Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14-09-2024 06:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe
-
Size
556KB
-
MD5
df9f83686c697a68d57f5983d39f52ee
-
SHA1
46ae2d9fa980e492d59f67ed20ab0803c05d81ea
-
SHA256
53bdb5ed28aaac05555364dcc5dafb711d5f1f9d1b1f75b2956db56ba37adc6c
-
SHA512
47a98791bc2ae5555ca31391e4493be27d2f6d7c6be8bbd2f900fa281ba2b9cf447fc9be7ee70c6afb506b3495b0c8264ea508f9a762432ccb6b3b2b23b7f482
-
SSDEEP
6144:lj6/wndfF/gl0LQIk8DR3dEuAI7pEfxsZozAm9TMdGQLUg1nYmefPImdrionr:t6onxOp8FySpE5zvIdtU+Ymef
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" zutaugdhjed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" zutaugdhjed.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zutaugdhjed.exe -
Adds policy Run key to start application 2 TTPs 25 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xhlnv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iharoeytlhkowmpkqded.exe" zutaugdhjed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xhlnv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uperkwmdrjiimyxo.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kxejuygp = "uperkwmdrjiimyxo.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xhlnv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bxnbvizrgzzafsskn.exe" vhnrbel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xhlnv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vtlbxmfzqlnqxmoinzz.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kxejuygp = "vtlbxmfzqlnqxmoinzz.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xhlnv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khyniwohxrsuaopimx.exe" vhnrbel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run zutaugdhjed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xhlnv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xxrjhytpifjoxosovjllf.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kxejuygp = "bxnbvizrgzzafsskn.exe" zutaugdhjed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kxejuygp = "iharoeytlhkowmpkqded.exe" zutaugdhjed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kxejuygp = "iharoeytlhkowmpkqded.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xhlnv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bxnbvizrgzzafsskn.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kxejuygp = "khyniwohxrsuaopimx.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xhlnv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vtlbxmfzqlnqxmoinzz.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kxejuygp = "xxrjhytpifjoxosovjllf.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xhlnv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iharoeytlhkowmpkqded.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kxejuygp = "iharoeytlhkowmpkqded.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kxejuygp = "khyniwohxrsuaopimx.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kxejuygp = "uperkwmdrjiimyxo.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xhlnv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xxrjhytpifjoxosovjllf.exe" vhnrbel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run zutaugdhjed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xhlnv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iharoeytlhkowmpkqded.exe" zutaugdhjed.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zutaugdhjed.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vhnrbel.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vhnrbel.exe -
Executes dropped EXE 4 IoCs
pid Process 2244 zutaugdhjed.exe 692 vhnrbel.exe 2640 vhnrbel.exe 2968 zutaugdhjed.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend vhnrbel.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc vhnrbel.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power vhnrbel.exe -
Loads dropped DLL 8 IoCs
