\Local\\Temp\\augfrneaxldadvveolf.exe ." nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gqshjvcob = "pitrcxnieriegxwenj.exe ." nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cigrp = "cymnbzsqpfzydxzkwvrfg.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cigrp = "cymnbzsqpfzydxzkwvrfg.exe" nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\pyznozfq = "pitrcxnieriegxwenj.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zkndgtboch = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pitrcxnieriegxwenj.exe ." nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nutfen = "pitrcxnieriegxwenj.exe ." nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nutfen = "augfrneaxldadvveolf.exe ." qapkumnpakz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ugkbftcqflv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqzvexleyjysshek.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zkndgtboch = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gyifpjysnzpklbzgo.exe ." nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\pyznozfq = "augfrneaxldadvveolf.exe" nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cigrp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cymnbzsqpfzydxzkwvrfg.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cigrp = "gyifpjysnzpklbzgo.exe" nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gqshjvcob = "cymnbzsqpfzydxzkwvrfg.exe ." qapkumnpakz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cigrp = "pitrcxnieriegxwenj.exe" nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gqshjvcob = "gyifpjysnzpklbzgo.exe ." nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zkndgtboch = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pitrcxnieriegxwenj.exe ." qapkumnpakz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ugkbftcqflv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\augfrneaxldadvveolf.exe" nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gqshjvcob = "nivvifxushaycvwgrpkx.exe ." nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nutfen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cymnbzsqpfzydxzkwvrfg.exe ." nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nutfen = "pitrcxnieriegxwenj.exe ." qapkumnpakz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zkndgtboch = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gyifpjysnzpklbzgo.exe ." qapkumnpakz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\pyznozfq = "gyifpjysnzpklbzgo.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zkndgtboch = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqzvexleyjysshek.exe ." nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nutfen = "nivvifxushaycvwgrpkx.exe ." nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cigrp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nivvifxushaycvwgrpkx.exe" nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nutfen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqzvexleyjysshek.exe ." qapkumnpakz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cigrp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pitrcxnieriegxwenj.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cigrp = "pitrcxnieriegxwenj.exe" qapkumnpakz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\pyznozfq = "cymnbzsqpfzydxzkwvrfg.exe" qapkumnpakz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nutfen = "augfrneaxldadvveolf.exe ." nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cigrp = "nivvifxushaycvwgrpkx.exe" nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cigrp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqzvexleyjysshek.exe" nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gqshjvcob = "nivvifxushaycvwgrpkx.exe ." nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\pyznozfq = "cymnbzsqpfzydxzkwvrfg.exe" nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gqshjvcob = "gyifpjysnzpklbzgo.exe ." nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ugkbftcqflv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pitrcxnieriegxwenj.exe" nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nutfen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\augfrneaxldadvveolf.exe ." nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cigrp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cymnbzsqpfzydxzkwvrfg.exe" qapkumnpakz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\pyznozfq = "zqzvexleyjysshek.exe" qapkumnpakz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ugkbftcqflv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\augfrneaxldadvveolf.exe" qapkumnpakz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cigrp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gyifpjysnzpklbzgo.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cigrp = "nivvifxushaycvwgrpkx.exe" nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nutfen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pitrcxnieriegxwenj.exe ." nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zkndgtboch = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nivvifxushaycvwgrpkx.exe ." nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nutfen = "cymnbzsqpfzydxzkwvrfg.exe ." nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\pyznozfq = "nivvifxushaycvwgrpkx.exe" nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cigrp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gyifpjysnzpklbzgo.exe" nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nutfen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nivvifxushaycvwgrpkx.exe ." nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nutfen = "zqzvexleyjysshek.exe ." nutfen.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\pyznozfq = "zqzvexleyjysshek.exe" qapkumnpakz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cigrp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\augfrneaxldadvveolf.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ugkbftcqflv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pitrcxnieriegxwenj.exe" nutfen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nutfen = "nivvifxushaycvwgrpkx.exe ." qapkumnpakz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gqshjvcob = "pitrcxnieriegxwenj.exe ." qapkumnpakz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cigrp = "zqzvexleyjysshek.exe" qapkumnpakz.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\gqshjvcob = "zqzvexleyjysshek.exe ." nutfen.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nutfen.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nutfen.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" qapkumnpakz.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" qapkumnpakz.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA qapkumnpakz.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" nutfen.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 www.showmyipaddress.com 4 www.whatismyip.ca 8 whatismyipaddress.com 18 whatismyip.everdot.org -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf nutfen.exe File created C:\autorun.inf nutfen.exe File opened for modification F:\autorun.inf nutfen.exe File created F:\autorun.inf nutfen.exe -
Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\cymnbzsqpfzydxzkwvrfg.exe nutfen.exe File opened for modification C:\Windows\SysWOW64\egahbfeinjjozzhyqvxrysw.zea nutfen.exe File opened for modification C:\Windows\SysWOW64\gyifpjysnzpklbzgo.exe qapkumnpakz.exe File opened for modification C:\Windows\SysWOW64\zqzvexleyjysshek.exe qapkumnpakz.exe File opened for modification C:\Windows\SysWOW64\tqfhwvpoofaagbeqddaprg.exe nutfen.exe File opened for modification C:\Windows\SysWOW64\rejbgvfukrcsozsuxnafxcrbqgnyokvoqt.wbt nutfen.exe File opened for modification C:\Windows\SysWOW64\cymnbzsqpfzydxzkwvrfg.exe qapkumnpakz.exe File opened for modification C:\Windows\SysWOW64\tqfhwvpoofaagbeqddaprg.exe qapkumnpakz.exe File opened for modification