Malware Analysis Report

2025-06-16 06:37

Sample ID 240825-l65lva1akl
Target c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118
SHA256 de56748561bdd30b47f0a64e4bbe0226771f428b1c5a793aeb109d248c672417
Tags
discovery persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

de56748561bdd30b47f0a64e4bbe0226771f428b1c5a793aeb109d248c672417

Threat Level: Known bad

The file c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

discovery persistence

Modifies WinLogon for persistence

Boot or Logon Autostart Execution: Active Setup

Adds policy Run key to start application

Executes dropped EXE

Loads dropped DLL

Deletes itself

Modifies WinLogon

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Runs net.exe

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-25 10:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-25 10:09

Reported

2024-08-25 10:12

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" C:\Windows\services.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" C:\Windows\services.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\services.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ C:\Windows\services.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" C:\Windows\services.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\services.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Windows\services.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\SysWOW64\winkey.dll C:\Windows\services.exe N/A
File created C:\Windows\SysWOW64\reginv.dll C:\Windows\services.exe N/A
File created C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe N/A
File created C:\Windows\SysWOW64\fservice.exe C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\fservice.exe C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\system\sservice.exe C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system\sservice.exe C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
File created C:\Windows\services.exe C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\services.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\system\sservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\system\sservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\system\sservice.exe C:\Windows\services.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\NET.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\fservice.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\NET.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5036 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe C:\Windows\SysWOW64\fservice.exe
PID 5036 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe C:\Windows\SysWOW64\fservice.exe
PID 5036 wrote to memory of 4452 N/A C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe C:\Windows\SysWOW64\fservice.exe
PID 5036 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5036 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 5036 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4452 wrote to memory of 2508 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 4452 wrote to memory of 2508 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 4452 wrote to memory of 2508 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 2508 wrote to memory of 4060 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 2508 wrote to memory of 4060 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 2508 wrote to memory of 4060 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 2508 wrote to memory of 5004 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 2508 wrote to memory of 5004 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 2508 wrote to memory of 5004 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 5004 wrote to memory of 5104 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 5004 wrote to memory of 5104 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 5004 wrote to memory of 5104 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 4060 wrote to memory of 3468 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 4060 wrote to memory of 3468 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 4060 wrote to memory of 3468 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe"

C:\Windows\SysWOW64\fservice.exe

C:\Windows\system32\fservice.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe.bat

C:\Windows\services.exe

C:\Windows\services.exe -XP

C:\Windows\SysWOW64\NET.exe

NET STOP srservice

C:\Windows\SysWOW64\NET.exe

NET STOP navapsvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 STOP navapsvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 STOP srservice

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 4.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/5036-0-0x0000000000400000-0x0000000000681000-memory.dmp

memory/5036-1-0x0000000000401000-0x00000000005FA000-memory.dmp

memory/5036-2-0x0000000000400000-0x0000000000681000-memory.dmp

C:\Windows\SysWOW64\fservice.exe

MD5 c081f6c1e7f47df99c84033bfc3b1b7d
SHA1 d0e18725c64e13ad26dfa7900fe67fbb1ff6327b
SHA256 de56748561bdd30b47f0a64e4bbe0226771f428b1c5a793aeb109d248c672417
SHA512 e3df5333233671c75ddfd7d21da345a3158038ff5786d9461b0ab28a1b5ad1eb353bc02b8650d5b7d6934b7a7443dc12078da948aa4bd5586acf4a61e5f6dd98

memory/5036-10-0x0000000000400000-0x0000000000681000-memory.dmp

memory/4452-11-0x0000000000400000-0x0000000000681000-memory.dmp

memory/5036-14-0x0000000000400000-0x0000000000681000-memory.dmp

memory/5036-15-0x0000000000401000-0x00000000005FA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe.bat