pid Process 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2244 zutaugdhjed.exe 2244 zutaugdhjed.exe 2244 zutaugdhjed.exe 2244 zutaugdhjed.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ujszmscnvh = "khyniwohxrsuaopimx.exe ." zutaugdhjed.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\itybkm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uperkwmdrjiimyxo.exe" vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpxdpudnu = "khyniwohxrsuaopimx.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pfpxlsdpylf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khyniwohxrsuaopimx.exe ." vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\itybkm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xxrjhytpifjoxosovjllf.exe" vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\itybkm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bxnbvizrgzzafsskn.exe" vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpxdpudnu = "uperkwmdrjiimyxo.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mdoxmugtdrmi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iharoeytlhkowmpkqded.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\itybkm = "vtlbxmfzqlnqxmoinzz.exe" vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\itybkm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vtlbxmfzqlnqxmoinzz.exe" vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ujszmscnvh = "xxrjhytpifjoxosovjllf.exe ." vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpxdpudnu = "bxnbvizrgzzafsskn.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mdoxmugtdrmi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khyniwohxrsuaopimx.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\itybkm = "bxnbvizrgzzafsskn.exe" vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ujszmscnvh = "bxnbvizrgzzafsskn.exe ." vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpxdpudnu = "vtlbxmfzqlnqxmoinzz.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pfpxlsdpylf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bxnbvizrgzzafsskn.exe ." vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpxdpudnu = "iharoeytlhkowmpkqded.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vhnrbel = "khyniwohxrsuaopimx.exe ." vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\itybkm = "iharoeytlhkowmpkqded.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\itybkm = "vtlbxmfzqlnqxmoinzz.exe" zutaugdhjed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vhnrbel = "bxnbvizrgzzafsskn.exe ." vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pfpxlsdpylf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khyniwohxrsuaopimx.exe ." vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vhnrbel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uperkwmdrjiimyxo.exe ." zutaugdhjed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vhnrbel = "iharoeytlhkowmpkqded.exe ." zutaugdhjed.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vhnrbel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iharoeytlhkowmpkqded.exe ." zutaugdhjed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\itybkm = "uperkwmdrjiimyxo.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\itybkm = "vtlbxmfzqlnqxmoinzz.exe" zutaugdhjed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\itybkm = "khyniwohxrsuaopimx.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\itybkm = "iharoeytlhkowmpkqded.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vhnrbel = "iharoeytlhkowmpkqded.exe ." zutaugdhjed.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\itybkm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uperkwmdrjiimyxo.exe" zutaugdhjed.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\itybkm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iharoeytlhkowmpkqded.exe" vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpxdpudnu = "khyniwohxrsuaopimx.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pfpxlsdpylf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iharoeytlhkowmpkqded.exe ." zutaugdhjed.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ujszmscnvh = "uperkwmdrjiimyxo.exe ." vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pfpxlsdpylf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iharoeytlhkowmpkqded.exe ." vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\itybkm = "xxrjhytpifjoxosovjllf.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vhnrbel = "iharoeytlhkowmpkqded.exe ." vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vhnrbel = "xxrjhytpifjoxosovjllf.exe ." vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\itybkm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khyniwohxrsuaopimx.