Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15-09-2024 20:33
Static task
static1
Behavioral task
behavioral1
Sample
e34e031f90002ad25ca1b315e0a0e1ca_JaffaCakes118.msi
Resource
win7-20240708-en
windows7-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
e34e031f90002ad25ca1b315e0a0e1ca_JaffaCakes118.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
e34e031f90002ad25ca1b315e0a0e1ca_JaffaCakes118.msi
-
Size
2.0MB
-
MD5
e34e031f90002ad25ca1b315e0a0e1ca
-
SHA1
ed594f951eed29c1354e6d9e65f82cc27b39b060
-
SHA256
60c410c65d8b07444b092f5fb71b2b3f071a0cb92230fad7211551309611d899
-
SHA512
4c08ffaa9301f963c54cb8aa17bce30d833121b056c06903606ca1fe0d9e3a112b20ae72dde5e623acdf3bde15e75830f43f86594eed46e3ddc411e2bee9149f
-
SSDEEP
24576:w9Uoe69/dlRsxV7/igVTHl+mwmbz0Zl+p/+c6qacm5PO/k:mUoe61SxwgVj4mboZiU
Malware Config
Extracted
Family
vidar
Version
26.1
Botnet
615
C2
http://centos10.com/
Attributes
-
profile_id
615
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
resource yara_rule behavioral1/memory/1848-52-0x00000000053F0000-0x0000000005486000-memory.dmp rezer0 -
Vidar Stealer 3 IoCs
resource yara_rule behavioral1/memory/2136-59-0x0000000000400000-0x000000000048D000-memory.dmp family_vidar behavioral1/memory/2136-63-0x0000000000400000-0x000000000048D000-memory.dmp family_vidar behavioral1/memory/2136-62-0x0000000000400000-0x000000000048D000-memory.dmp family_vidar -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1848 set thread context of 2136 1848 update_.exe 40 -
Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI2E08.tmp msiexec.exe File created C:\Windows\Installer\f76d79a.msi msiexec.exe File opened for modification C:\Windows\Installer\f76d79a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2D29.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2D3A.tmp msiexec.exe File created C:\Windows\Installer\f76d79d.msi msiexec.exe File opened for modification C:\Windows\Installer\{1BCCC744-C9F2-4623-BB86-4B588A51334D}\ProductIcon msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f76d79b.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f76d79b.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\MSID865.tmp msiexec.exe File created C:\Windows\Installer\{1BCCC744-C9F2-4623-BB86-4B588A51334D}\ProductIcon msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe -
Executes dropped EXE 1 IoCs
pid Process 1848 update_.exe -
Loads dropped DLL 7 IoCs
pid Process 2772 MsiExec.exe 2772 MsiExec.exe 2772 MsiExec.exe 2772 MsiExec.exe 2772 MsiExec.exe 2772 MsiExec.exe 2772 MsiExec.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 776 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language expand.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language update_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegSvcs.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegSvcs.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe -
Modifies registry class 23 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\447CCCB12F9C3264BB68B485A81533D4\ProductFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\ProductName = "setup" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\PackageCode = "C10CDC6E570C4CA43B2950E45D8BE53F" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\447CCCB12F9C3264BB68B485A81533D4 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\SourceList\Media msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4D8C7751FCEC9AC4BB70FBE6F1982114 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4D8C7751FCEC9AC4BB70FBE6F1982114\447CCCB12F9C3264BB68B485A81533D4 