Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2024 05:20
Behavioral task
behavioral1
Sample
df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe
-
Size
355KB
-
MD5
df90ccb7382b324fd1b2523fc82c2472
-
SHA1
03fbeb1d5372e2c1c289c2dd7055b1941df6ca46
-
SHA256
c1cafddda67e4aecff70a319ac8fd510480046bb99d7b5720d19545a3d996a37
-
SHA512
e241d89ff3f86e1b4911d6e2542ef7be0cf072209e293258ecca253cfca438940f51c8e2ad19040e4fdad200398f906604ca10f01c407231fbf247a995fd0035
-
SSDEEP
6144:a3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:lmWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
ganypih.com
lykyjad.com
vopybyt.com
qebytiq.com
pujyjav.com
gatyvyz.com
lyvytuj.com
vojyjof.com
qetyvep.com
puvytuq.com
gahyhob.com
lyryvex.com
vocyruk.com
qegyhig.com
purycap.com
gacyryw.com
lygygin.com
vowycac.com
qexyryl.com
pufygug.com
gaqycos.com
lyxywer.com
vofygum.com
qeqyxov.com
puzywel.com
gadyfuh.com
lymyxid.com
volyqat.com
qedyfyq.com
pumyxiv.com
galyqaz.com
lysyfyj.com
vonyzuf.com
qekyqop.com
pupydeq.com
ganyzub.com
lykymox.com
vopydek.com
qebylug.com
pujymip.com
gatydaw.com
lyvylyn.com
vojymic.com
qetysal.com
puvylyg.com
gahynus.com
lyrysor.com
vocykem.com
qegynuv.com
purypol.com
gacykeh.com
lygynud.com
vowypit.com
qexykaq.com
pufybyv.com
gaqypiz.com
lyxyjaj.com
vofybyf.com
qeqytup.com
puzyjoq.com
gadyveb.com
lymytux.com
volyjok.com
qedyveg.com
pumytup.com
galyhiw.com
lysyvan.com
vonyryc.com
qekyhil.com
pupycag.com
ganyrys.com
lykygur.com
vopycom.com
qebyrev.com
pujygul.com
gatycoh.com
lyvywed.com
vojygut.com
qetyxiq.com
puvywav.com
gahyfyz.com
lyryxij.com
vocyqaf.com
qegyfyp.com
puryxuq.com
gacyqob.com
lygyfex.com
vowyzuk.com
qexyqog.com
pufydep.com
gaqyzuw.com
lyxymin.com
vofydac.com
qeqylyl.com
puzymig.com
gadydas.com
lymylyr.com
volymum.com
qedysov.com
pumylel.com
galynuh.com
lysysod.com
vonyket.com
qekynuq.com
pupypiv.com
ganykaz.com
lykynyj.com
vopypif.com
qebykap.com
pujybyq.com
gatypub.com
lyvyjox.com
vojybek.com
qetytug.com
puvyjop.com
gahyvew.com
lyrytun.com
vocyjic.com
qegyval.com
purytyg.com
gacyhis.com
lygyvar.com
vowyrym.com
qexyhuv.com
pufycol.com
gaqyreh.com
lyxygud.com
vofycot.com
qeqyreq.com
puzyguv.com
gadyciz.com
lymywaj.com
volygyf.com
qedyxip.com
pumywaq.com
galyfyb.com
lysyxux.com
vonyqok.com
qekyfeg.com
pupyxup.com
ganyqow.com
lykyfen.com
vopyzuc.com
qebyqil.com
pujydag.com
gatyzys.com
lyvymir.com
vojydam.com
qetylyv.com
puvymul.com
gahydoh.com
lyryled.com
vocymut.com
qegysoq.com
purylev.com
gacynuz.com
lygysij.com
vowykaf.com
qexynyp.com
pufypiq.com
gaqykab.com
lyxynyx.com
vofypuk.com
qeqykog.com
puzybep.com
gadypuw.com
lymyjon.com
volybec.com
qedytul.com
pumyjig.com
galyvas.com
lysytyr.com
vonyjim.com
qekyvav.com