C:\Windows\SysWOW64\cymnbzsqpfzydxzkwvrfg.exe qapkumnpakz.exe File opened for modification C:\Windows\SysWOW64\augfrneaxldadvveolf.exe nutfen.exe File opened for modification C:\Windows\SysWOW64\zqzvexleyjysshek.exe nutfen.exe File opened for modification C:\Windows\SysWOW64\tqfhwvpoofaagbeqddaprg.exe qapkumnpakz.exe File opened for modification C:\Windows\SysWOW64\zqzvexleyjysshek.exe nutfen.exe File opened for modification C:\Windows\SysWOW64\augfrneaxldadvveolf.exe nutfen.exe File opened for modification C:\Windows\SysWOW64\gyifpjysnzpklbzgo.exe qapkumnpakz.exe File opened for modification C:\Windows\SysWOW64\pitrcxnieriegxwenj.exe qapkumnpakz.exe File opened for modification C:\Windows\SysWOW64\nivvifxushaycvwgrpkx.exe qapkumnpakz.exe File opened for modification C:\Windows\SysWOW64\pitrcxnieriegxwenj.exe nutfen.exe File opened for modification C:\Windows\SysWOW64\tqfhwvpoofaagbeqddaprg.exe nutfen.exe File opened for modification C:\Windows\SysWOW64\augfrneaxldadvveolf.exe qapkumnpakz.exe File opened for modification C:\Windows\SysWOW64\gyifpjysnzpklbzgo.exe nutfen.exe File opened for modification C:\Windows\SysWOW64\nivvifxushaycvwgrpkx.exe nutfen.exe File opened for modification C:\Windows\SysWOW64\cymnbzsqpfzydxzkwvrfg.exe nutfen.exe File created C:\Windows\SysWOW64\egahbfeinjjozzhyqvxrysw.zea nutfen.exe File opened for modification C:\Windows\SysWOW64\zqzvexleyjysshek.exe qapkumnpakz.exe File opened for modification C:\Windows\SysWOW64\nivvifxushaycvwgrpkx.exe qapkumnpakz.exe File opened for modification C:\Windows\SysWOW64\augfrneaxldadvveolf.exe qapkumnpakz.exe File opened for modification C:\Windows\SysWOW64\nivvifxushaycvwgrpkx.exe nutfen.exe File opened for modification C:\Windows\SysWOW64\gyifpjysnzpklbzgo.exe nutfen.exe File opened for modification C:\Windows\SysWOW64\pitrcxnieriegxwenj.exe nutfen.exe File created C:\Windows\SysWOW64\rejbgvfukrcsozsuxnafxcrbqgnyokvoqt.wbt nutfen.exe File opened for modification C:\Windows\SysWOW64\pitrcxnieriegxwenj.exe qapkumnpakz.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\rejbgvfukrcsozsuxnafxcrbqgnyokvoqt.wbt nutfen.exe File opened for modification C:\Program Files (x86)\egahbfeinjjozzhyqvxrysw.zea nutfen.exe File created C:\Program Files (x86)\egahbfeinjjozzhyqvxrysw.zea nutfen.exe File opened for modification C:\Program Files (x86)\rejbgvfukrcsozsuxnafxcrbqgnyokvoqt.wbt nutfen.exe -
Drops file in Windows directory 32 IoCs
description ioc Process File opened for modification C:\Windows\nivvifxushaycvwgrpkx.exe qapkumnpakz.exe File opened for modification C:\Windows\rejbgvfukrcsozsuxnafxcrbqgnyokvoqt.wbt nutfen.exe File created C:\Windows\rejbgvfukrcsozsuxnafxcrbqgnyokvoqt.wbt nutfen.exe File opened for modification C:\Windows\nivvifxushaycvwgrpkx.exe qapkumnpakz.exe File opened for modification C:\Windows\zqzvexleyjysshek.exe nutfen.exe File opened for modification C:\Windows\gyifpjysnzpklbzgo.exe nutfen.exe File opened for modification C:\Windows\pitrcxnieriegxwenj.exe nutfen.exe File opened for modification C:\Windows\augfrneaxldadvveolf.exe nutfen.exe File opened for modification C:\Windows\egahbfeinjjozzhyqvxrysw.zea nutfen.exe File created C:\Windows\egahbfeinjjozzhyqvxrysw.zea nutfen.exe File opened for modification C:\Windows\tqfhwvpoofaagbeqddaprg.exe qapkumnpakz.exe File opened for modification C:\Windows\augfrneaxldadvveolf.exe qapkumnpakz.exe File opened for modification C:\Windows\cymnbzsqpfzydxzkwvrfg.exe qapkumnpakz.exe File opened for modification C:\Windows\augfrneaxldadvveolf.exe nutfen.exe File opened for modification C:\Windows\pitrcxnieriegxwenj.exe nutfen.exe File opened for modification C:\Windows\tqfhwvpoofaagbeqddaprg.exe nutfen.exe File opened for modification C:\Windows\gyifpjysnzpklbzgo.exe nutfen.exe File opened for modification C:\Windows\augfrneaxldadvveolf.exe qapkumnpakz.exe File opened for modification C:\Windows\pitrcxnieriegxwenj.exe qapkumnpakz.exe File opened for modification C:\Windows\pitrcxnieriegxwenj.exe