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\ProductIcon = "C:\\Windows\\Installer\\{1BCCC744-C9F2-4623-BB86-4B588A51334D}\\ProductIcon" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\SourceList\PackageName = "e34e031f90002ad25ca1b315e0a0e1ca_JaffaCakes118.msi" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\447CCCB12F9C3264BB68B485A81533D4\Assignment = "1" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2484 msiexec.exe 2484 msiexec.exe 1848 update_.exe 1848 update_.exe 1848 update_.exe 1848 update_.exe 1848 update_.exe 2136 RegSvcs.exe 2136 RegSvcs.exe 2136 RegSvcs.exe 2136 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 776 msiexec.exe Token: SeIncreaseQuotaPrivilege 776 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeSecurityPrivilege 2484 msiexec.exe Token: SeCreateTokenPrivilege 776 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 776 msiexec.exe Token: SeLockMemoryPrivilege 776 msiexec.exe Token: SeIncreaseQuotaPrivilege 776 msiexec.exe Token: SeMachineAccountPrivilege 776 msiexec.exe Token: SeTcbPrivilege 776 msiexec.exe Token: SeSecurityPrivilege 776 msiexec.exe Token: SeTakeOwnershipPrivilege 776 msiexec.exe Token: SeLoadDriverPrivilege 776 msiexec.exe Token: SeSystemProfilePrivilege 776 msiexec.exe Token: SeSystemtimePrivilege 776 msiexec.exe Token: SeProfSingleProcessPrivilege 776 msiexec.exe Token: SeIncBasePriorityPrivilege 776 msiexec.exe Token: SeCreatePagefilePrivilege 776 msiexec.exe Token: SeCreatePermanentPrivilege 776 msiexec.exe Token: SeBackupPrivilege 776 msiexec.exe Token: SeRestorePrivilege 776 msiexec.exe Token: SeShutdownPrivilege 776 msiexec.exe Token: SeDebugPrivilege 776 msiexec.exe Token: SeAuditPrivilege 776 msiexec.exe Token: SeSystemEnvironmentPrivilege 776 msiexec.exe Token: SeChangeNotifyPrivilege 776 msiexec.exe Token: SeRemoteShutdownPrivilege 776 msiexec.exe Token: SeUndockPrivilege 776 msiexec.exe Token: SeSyncAgentPrivilege 776 msiexec.exe Token: SeEnableDelegationPrivilege 776 msiexec.exe Token: SeManageVolumePrivilege 776 msiexec.exe Token: SeImpersonatePrivilege 776 msiexec.exe Token: SeCreateGlobalPrivilege 776 msiexec.exe Token: SeBackupPrivilege 3004 vssvc.exe Token: SeRestorePrivilege 3004 vssvc.exe Token: SeAuditPrivilege 3004 vssvc.exe Token: SeBackupPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2852 DrvInst.exe Token: SeRestorePrivilege 2852 DrvInst.exe Token: SeRestorePrivilege 2852 DrvInst.exe Token: SeRestorePrivilege 2852 DrvInst.exe Token: SeRestorePrivilege 2852 DrvInst.exe Token: SeRestorePrivilege 2852 DrvInst.exe Token: SeRestorePrivilege 2852 DrvInst.exe Token: SeLoadDriverPrivilege 2852 DrvInst.exe Token: SeLoadDriverPrivilege 2852 DrvInst.exe Token: SeLoadDriverPrivilege 2852 DrvInst.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeDebugPrivilege 1848 update_.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe Token: SeRestorePrivilege 2484 msiexec.exe Token: SeTakeOwnershipPrivilege 2484 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 776 msiexec.exe 776 msiexec.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2484 wrote to memory of 2772 2484 msiexec.exe 35 PID 2484 wrote to memory of 2772 2484 msiexec.exe 35 PID 2484 wrote to memory of 2772 2484 msiexec.exe 35 PID 2484 wrote to memory of 2772 2484 msiexec.exe 35 PID 2484 wrote to memory of 2772 2484 msiexec.exe 35 PID 2484 wrote to memory of 2772 2484 msiexec.exe 35 PID 2484 wrote to memory of 2772 2484 msiexec.exe 35 PID 2772 wrote to memory of 1420 2772 MsiExec.exe 36 PID 2772 wrote to memory of 1420 2772 MsiExec.exe 36 PID 2772 wrote to