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vhnrbel = "vtlbxmfzqlnqxmoinzz.exe ." vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vhnrbel = "uperkwmdrjiimyxo.exe ." vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pfpxlsdpylf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xxrjhytpifjoxosovjllf.exe ." vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpxdpudnu = "bxnbvizrgzzafsskn.exe" vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vhnrbel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khyniwohxrsuaopimx.exe ." vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vhnrbel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iharoeytlhkowmpkqded.exe ." vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mdoxmugtdrmi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vtlbxmfzqlnqxmoinzz.exe" vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\itybkm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vtlbxmfzqlnqxmoinzz.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\itybkm = "uperkwmdrjiimyxo.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vhnrbel = "bxnbvizrgzzafsskn.exe ." vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vhnrbel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uperkwmdrjiimyxo.exe ." vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mdoxmugtdrmi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uperkwmdrjiimyxo.exe" zutaugdhjed.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\itybkm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iharoeytlhkowmpkqded.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\itybkm = "khyniwohxrsuaopimx.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mdoxmugtdrmi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uperkwmdrjiimyxo.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\itybkm = "vtlbxmfzqlnqxmoinzz.exe" vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpxdpudnu = "xxrjhytpifjoxosovjllf.exe" vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\itybkm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khyniwohxrsuaopimx.exe" vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pfpxlsdpylf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vtlbxmfzqlnqxmoinzz.exe ." vhnrbel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pfpxlsdpylf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\khyniwohxrsuaopimx.exe ." zutaugdhjed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\itybkm = "xxrjhytpifjoxosovjllf.exe" vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpxdpudnu = "iharoeytlhkowmpkqded.exe" vhnrbel.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vhnrbel = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bxnbvizrgzzafsskn.exe ." vhnrbel.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zutaugdhjed.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zutaugdhjed.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vhnrbel.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vhnrbel.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vhnrbel.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" vhnrbel.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 www.whatismyip.ca 2 www.showmyipaddress.com 4 whatismyipaddress.com 7 whatismyip.everdot.org -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf vhnrbel.exe File opened for modification F:\autorun.inf vhnrbel.exe File created F:\autorun.inf vhnrbel.exe File opened for modification C:\autorun.inf vhnrbel.exe -
Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\bxnbvizrgzzafsskn.exe vhnrbel.exe File opened for modification C:\Windows\SysWOW64\bxnbvizrgzzafsskn.exe zutaugdhjed.exe File opened for modification C:\Windows\SysWOW64\iharoeytlhkowmpkqded.exe zutaugdhjed.exe File opened for modification C:\Windows\SysWOW64\khyniwohxrsuaopimx.exe zutaugdhjed.exe File opened for modification C:\Windows\SysWOW64\iharoeytlhkowmpkqded.exe zutaugdhjed.exe File opened for modification C:\Windows\SysWOW64\opkdcuqnhfkqasxucruvqj.exe zutaugdhjed.exe File opened for modification C:\Windows\SysWOW64\uperkwmdrjiimyxo.exe vhnrbel.exe File opened for modification C:\Windows\SysWOW64\xxrjhytpifjoxosovjllf.exe