pupytyl.com
ganyhuh.com
lykyvod.com
vopyret.com
qebyhuq.com
pujycov.com
gatyrez.com
lyvyguj.com
vojycif.com
qetyrap.com
puvygyq.com
gahycib.com
lyrywax.com
vocygyk.com
qegyxug.com
purywop.com
gacyfew.com
lygyxun.com
vowyqoc.com
qexyfel.com
pufyxug.com
gaqyqis.com
lyxyfar.com
vofyzym.com
qeqyqiv.com
puzydal.com
gadyzyh.com
lymymud.com
volydot.com
qedyleq.com
pumymuv.com
galydoz.com
lysylej.com
vonymuf.com
qekysip.com
pupylaq.com
ganynyb.com
lykysix.com
vopykak.com
qebynyg.com
pujypup.com
gatykow.com
lyvynen.com
vojypuc.com
qetykol.com
puvybeg.com
gahypus.com
lyryjir.com
vocybam.com
qegytyv.com
puryjil.com
gacyvah.com
lygytyd.com
vowyjut.com
qexyvoq.com
pufytev.com
gaqyhuz.com
lyxyvoj.com
vofyref.com
qeqyhup.com
puzyciq.com
gadyrab.com
lymygyx.com
volycik.com
qedyrag.com
pumygyp.com
galycuw.com
lysywon.com
vonygec.com
qekyxul.com
pupywog.com
ganyfes.com
lykyxur.com
vopyqim.com
qebyfav.com
pujyxyl.com
gatyqih.com
lyvyfad.com
vojyzyt.com
qetyquq.com
puvydov.com
gahyzez.com
lyrymuj.com
vocydof.com
qegylep.com
purymuq.com
gacydib.com
lygylax.com
vowymyk.com
qexysig.com
pufylap.com
gaqynyw.com
lyxysun.com
vofykoc.com
qeqynel.com
puzypug.com
gadykos.com
lymyner.com
volypum.com
qedykiv.com
pumybal.com
galypyh.com
lysyjid.com
vonybat.com
qekytyq.com
pupyjuv.com
ganyvoz.com
lykytej.com
vopyjuf.com
qebyvop.com
pujyteq.com
gatyhub.com
lyvyvix.com
vojyrak.com
qetyhyg.com
puvycip.com
gahyraw.com
lyrygyn.com
vocycuc.com
qegyrol.com
purygeg.com
gacycus.com
lygywor.com
vowygem.com
qexyxuv.com
pufywil.com
gaqyfah.com
lyxyxyd.com
vofyqit.com
qeqyfaq.com
puzyxyv.com
gadyquz.com
lymyfoj.com
volyzef.com
qedyqup.com
pumydoq.com
galyzeb.com
lysymux.com
vonydik.com
qekylag.com
pupymyp.com
ganydiw.com
lykylan.com
vopymyc.com
qebysul.com
pujylog.com
gatynes.com
lyvysur.com
vojykom.com
qetynev.com
puvypul.com
gahykih.com
lyrynad.com
vocypyt.com
qegykiq.com
purybav.com
gacypyz.com
lygyjuj.com
vowybof.com
qexytep.com
pufyjuq.com
gaqyvob.com
lyxytex.com
vofyjuk.com
qeqyvig.com
puzytap.com
gadyhyw.com
lymyvin.com
volyrac.com
qedyhyl.com
pumycug.com
galyros.com
lysyger.com
vonycum.com
qekyrov.com
pupygel.com
ganycuh.com
lykywid.com
vopygat.com
qebyxyq.com
pujywiv.com
gatyfaz.com
lyvyxyj.com
vojyquf.com
qetyfop.com
puvyxeq.com
gahyqub.com
lyryfox.com
vocyzek.com
qegyqug.com
purydip.com
gacyzaw.com
lygymyn.com
vowydic.com
qexylal.com
pufymyg.com
gaqydus.com
lyxylor.com
vofymem.com
qeqysuv.com
puzylol.com
gadyneh.com
lymysud.com
volykit.com
qedynaq.com
pumypyv.com
galykiz.com
lysynaj.com
vonypyf.com
qekykup.com
pupyboq.com
ganypeb.com
lykyjux.com
vopybok.com
qebyteg.com
pujyjup.com
gatyviw.com
lyvytan.com
vojyjyc.com
qetyvil.com
puvytag.com
gahyhys.com
lyryvur.com
vocyrom.com