MD5 7db595f27577f5043312abd397c9356e
SHA1 6e13f1e8ca4d5b01c11173e1aec5682e9d44872f
SHA256 84e10183a6c65ecf204100a02265823b218ee3c9dd7d9f5c301e71888ba4e61a
SHA512 00e0582350e77dd63cf0184faa5c7313ba565298df0fba6a821568a8acc1919211c702ff3bd773705ffbf2dfcfe7201deb5f1850021b6b68b64ea32ce437a469

memory/4452-17-0x0000000000400000-0x0000000000681000-memory.dmp

memory/4452-18-0x0000000000400000-0x0000000000681000-memory.dmp

memory/4452-27-0x0000000000400000-0x0000000000681000-memory.dmp

memory/2508-28-0x0000000000400000-0x0000000000681000-memory.dmp

C:\Windows\SysWOW64\winkey.dll

MD5 43e7d9b875c921ba6be38d45540fb9dd
SHA1 f22a73fc0d4aa3ea6c0b8f61d974b028f308acc4
SHA256 f1b2b0abe844e6ba812c7f8709a463a7f6c56fa6ac38d376a0739cc3469f795b
SHA512 2e74e23c0875b69b82319391c392132f28f4eb45aa412805130382498ae48969a06a2b3a7528b626fa7d7ddb6b006f19f0ef8d73cf73cb9a0c0df44a21077622

memory/2508-30-0x0000000000400000-0x0000000000681000-memory.dmp

C:\Windows\SysWOW64\reginv.dll

MD5 d4a3f90e159ffbcbc4f9740de4b7f171
SHA1 0542f5d1e2c23dca8d90766b3a8537dc3880e5c9
SHA256 2200dd5f83d2fb8c5d3994206a4fa9ff34b4cbfe56ed39a9a03c954cf45d8f77
SHA512 5493beb50b5f7d8ec52f32718d01696916ae173456005d0c1294ce695161ce5004aff58ee3892bf5db0f9b23720146a6d3ae8ffbcbbd81f84d894fdc8cf75a94

memory/2508-40-0x0000000000400000-0x0000000000681000-memory.dmp

memory/2508-41-0x0000000000400000-0x0000000000681000-memory.dmp

memory/2508-42-0x0000000000400000-0x0000000000681000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-25 10:09

Reported

2024-08-25 10:12

Platform

win7-20240704-en

Max time kernel

150s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" C:\Windows\services.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\services.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" C:\Windows\services.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ C:\Windows\services.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" C:\Windows\services.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\fservice.exe N/A
N/A N/A C:\Windows\services.exe N/A

Modifies WinLogon

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ C:\Windows\services.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\fservice.exe C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\fservice.exe C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\SysWOW64\fservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\SysWOW64\winkey.dll C:\Windows\services.exe N/A
File created C:\Windows\SysWOW64\reginv.dll C:\Windows\services.exe N/A
File created C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\system\sservice.exe C:\Windows\services.exe N/A
File opened for modification C:\Windows\system\sservice.exe C:\Windows\services.exe N/A
File created C:\Windows\system\sservice.exe C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system\sservice.exe C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
File created C:\Windows\services.exe C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\services.exe C:\Windows\SysWOW64\fservice.exe N/A
File created C:\Windows\system\sservice.exe C:\Windows\SysWOW64\fservice.exe N/A
File opened for modification C:\Windows\system\sservice.exe C:\Windows\SysWOW64\fservice.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\fservice.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\NET.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\NET.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\net1.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A
N/A N/A C:\Windows\services.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2552 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe C:\Windows\SysWOW64\fservice.exe
PID 2552 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe C:\Windows\SysWOW64\fservice.exe
PID 2552 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe C:\Windows\SysWOW64\fservice.exe
PID 2552 wrote to memory of 1304 N/A C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe C:\Windows\SysWOW64\fservice.exe
PID 2552 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2552 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2552 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2552 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1304 wrote to memory of 2876 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 1304 wrote to memory of 2876 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 1304 wrote to memory of 2876 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 1304 wrote to memory of 2876 N/A C:\Windows\SysWOW64\fservice.exe C:\Windows\services.exe
PID 2876 wrote to memory of 2664 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 2876 wrote to memory of 2664 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 2876 wrote to memory of 2664 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 2876 wrote to memory of 2664 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 2876 wrote to memory of 2716 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 2876 wrote to memory of 2716 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 2876 wrote to memory of 2716 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 2876 wrote to memory of 2716 N/A C:\Windows\services.exe C:\Windows\SysWOW64\NET.exe
PID 2716 wrote to memory of 2688 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 2716 wrote to memory of 2688 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 2716 wrote to memory of 2688 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 2716 wrote to memory of 2688 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 2664 wrote to memory of 2740 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 2664 wrote to memory of 2740 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 2664 wrote to memory of 2740 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe
PID 2664 wrote to memory of 2740 N/A C:\Windows\SysWOW64\NET.exe C:\Windows\SysWOW64\net1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe"