vhnrbel.exe File created C:\Windows\SysWOW64\zdbxzuttqrzivqyyjbhlj.hcb vhnrbel.exe File opened for modification C:\Windows\SysWOW64\opkdcuqnhfkqasxucruvqj.exe zutaugdhjed.exe File opened for modification C:\Windows\SysWOW64\uperkwmdrjiimyxo.exe zutaugdhjed.exe File opened for modification C:\Windows\SysWOW64\xxrjhytpifjoxosovjllf.exe zutaugdhjed.exe File opened for modification C:\Windows\SysWOW64\bxnbvizrgzzafsskn.exe vhnrbel.exe File opened for modification C:\Windows\SysWOW64\iharoeytlhkowmpkqded.exe vhnrbel.exe File opened for modification C:\Windows\SysWOW64\zdbxzuttqrzivqyyjbhlj.hcb vhnrbel.exe File opened for modification C:\Windows\SysWOW64\ujszmscnvhausyrcybshqxkqaltfysqw.awz vhnrbel.exe File opened for modification C:\Windows\SysWOW64\bxnbvizrgzzafsskn.exe zutaugdhjed.exe File created C:\Windows\SysWOW64\ujszmscnvhausyrcybshqxkqaltfysqw.awz vhnrbel.exe File opened for modification C:\Windows\SysWOW64\xxrjhytpifjoxosovjllf.exe zutaugdhjed.exe File opened for modification C:\Windows\SysWOW64\vtlbxmfzqlnqxmoinzz.exe zutaugdhjed.exe File opened for modification C:\Windows\SysWOW64\iharoeytlhkowmpkqded.exe vhnrbel.exe File opened for modification C:\Windows\SysWOW64\uperkwmdrjiimyxo.exe vhnrbel.exe File opened for modification C:\Windows\SysWOW64\vtlbxmfzqlnqxmoinzz.exe vhnrbel.exe File opened for modification C:\Windows\SysWOW64\khyniwohxrsuaopimx.exe vhnrbel.exe File opened for modification C:\Windows\SysWOW64\khyniwohxrsuaopimx.exe zutaugdhjed.exe File opened for modification C:\Windows\SysWOW64\vtlbxmfzqlnqxmoinzz.exe zutaugdhjed.exe File opened for modification C:\Windows\SysWOW64\vtlbxmfzqlnqxmoinzz.exe vhnrbel.exe File opened for modification C:\Windows\SysWOW64\opkdcuqnhfkqasxucruvqj.exe vhnrbel.exe File opened for modification C:\Windows\SysWOW64\xxrjhytpifjoxosovjllf.exe vhnrbel.exe File opened for modification C:\Windows\SysWOW64\opkdcuqnhfkqasxucruvqj.exe vhnrbel.exe File opened for modification C:\Windows\SysWOW64\khyniwohxrsuaopimx.exe vhnrbel.exe File opened for modification C:\Windows\SysWOW64\uperkwmdrjiimyxo.exe zutaugdhjed.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\ujszmscnvhausyrcybshqxkqaltfysqw.awz vhnrbel.exe File opened for modification C:\Program Files (x86)\zdbxzuttqrzivqyyjbhlj.hcb vhnrbel.exe File created C:\Program Files (x86)\zdbxzuttqrzivqyyjbhlj.hcb vhnrbel.exe File opened for modification C:\Program Files (x86)\ujszmscnvhausyrcybshqxkqaltfysqw.awz vhnrbel.exe -
Drops file in Windows directory 32 IoCs
description ioc Process File opened for modification C:\Windows\opkdcuqnhfkqasxucruvqj.exe vhnrbel.exe File opened for modification C:\Windows\opkdcuqnhfkqasxucruvqj.exe zutaugdhjed.exe File opened for modification C:\Windows\bxnbvizrgzzafsskn.exe vhnrbel.exe File opened for modification C:\Windows\vtlbxmfzqlnqxmoinzz.exe zutaugdhjed.exe File opened for modification C:\Windows\khyniwohxrsuaopimx.exe vhnrbel.exe File opened for modification C:\Windows\iharoeytlhkowmpkqded.exe vhnrbel.exe File opened for modification C:\Windows\opkdcuqnhfkqasxucruvqj.exe vhnrbel.exe File opened for modification C:\Windows\zdbxzuttqrzivqyyjbhlj.hcb vhnrbel.exe File opened for modification C:\Windows\iharoeytlhkowmpkqded.exe zutaugdhjed.exe File opened for modification C:\Windows\xxrjhytpifjoxosovjllf.exe zutaugdhjed.exe File opened for modification C:\Windows\bxnbvizrgzzafsskn.exe zutaugdhjed.exe File opened for modification C:\Windows\iharoeytlhkowmpkqded.exe vhnrbel.exe File opened for modification C:\Windows\xxrjhytpifjoxosovjllf.exe vhnrbel.exe File opened for modification C:\Windows\uperkwmdrjiimyxo.exe vhnrbel.exe File opened for modification C:\Windows\xxrjhytpifjoxosovjllf.exe vhnrbel.exe File opened for modification C:\Windows\uperkwmdrjiimyxo.exe zutaugdhjed.exe File opened for modification C:\Windows\bxnbvizrgzzafsskn.exe zutaugdhjed.exe File opened for modification C:\Windows\khyniwohxrsuaopimx.exe zutaugdhjed.exe File opened for modification C:\Windows\vtlbxmfzqlnqxmoinzz.exe vhnrbel.exe File opened for modification C:\Windows\vtlbxmfzqlnqxmoinzz.exe vhnrbel.exe File opened for modification C:\Windows\vtlbxmfzqlnqxmoinzz.exe zutaugdhjed.exe File opened for modification C:\Windows\uperkwmdrjiimyxo.exe zutaugdhjed.exe