qegyhev.com
purycul.com
gacyroh.com
lygyged.com
vowycut.com
qexyriq.com
pufygav.com
gaqycyz.com
lyxywij.com
vofygaf.com
qeqyxyp.com
puzywuq.com
gadyfob.com
lymyxex.com
volyquk.com
qedyfog.com
pumyxep.com
galyquw.com
lysyfin.com
vonyzac.com
qekyqyl.com
pupydig.com
ganyzas.com
lykymyr.com
vopydum.com
qebylov.com
pujymel.com
gatyduh.com
lyvylod.com
vojymet.com
qetysuq.com
puvyliv.com
gahynaz.com
lyrysyj.com
vocykif.com
qegynap.com
purypyq.com
gacykub.com
lygynox.com
vowypek.com
qexykug.com
pufybop.com
gaqypew.com
lyxyjun.com
vofybic.com
qeqytal.com
puzyjyg.com
gadyvis.com
lymytar.com
volyjym.com
qedyvuv.com
pumytol.com
galyheh.com
lysyvud.com
vonyrot.com
qekyheq.com
pupycuv.com
ganyriz.com
lykygaj.com
vopycyf.com
qebyrip.com
pujygaq.com
gatycyb.com
lyvywux.com
vojygok.com
qetyxeg.com
puvywup.com
gahyfow.com
lyryxen.com
vocyquc.com
qegyfil.com
puryxag.com
gacyqys.com
lygyfir.com
vowyzam.com
qexyqyv.com
pufydul.com
gaqyzoh.com
lyxymed.com
vofydut.com
qeqyloq.com
puzymev.com
gadyduz.com
lymylij.com
volymaf.com
qedysyp.com
pumyliq.com
galynab.com
lysysyx.com
vonykuk.com
qekynog.com
pupypep.com
ganykuw.com
lykynon.com
vopypec.com
qebykul.com
pujybig.com
gatypas.com
lyvyjyr.com
vojybim.com
qetytav.com
puvyjyl.com
gahyvuh.com
lyrytod.com
vocyjet.com
qegyvuq.com
purytov.com
gacyhez.com
lygyvuj.com
vowyrif.com
qexyhap.com
pufycyq.com
gaqyrib.com
lyxygax.com
vofycyk.com
qeqyrug.com
puzygop.com
gadycew.com
lymywun.com
volygoc.com
qedyxel.com
pumywug.com
galyfis.com
lysyxar.com
vonyqym.com
qekyfiv.com
pupyxal.com
ganyqyh.com
lykyfud.com
vopyzot.com
qebyqeq.com
pujyduv.com
gatyzoz.com
lyvymej.com
vojyduf.com
qetylip.com
puvymaq.com
gahydyb.com
lyrylix.com
vocymak.com
qegysyg.com
purylup.com
gacynow.com
lygysen.com
vowykuc.com
qexynol.com
pufypeg.com
gaqykus.com
lyxynir.com
vofypam.com
qeqykyv.com
puzybil.com
gadypah.com
lymyjyd.com
volybut.com
qedytoq.com
pumyjev.com
galyvuz.com
lysytoj.com
vonyjef.com
qekyvup.com
pupytiq.com
ganyhab.com
lykyvyx.com
vopyrik.com
qebyhag.com
pujycyp.com
gatyruw.com
lyvygon.com
vojycec.com
qetyrul.com
puvygog.com
gahyces.com
lyrywur.com
vocygim.com
qegyxav.com
purywyl.com
gacyfih.com
lygyxad.com
vowyqyt.com
qexyfuq.com
pufyxov.com
gaqyqez.com
lyxyfuj.com
vofyzof.com
qeqyqep.com
puzyduq.com
gadyzib.com
lymymax.com
volydyk.com
qedylig.com
pumymap.com
galydyw.com
lysylun.com
vonymoc.com
qekysel.com
pupylug.com
ganynos.com
lykyser.com
vopykum.com
qebyniv.com
pujypal.com
gatykyh.com
lyvynid.com
vojypat.com
qetykyq.com
puvybuv.com
gahypoz.com
lyryjej.com
vocybuf.com
qegytop.com
puryjeq.com
gacyvub.com
lygytix.com
vowyjak.com
qexyvyg.com
pufytip.com
gaqyhaw.com
lyxyvyn.com
vofyruc.com
qeqyhol.com
puzyceg.com
gadyrus.com
lymygor.com