qapkumnpakz.exe File opened for modification C:\Windows\nivvifxushaycvwgrpkx.exe nutfen.exe File opened for modification C:\Windows\cymnbzsqpfzydxzkwvrfg.exe nutfen.exe File opened for modification C:\Windows\cymnbzsqpfzydxzkwvrfg.exe nutfen.exe File opened for modification C:\Windows\zqzvexleyjysshek.exe qapkumnpakz.exe File opened for modification C:\Windows\gyifpjysnzpklbzgo.exe qapkumnpakz.exe File opened for modification C:\Windows\zqzvexleyjysshek.exe qapkumnpakz.exe File opened for modification C:\Windows\gyifpjysnzpklbzgo.exe qapkumnpakz.exe File opened for modification C:\Windows\tqfhwvpoofaagbeqddaprg.exe qapkumnpakz.exe File opened for modification C:\Windows\zqzvexleyjysshek.exe nutfen.exe File opened for modification C:\Windows\tqfhwvpoofaagbeqddaprg.exe nutfen.exe File opened for modification C:\Windows\nivvifxushaycvwgrpkx.exe nutfen.exe File opened for modification C:\Windows\cymnbzsqpfzydxzkwvrfg.exe qapkumnpakz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nutfen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qapkumnpakz.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2532 nutfen.exe 2532 nutfen.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2532 nutfen.exe 2532 nutfen.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2532 nutfen.exe 2532 nutfen.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2532 nutfen.exe 2532 nutfen.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2532 nutfen.exe 2532 nutfen.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2532 nutfen.exe 2532 nutfen.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2532 nutfen.exe 2532 nutfen.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2532 nutfen.exe 2532 nutfen.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2532 nutfen.exe 2532 nutfen.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2532 nutfen.exe 2532 nutfen.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2532 nutfen.exe 2532 nutfen.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2532 nutfen.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2316 wrote to memory of 936 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 30 PID 2316 wrote to memory of 936 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 30 PID 2316 wrote to memory of 936 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 30 PID 2316 wrote to memory of 936 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 30 PID 936 wrote to memory of 2532 936 qapkumnpakz.exe 31 PID 936 wrote to memory of 2532 936 qapkumnpakz.exe 31 PID 936 wrote to memory of 2532 936 qapkumnpakz.exe 31 PID 936 wrote to memory of 2532 936 qapkumnpakz.exe 31 PID 936 wrote to memory of 1372 936 qapkumnpakz.exe 32 PID 936 wrote to memory of 1372 936 qapkumnpakz.exe 32 PID 936 wrote to memory of 1372 936 qapkumnpakz.exe 32 PID 936 wrote to memory of 1372 936 qapkumnpakz.exe 32 PID 2316 wrote to memory of 2572 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 33 PID 2316 wrote to memory of 2572 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 33 PID 2316 wrote to memory of 2572 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 33 PID 2316 wrote to memory of 2572 2316 b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe 33 -
System policy modification 1 TTPs 38 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" qapkumnpakz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" nutfen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nutfen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" nutfen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" nutfen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" qapkumnpakz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer qapkumnpakz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nutfen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" nutfen.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b9cd956fb3dd23a42d76857294b5c5e5_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\qapkumnpakz.exe"C:\Users\Admin\AppData\Local\Temp\qapkumnpakz.exe" "c:\users\admin\appdata\local\temp\b9cd956fb3dd23a42d76857294b5c5e5_jaffacakes118.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:936 -