File opened for modification C:\Windows\iharoeytlhkowmpkqded.exe zutaugdhjed.exe File opened for modification C:\Windows\bxnbvizrgzzafsskn.exe vhnrbel.exe File opened for modification C:\Windows\khyniwohxrsuaopimx.exe vhnrbel.exe File created C:\Windows\zdbxzuttqrzivqyyjbhlj.hcb vhnrbel.exe File opened for modification C:\Windows\ujszmscnvhausyrcybshqxkqaltfysqw.awz vhnrbel.exe File created C:\Windows\ujszmscnvhausyrcybshqxkqaltfysqw.awz vhnrbel.exe File opened for modification C:\Windows\khyniwohxrsuaopimx.exe zutaugdhjed.exe File opened for modification C:\Windows\xxrjhytpifjoxosovjllf.exe zutaugdhjed.exe File opened for modification C:\Windows\uperkwmdrjiimyxo.exe vhnrbel.exe File opened for modification C:\Windows\opkdcuqnhfkqasxucruvqj.exe zutaugdhjed.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhnrbel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zutaugdhjed.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 692 vhnrbel.exe 692 vhnrbel.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 692 vhnrbel.exe 692 vhnrbel.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 692 vhnrbel.exe 692 vhnrbel.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 692 vhnrbel.exe 692 vhnrbel.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 692 vhnrbel.exe 692 vhnrbel.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 692 vhnrbel.exe 692 vhnrbel.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 692 vhnrbel.exe 692 vhnrbel.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 692 vhnrbel.exe 692 vhnrbel.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 692 vhnrbel.exe 692 vhnrbel.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 692 vhnrbel.exe 692 vhnrbel.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 692 vhnrbel.exe 692 vhnrbel.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 692 vhnrbel.exe 692 vhnrbel.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 692 vhnrbel.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2244 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 30 PID 2692 wrote to memory of 2244 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 30 PID 2692 wrote to memory of 2244 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 30 PID 2692 wrote to memory of 2244 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 30 PID 2244 wrote to memory of 692 2244 zutaugdhjed.exe 31 PID 2244 wrote to memory of 692 2244 zutaugdhjed.exe 31 PID 2244 wrote to memory of 692 2244 zutaugdhjed.exe 31 PID 2244 wrote to memory of 692 2244 zutaugdhjed.exe 31 PID 2244 wrote to memory of 2640 2244 zutaugdhjed.exe 32 PID 2244 wrote to memory of 2640 2244 zutaugdhjed.exe 32 PID 2244 wrote to memory of 2640 2244 zutaugdhjed.exe 32 PID 2244 wrote to memory of 2640 2244 zutaugdhjed.exe 32 PID 2692 wrote to memory of 2968 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 34 PID 2692 wrote to memory of 2968 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 34 PID 2692 wrote to memory of 2968 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 34 PID 2692 wrote to memory of 2968 2692 df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe 34 -
System policy modification 1 TTPs 38 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" zutaugdhjed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" zutaugdhjed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" vhnrbel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vhnrbel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" vhnrbel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" vhnrbel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" vhnrbel.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" zutaugdhjed.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System zutaugdhjed.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zutaugdhjed.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\df9f83686c697a68d57f5983d39f52ee_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\zutaugdhjed.exe"C:\Users\Admin\AppData\Local\Temp\zutaugdhjed.exe" "c:\users\admin\appdata\local\temp\df9f83686c697a68d57f5983d39f52ee_jaffacakes118.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\vhnrbel.exe"C:\Users\Admin\AppData\Local\Temp\vhnrbel.exe" "-C:\Users\Admin\AppData\Local\Temp\uperkwmdrjiimyxo.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:692