volycem.com
qedyruv.com
pumygil.com
galycah.com
lysywyd.com
vonygit.com
qekyxaq.com
pupywyv.com
ganyfuz.com
lykyxoj.com
vopyqef.com
qebyfup.com
pujyxoq.com
gatyqeb.com
lyvyfux.com
vojyzik.com
qetyqag.com
puvydyp.com
gahyziw.com
lyryman.com
vocydyc.com
qegylul.com
purymog.com
gacydes.com
lygylur.com
vowymom.com
qexysev.com
pufylul.com
gaqynih.com
lyxysad.com
vofykyt.com
qeqyniq.com
puzypav.com
gadykyz.com
lymynuj.com
volypof.com
qedykep.com
pumybuq.com
galypob.com
lysyjex.com
vonybuk.com
qekytig.com
pupyjap.com
ganyvyw.com
lykytin.com
vopyjac.com
qebyvyl.com
pujytug.com
gatyhos.com
lyvyver.com
vojyrum.com
qetyhov.com
puvycel.com
gahyruh.com
lyrygid.com
vocycat.com
qegyryq.com
purygiv.com
gacycaz.com
lygywyj.com
vowyguf.com
qexyxop.com
pufyweq.com
gaqyfub.com
lyxyxox.com
vofyqek.com
qeqyfug.com
puzyxip.com
gadyqaw.com
lymyfyn.com
volyzic.com
qedyqal.com
pumydyg.com
galyzus.com
lysymor.com
vonydem.com
qekyluv.com
pupymol.com
ganydeh.com
lykylud.com
vopymit.com
qebysaq.com
pujylyv.com
gatyniz.com
lyvysaj.com
vojykyf.com
qetynup.com
puvypoq.com
gahykeb.com
lyrynux.com
vocypok.com
qegykeg.com
purybup.com
gacypiw.com
lygyjan.com
vowybyc.com
qexytil.com
pufyjag.com
gaqyvys.com
lyxytur.com
vofyjom.com
qeqyvev.com
puzytul.com
gadyhoh.com
lymyved.com
volyrut.com
qedyhiq.com
pumycav.com
galyryz.com
lysygij.com
vonycaf.com
qekyryp.com
pupyguq.com
ganycob.com
lykywex.com
vopyguk.com
qebyxog.com
pujywep.com
gatyfuw.com
lyvyxin.com
vojyqac.com
qetyfyl.com
puvyxig.com
gahyqas.com
lyryfyr.com
vocyzum.com
qegyqov.com
purydel.com
gacyzuh.com
lygymod.com
vowydet.com
qexyluq.com
pufymiv.com
gaqydaz.com
lyxylyj.com
vofymif.com
qeqysap.com
puzylyq.com
gadynub.com
lymysox.com
volykek.com
qedynug.com
pumypop.com
galykew.com
lysynun.com
vonypic.com
qekykal.com
pupybyg.com
ganypis.com
lykyjar.com
vopybym.com
qebytuv.com
pujyjol.com
gatyveh.com
lyvytud.com
vojyjot.com
qetyveq.com
puvytuv.com
gahyhiz.com
lyryvaj.com
vocyryf.com
qegyhip.com
purycaq.com
gacyryb.com
lygygux.com
vowycok.com
qexyreg.com
pufygup.com
gaqycow.com
lyxywen.com
vofyguc.com
qeqyxil.com
puzywag.com
gadyfys.com
lymyxir.com
volyqam.com
qedyfyv.com
pumyxul.com
galyqoh.com
lysyfed.com
vonyzut.com
qekyqoq.com
pupydev.com
ganyzuz.com
lykymij.com
vopydaf.com
qebylyp.com
pujymiq.com
gatydab.com
lyvylyx.com
vojymuk.com
qetysog.com
puvylep.com
gahynuw.com
lyryson.com
vocykec.com
qegynul.com
purypig.com
gacykas.com
lygynyr.com
vowypim.com
qexykav.com
pufybyl.com
gaqypuh.com
lyxyjod.com
vofybet.com
qeqytuq.com
puzyjov.com
gadyvez.com
lymytuj.com
volyjif.com
qedyvap.com
pumytyq.com
galyhib.com
lysyvax.com
vonyryk.com
qekyhug.com
pupycop.com
ganyrew.com
lykygun.com
vopycoc.com
qebyrel.com
pujygug.com
gatycis.com