C:\Users\Admin\AppData\Local\Temp\nutfen.exe"C:\Users\Admin\AppData\Local\Temp\nutfen.exe" "-C:\Users\Admin\AppData\Local\Temp\zqzvexleyjysshek.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2532
-
-
C:\Users\Admin\AppData\Local\Temp\nutfen.exe"C:\Users\Admin\AppData\Local\Temp\nutfen.exe" "-C:\Users\Admin\AppData\Local\Temp\zqzvexleyjysshek.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:1372
-
-
-
C:\Users\Admin\AppData\Local\Temp\qapkumnpakz.exe"C:\Users\Admin\AppData\Local\Temp\qapkumnpakz.exe" "c:\users\admin\appdata\local\temp\b9cd956fb3dd23a42d76857294b5c5e5_jaffacakes118.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2572
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272B
MD5023b36dff06b20a049117a048714eb8f
SHA1ad12cb70f7a37e15df81775108c72f710581036d
SHA256c76b46ac891fdf7d0a44cd20595dbae8b97d8787ff89c92a4d3d3962e454573f
SHA512667ac28a184c8940f6714235d534192422adf4f6996e5021f187818fcc851d45aba493d5a42579f5dc76ddbeaff10ce391bd5d8fbd36b7eb10b965397bcb1e57
-
Filesize
272B
MD5a2525a67e5b9088e5b8ff7d398f6295b
SHA1fe59373b96ab140fe645f29e264b8f82e738dd01
SHA2565540b27ef51fb86fa6a6637e9817b4d8e6f15d1cbf41ee2dd8cc17f8860f09b2
SHA51292d79bcdd9164c13c0dae7f65602d1ba464240e4aeb0bd67ea7ef538281fdbfe6578bc79651e0578e133356b45aac0c7d2e62df2fe5c8e34b091e7b2f2081960
-
Filesize
272B
MD50787c6b5cff43634290498925410ca6e
SHA19f1606c5fc1a4822478c3c066097259478d5a840
SHA256c77c918c316d8a87088b47c0c896c50040126e4b47aebc0d32f1ae15c4d3f115
SHA512a8c50f7fea8779c614e8b139e86e29912c255c2b512afed4c7a32b60c88597a91044a7ec12b19dacb2a08f3da5590361125ef652f0c103808f11e4161af7cc17
-
Filesize
272B
MD5b927c1f8d8a1a49a008f6ad6a45df322
SHA15c313b2ee9a6eb5252f079210dd20aadde9b8e2e
SHA256a4173a1d60a2359f5fad6896419dc8f61659d93d017f99bb3eaff69b36a1287c
SHA512b19344b8de7f9041cd257ef9b914fd2c717e5b5c10cf830f76db75200799722a055031eb8dc04902dca8ebb19f8776670f35344e6603ccca7224f6788dd56c6f
-
Filesize
272B
MD50db430f83b41317cb388ff2f0b52b5dd
SHA12c2321ca3c27ecf7a7dd7cc07e02b5027b1552db
SHA2567d3f8769ffe981a569647721e8b8a5d5fadcb260d523b8192a7ac71a8bb49a4a
SHA51253195b5a683ab64fce700482034c1993689e8c8087ae1961789bdba171632fa3001e8209afaddecac2ecab784b442c556f3f3750616c4b619fb7ed20293104ae
-
Filesize
272B
MD5ceeacf442a2b1fe37c91428986eae335
SHA1335c3e751de9d2fa1b55ed7e29ef2d75856b5c6e
SHA25668ca23a7b46c197335a8790a18307b3b9cdda6cdc1885a7f62f8eda1a53fcbc7
SHA5120c4f1c3df216f8fdd2311b15e27816565899b2c1c07586eaa52ed5826e32676a31b70e6c8ac9d5d5c8d9983b3af6e8a3f98dfa09872f56bae5d49d1526175841
-
Filesize
3KB
MD5dfe1697cc2a5e71262a04057750c12a9
SHA152449ffed4c9fad50513ab5f93e53427fa8de28a
SHA2566f32d908e4a541d9e0dd961a709065b7aa7c93768b174a5396352bfbcfdba837
SHA5122cf73500a5a46743dee650a839f48d8a4dd39da7db7c48437d78821360fdf89aa85c7174f2c99c2e43036b5f913f0e2ee172b2cc3208ba88a125c63364f12be2
-
Filesize
748KB
MD5b9cd956fb3dd23a42d76857294b5c5e5
SHA1a66aaf9d00f74a055476c612bf964931a0127498
SHA2561568bfc419fa7e558d8da48c43c33c420a504578cc691258ec4ded9bbcf55241
SHA51281c77aeaab903e52dbd48be6ec4d2d2e30f911db1452f990c9038c53bd1bb5eb6cefd35ffbb4707ffa4176d85512496cbe079155eb9ecc451476194afe755173
-
Filesize
692KB
MD586144dc5f3113c59de67a12058f17699
SHA196a813a8336cd608417d0849ff39a547084b174e
SHA25609a22088b21dd74b581b040513dbcb3d62fa1dda2eae35243d422aedd4097ceb
SHA512c7933adb1c504771d4599a3a66a47541e61153c89c8749313b7f3ac86dd76a4935ff70bcdbba0aa19ec6fef5dcd313b9215b31d520d2006f4f1378b79006badf
-
Filesize
320KB
MD5b92314203327a733531042bc58e54f57
SHA11f3d0081f308a82c9659f4a57fc1ad551167a181
SHA256d936bfd3b4264fe1650dee22119858b9d0cc58598e7e956ebecf72fb82f7c7d3
SHA5122982559183e13830cd795c7badadb15b4dad50315155299d9713970aff034c827ade98c79d6da836aea743890aca71bc0f7d5348a32f2858b4f40884ecccf7f7