-
-
C:\Users\Admin\AppData\Local\Temp\vhnrbel.exe"C:\Users\Admin\AppData\Local\Temp\vhnrbel.exe" "-C:\Users\Admin\AppData\Local\Temp\uperkwmdrjiimyxo.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2640
-
-
-
C:\Users\Admin\AppData\Local\Temp\zutaugdhjed.exe"C:\Users\Admin\AppData\Local\Temp\zutaugdhjed.exe" "c:\users\admin\appdata\local\temp\df9f83686c697a68d57f5983d39f52ee_jaffacakes118.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2968
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272B
MD53298f191af240666841a48c805b456a2
SHA1cc4c3a41702d2154199b8b8f5163d13e9e6b08a0
SHA256ddbd783f1f12279233874711b17b602a461071b2207013eee4f457391540dc8b
SHA51236063355b074e86c802c84414abb46dc912235adcdcb69ea3141c8b0aba030b9d494aa152ded3daad285886c8bbf9dfa02481efbdbf5d4ab209a57cbaaf3f0d7
-
Filesize
272B
MD595deb165bca703c731542aad7375f871
SHA13a958cbd555fc41243135eedce2f1bfca1ae6538
SHA256611da6210f0a2c2ebffe3d0d9e767b6dbc5bb086c8c444653ac13f94b08ce92e
SHA512fb2aeeaf98182fa5bb3c48af15a5089135145b108bf981f11535a719fa6ec2281523eb22f357bfe7513a01143f85fd87d811910e52453eabe03e58d168092c2a
-
Filesize
272B
MD5b87fe2f9fc8c78677d4087d9a36a9576
SHA1988e0474107811137ad519e02fa1daaff886bdc0
SHA256606cae6162028bad1696e2a77f1e47b094d14d4c07489e32d68871f5f471644a
SHA512028d2ad23112dec065f3110e168343d94508f357bedebf585689531ebaf3a785261ada1c6c383214f486d17e70c861d07c19c6f7f790479b3a523870f978ef23
-
Filesize
272B
MD5fa33e5b87a62f12cebb021ba59acb6ce
SHA10cc16915e6667bf86c0474ecd52a47f4729d2578
SHA2566299bec6a0453e5855db3b196f49a02811ae393362fa7a83c39703c4109ff852
SHA512e03b630e16fd3e9a5fdb3151af28dce9c0d609b5488f934e5a3525fdf8d9840cb8df6610144cc72c829d226a2a67130b4e2ef47de6847364c1ab483bede8927c
-
Filesize
320KB
MD55203b6ea0901877fbf2d8d6f6d8d338e
SHA1c803e92561921b38abe13239c1fd85605b570936
SHA2560cc02d34d5fd4cf892fed282f98c1ad3e7dd6159a8877ae5c46d3f834ed36060
SHA512d48a41b4fc4c38a6473f789c02918fb7353a4b4199768a3624f3b685d91d38519887a1ccd3616e0d2b079a346afaec5a0f2ef2c46d72d3097ef561cedb476471
-
Filesize
3KB
MD5ba8f557a026f131dfb2be5735a902b4d
SHA1e14a6759a26887115c7feb7bb47fc2f197712aae
SHA256e0f52466406d1fa5557f0bbcab834a81efb86344131debef80a27603c7cb2e61
SHA512b61111b39582b8dfb5c98acb179109edff5ef744833dd1c32117f019c53bbbc582958d5302b992abc370872c2cf2f1c35530755cecbd29fc001ed471b8e90754
-
Filesize
272B
MD5d28d215a25db7c769c508cdcb3ce48f7
SHA140f2eaa018b8d89aca02fd779841ef9d55702c26
SHA256c0785cc6f58b93c86bdcea1e583cb66b8c9ebbedbef50ce19030affb84eb5909
SHA5121052d7712583571a27817863a1a0f9c0d01eab07a9487a9a899dafd7d75af6cc1d68cfc74738114354376f19468117e1a5034eb1f4ed03ff8c39bcf69f80c23e
-
Filesize
272B
MD50cebc15820dacf93b20ccfd9867c2459
SHA142823b393ec524e3357aeef918fdfebc2e8736ca
SHA256dab6012eca82961514e319721c93156cc6000a10b05bc394dbe64fdaf66182c1
SHA512fd252ab101a2b9975bd89549b2578e0333f6c3683fe2aae9bb6780ec4a5ef36b149045f8bf33222ea3fbdb06ad16f493d76ff8635c060a1ed3e7790fb342946d
-
Filesize
272B
MD577d138953ea594cedc71c6731bbc7640
SHA1f4207d17727282839936c6ba3f66bfb834b58be2
SHA256bf48ebdd95c3f97f441fb5e2d6cd338ec1740e81a8d37d1f99225ad57d937273
SHA5123799502c3d656d533d42fef9c1772b8635a59632f4aa0262d033a3b7d68d30257752b2e6635fa45c261628d13fd087760ff048996c6673b5a9f2d93d37f6e049
-
Filesize
272B
MD5822ff0fffaa8b3faaeb6b15f83909436
SHA1f96cf3a0e17d8441604d18a2acf3017f4b65b695
SHA256bc394d1366dd1c345dfe330a81e2ad14def83c5e21f31d528f0dfd70dd49b1b4
SHA5129dd86c344e334104f3ebfaf5bfed780fb74df5fb0ae83b06b4a58f02873c7b8e3b1c93cb8c8e4f00e68c6333d2226b8805bb3166a72b20665eeae6d12b2dd82f
-
Filesize
556KB
MD5df9f83686c697a68d57f5983d39f52ee
SHA146ae2d9fa980e492d59f67ed20ab0803c05d81ea
SHA25653bdb5ed28aaac05555364dcc5dafb711d5f1f9d1b1f75b2956db56ba37adc6c
SHA51247a98791bc2ae5555ca31391e4493be27d2f6d7c6be8bbd2f900fa281ba2b9cf447fc9be7ee70c6afb506b3495b0c8264ea508f9a762432ccb6b3b2b23b7f482
-
Filesize
700KB
MD5e662a780e0ad6083b91e08968b4f4535
SHA191e34c12956b23b884cf7d8a64d791c64d5ef5a0
SHA2565b06fa6ac273e560e85151464f4248018fbc57836cd5c9e3e72c36f3053556b0
SHA5122fea000b382fcfaddf5768a571c01a28114f04a856ab9d4da2283af9d3f09e240f098c14902d9719b1dbc2de1ff6d2e0f5df27bf2b1e2e93ea27ff6993c479a5