lyvywar.com
vojygym.com
qetyxiv.com
puvywal.com
gahyfyh.com
lyryxud.com
vocyqot.com
qegyfeq.com
puryxuv.com
gacyqoz.com
lygyfej.com
vowyzuf.com
qexyqip.com
pufydaq.com
gaqyzyb.com
lyxymix.com
vofydak.com
qeqylyg.com
puzymup.com
gadydow.com
lymylen.com
volymuc.com
qedysol.com
pumyleg.com
galynus.com
lysysir.com
vonykam.com
qekynyv.com
pupypil.com
ganykah.com
lykynyd.com
vopyput.com
qebykoq.com
pujybev.com
gatypuz.com
lyvyjoj.com
vojybef.com
qetytup.com
puvyjiq.com
gahyvab.com
lyrytyx.com
vocyjik.com
qegyvag.com
purytyp.com
gacyhuw.com
lygyvon.com
vowyrec.com
qexyhul.com
pufycog.com
gaqyres.com
lyxygur.com
vofycim.com
qeqyrav.com
puzygyl.com
gadycih.com
lymywad.com
volygyt.com
qedyxuq.com
pumywov.com
galyfez.com
lysyxuj.com
vonyqof.com
qekyfep.com
pupyxuq.com
ganyqib.com
lykyfax.com
vopyzyk.com
qebyqig.com
pujydap.com
gatyzyw.com
lyvymun.com
vojydoc.com
qetylel.com
puvymug.com
gahydos.com
lyryler.com
vocymum.com
qegysiv.com
purylal.com
gacynyh.com
lygysid.com
vowykat.com
qexynyq.com
pufypuv.com
gaqykoz.com
lyxynej.com
vofypuf.com
qeqykop.com
puzybeq.com
gadypub.com
lymyjix.com
volybak.com
qedytyg.com
pumyjip.com
galyvaw.com
lysytyn.com
vonyjuc.com
qekyvol.com
pupyteg.com
ganyhus.com
lykyvor.com
vopyrem.com
qebyhuv.com
pujycil.com
gatyrah.com
lyvygyd.com
vojycit.com
qetyraq.com
puvygyv.com
gahycuz.com
lyrywoj.com
vocygef.com
qegyxup.com
purywoq.com
gacyfeb.com
lygyxux.com
vowyqik.com
qexyfag.com
pufyxyp.com
gaqyqiw.com
lyxyfan.com
vofyzyc.com
qeqyqul.com
puzydog.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe," svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 1520 svchost.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\5948df4b = "`Ÿ¯ò:Ö÷éän?ü£peÿ^à+Y®``èº8ì\x18‡Uå\x03\x05S¸ÒÂõ›f²Kjó“=msb•˜âM5z¥\x05mHã“\x10Ãꮣj2ë\x1d]\u00adÝ’ÕzŠ*\u0090壕\x1ec`ª(Õ–°.p²\rê»î¢e²‚Uz[`ØF\x135`åB»+Àf’\v\x13\x13íÝ\x1bÅ‹ûS\x05MºË#ˆ@•ª¥Kþ\x10=…\x10þ3n\b»Ãxnæ–öó¥Ø%ë\x1aÈ0&Ã\x05\x02³Ë¨£Uf5»›åûå" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\5948df4b = "`Ÿ¯ò:Ö÷éän?ü£peÿ^à+Y®``èº8ì\x18‡Uå\x03\x05S¸ÒÂõ›f²Kjó“=msb•˜âM5z¥\x05mHã“\x10Ãꮣj2ë\x1d]\u00adÝ’ÕzŠ*\u0090壕\x1ec`ª(Õ–°.p²\rê»î¢e²‚Uz[`ØF\x135`åB»+Àf’\v\x13\x13íÝ\x1bÅ‹ûS\x05MºË#ˆ@•ª¥Kþ\x10=…\x10þ3n\b»Ãxnæ–öó¥Ø%ë\x1aÈ0&Ã\x05\x02³Ë¨£Uf5»›åûå" df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\apppatch\svchost.exe df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe File created C:\Windows\apppatch\svchost.exe df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1544 df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe 1544 df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe 1544 df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe 1544 df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe 1544 df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe 1544 df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe 1544 df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe 1544 df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe 1520 svchost.