C:\Windows\SysWOW64\fservice.exe

C:\Windows\system32\fservice.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe.bat

C:\Windows\services.exe

C:\Windows\services.exe -XP

C:\Windows\SysWOW64\NET.exe

NET STOP srservice

C:\Windows\SysWOW64\NET.exe

NET STOP navapsvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 STOP navapsvc

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 STOP srservice

Network

N/A

Files

memory/2552-0-0x0000000000400000-0x0000000000681000-memory.dmp

memory/2552-1-0x0000000000401000-0x00000000005FA000-memory.dmp

memory/2552-2-0x0000000000400000-0x0000000000681000-memory.dmp

C:\Windows\SysWOW64\fservice.exe

MD5 c081f6c1e7f47df99c84033bfc3b1b7d
SHA1 d0e18725c64e13ad26dfa7900fe67fbb1ff6327b
SHA256 de56748561bdd30b47f0a64e4bbe0226771f428b1c5a793aeb109d248c672417
SHA512 e3df5333233671c75ddfd7d21da345a3158038ff5786d9461b0ab28a1b5ad1eb353bc02b8650d5b7d6934b7a7443dc12078da948aa4bd5586acf4a61e5f6dd98

memory/2552-13-0x0000000003190000-0x0000000003411000-memory.dmp

memory/2552-15-0x0000000000400000-0x0000000000681000-memory.dmp

memory/1304-16-0x0000000000400000-0x0000000000681000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\c081f6c1e7f47df99c84033bfc3b1b7d_JaffaCakes118.exe.bat

MD5 7db595f27577f5043312abd397c9356e
SHA1 6e13f1e8ca4d5b01c11173e1aec5682e9d44872f
SHA256 84e10183a6c65ecf204100a02265823b218ee3c9dd7d9f5c301e71888ba4e61a
SHA512 00e0582350e77dd63cf0184faa5c7313ba565298df0fba6a821568a8acc1919211c702ff3bd773705ffbf2dfcfe7201deb5f1850021b6b68b64ea32ce437a469

memory/2552-25-0x0000000000400000-0x0000000000681000-memory.dmp

memory/2552-24-0x0000000000401000-0x00000000005FA000-memory.dmp

memory/1304-27-0x0000000000400000-0x0000000000681000-memory.dmp

memory/1304-28-0x0000000000400000-0x0000000000681000-memory.dmp

memory/2876-39-0x0000000000400000-0x0000000000681000-memory.dmp

memory/1304-38-0x00000000034E0000-0x0000000003761000-memory.dmp

memory/1304-40-0x00000000034E0000-0x0000000003761000-memory.dmp

memory/1304-41-0x0000000000400000-0x0000000000681000-memory.dmp

memory/2876-42-0x0000000000400000-0x0000000000681000-memory.dmp

memory/2876-44-0x0000000000400000-0x0000000000681000-memory.dmp

\Windows\SysWOW64\winkey.dll

MD5 43e7d9b875c921ba6be38d45540fb9dd
SHA1 f22a73fc0d4aa3ea6c0b8f61d974b028f308acc4
SHA256 f1b2b0abe844e6ba812c7f8709a463a7f6c56fa6ac38d376a0739cc3469f795b
SHA512 2e74e23c0875b69b82319391c392132f28f4eb45aa412805130382498ae48969a06a2b3a7528b626fa7d7ddb6b006f19f0ef8d73cf73cb9a0c0df44a21077622

\Windows\SysWOW64\reginv.dll

MD5 d4a3f90e159ffbcbc4f9740de4b7f171
SHA1 0542f5d1e2c23dca8d90766b3a8537dc3880e5c9
SHA256 2200dd5f83d2fb8c5d3994206a4fa9ff34b4cbfe56ed39a9a03c954cf45d8f77
SHA512 5493beb50b5f7d8ec52f32718d01696916ae173456005d0c1294ce695161ce5004aff58ee3892bf5db0f9b23720146a6d3ae8ffbcbbd81f84d894fdc8cf75a94

memory/2876-52-0x0000000000400000-0x0000000000681000-memory.dmp

memory/2876-53-0x0000000000400000-0x0000000000681000-memory.dmp

memory/2876-54-0x0000000000400000-0x0000000000681000-memory.dmp