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1544 df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1544 wrote to memory of 1520 1544 df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe 85 PID 1544 wrote to memory of 1520 1544 df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe 85 PID 1544 wrote to memory of 1520 1544 df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\df90ccb7382b324fd1b2523fc82c2472_JaffaCakes118.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1520
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
42KB
MD5cbfd7e08b4841e7ffdbb71caef4f5123
SHA19379505469ebd37508005bb0b24768fd88dd484d
SHA256bf2e415fdadd652fe699bdca7f919647c5d20f12118fe829e6ef9473b9d1a20c
SHA512943de3bacdcc6835b94db71c1a2a8cfa59e74c7c30aeacb4c3d90f0ffc78c1b1cbfcf7afb71de7c2683a480c3c45ff8612856c1baf5f311917bc96286f9fbb86
-
Filesize
42KB
MD5bc81972dcd7d3a718291a013622c742f
SHA1faac46e3ac5e1c0eea04fabaeb3c7481de78268b
SHA25690f5b2771b6d45e6281cbb86fee6742c15e591cff30786f8069cb0fef6ad4df1
SHA512cdfbcc2325c3710ef4542b2272c790fde7eebd33a97d7d2efe944f8c8cdf5414605a17bac436cb4f2ed0b0d0a13f2221aeab83e5544ec511b7352cb2761003c0
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD57d278968c0214f4a247261abf19e98b7
SHA14987b6be1100e6939a9bcb68b1f11f37d0e80f48
SHA25683b16a9e3d4690d1bf71cf25a743d846fe46bd9453fdd07dd7744acb9acdb367
SHA51241fda1a64bc1c25bd40854d6ca059be82e4de7f0f3e3b754aac4cfc51d139b0702155f3bb97d2e973933a5a88a1afa39ba4c5ae898cd9e5e67f797079e8f1830
-
Filesize
481B
MD58a9f65d2ed2512b9a44027df664d7df2
SHA123d9fb4557270e04f83a29753c98ba5b1c38a32c
SHA25601899d3f60efda1d6ba1689ab3820e684b829f3ef5708e6e23979591eb09025e
SHA5125839b660da1b90b81b51889ec6fb2957413616ddf7d4f3dae6e0f4e3a82271fc8e523fde97943d9cea2ed3892ea4d2750d5c2f393339b88eea3ab5daf3167456
-
Filesize
24KB
MD5ccd51c09add63b783d4240c957666543
SHA1f00c138fc57e62850d7c8480044be4fcafb8eecc
SHA2566390cac03bbc33836a266c97210855e4b02332209bac10d9f69392d385879fd9
SHA5121d746c38b03a26c247529d22beaa405fe5ef1325505c7fa5536d8019201fbf52a1dab77305ac86b7c621bb30bc0d0649417d1620f00df6596cbd894ada3fe65e
-
Filesize
355KB
MD5982de65a74a80ef0853a4683d6a35584
SHA197564f844e9d0366095c163da02d108a85887c6d
SHA256978d1bf59724798652dacac3a7cd3410822b5687467109adae065dec99301de8
SHA5120b3d11a4a99e25b838e4513d24e79aa6c2a5a218a57eda461846ccccf9f8106c192af1deba483074ca95abf9db327e5aebf2b8d2245ff256bb34460820c072a1