memory of 1420 2772 MsiExec.exe 36 PID 2772 wrote to memory of 1420 2772 MsiExec.exe 36 PID 2772 wrote to memory of 1848 2772 MsiExec.exe 38 PID 2772 wrote to memory of 1848 2772 MsiExec.exe 38 PID 2772 wrote to memory of 1848 2772 MsiExec.exe 38 PID 2772 wrote to memory of 1848 2772 MsiExec.exe 38 PID 2772 wrote to memory of 1848 2772 MsiExec.exe 38 PID 2772 wrote to memory of 1848 2772 MsiExec.exe 38 PID 2772 wrote to memory of 1848 2772 MsiExec.exe 38 PID 1848 wrote to memory of 2568 1848 update_.exe 39 PID 1848 wrote to memory of 2568 1848 update_.exe 39 PID 1848 wrote to memory of 2568 1848 update_.exe 39 PID 1848 wrote to memory of 2568 1848 update_.exe 39 PID 1848 wrote to memory of 2568 1848 update_.exe 39 PID 1848 wrote to memory of 2568 1848 update_.exe 39 PID 1848 wrote to memory of 2568 1848 update_.exe 39 PID 1848 wrote to memory of 2136 1848 update_.exe 40 PID 1848 wrote to memory of 2136 1848 update_.exe 40 PID 1848 wrote to memory of 2136 1848 update_.exe 40 PID 1848 wrote to memory of 2136 1848 update_.exe 40 PID 1848 wrote to memory of 2136 1848 update_.exe 40 PID 1848 wrote to memory of 2136 1848 update_.exe 40 PID 1848 wrote to memory of 2136 1848 update_.exe 40 PID 1848 wrote to memory of 2136 1848 update_.exe 40 PID 1848 wrote to memory of 2136 1848 update_.exe 40 PID 1848 wrote to memory of 2136 1848 update_.exe 40 PID 1848 wrote to memory of 2136 1848 update_.exe 40 PID 1848 wrote to memory of 2136 1848 update_.exe 40 PID 2772 wrote to memory of 1668 2772 MsiExec.exe 41 PID 2772 wrote to memory of 1668 2772 MsiExec.exe 41 PID 2772 wrote to memory of 1668 2772 MsiExec.exe 41 PID 2772 wrote to memory of 1668 2772 MsiExec.exe 41 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\e34e031f90002ad25ca1b315e0a0e1ca_JaffaCakes118.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:776
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D03C053803D43151CF20A43296A7F5D92⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\expand.exe"C:\Windows\System32\expand.exe" -R files.cab -F:* files3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1420
-
-
C:\Users\Admin\AppData\Local\Temp\MW-4aafab00-f438-4e3d-99b2-7ec05c519f41\files\update_.exe"C:\Users\Admin\AppData\Local\Temp\MW-4aafab00-f438-4e3d-99b2-7ec05c519f41\files\update_.exe"3⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"4⤵PID:2568
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"4⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2136
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-4aafab00-f438-4e3d-99b2-7ec05c519f41\files"3⤵
- System Location Discovery: System Language Discovery
PID:1668
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003EC" "00000000000003DC"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2852
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD515f612e55ce395fe51f2e3d4c38366d0
SHA1c0f10b19f6f58b4bff20ce24f687504a1ca877ee
SHA256080f38c1dc637b0ce77e80b49b30246d3f66c8634258bcbaf8ae5689b3823210
SHA5123bbc582979da0b85d4c8af025d955dd3452152f1d3ca33be7ed0d47edf9440ebbc5ed2b15d7227256fb1da8fbb94e5b1e268589c3da8aca0cef46fd1c6815443
-
Filesize
1.6MB
MD5483df885be4c8437b1911eff9850dda7
SHA106a57536d2c68c0c20d1ca3d7d451ac1280dd4f3
SHA256ecd1378d316af9c3412409bcd7e75209bcfc059ec168ee1ffbb1e6f4aad05834
SHA512007b3f6cee62f09338c02422066ecda15c04d95d713c0084af0d6d3af78f6be13e8bbbffc63aecbefd3aa114bc7856b044131785526cba61981c8558c373d079
-
Filesize
1.6MB
MD58997b830816a345baf25f94e8033f92a
SHA1f398d7c660d0d2e5e3f8fc7c88818f52d22ed008
SHA256af104f0f0c43600e5116b57f3e89f044c225850cee16a4e1a1d37d0272d20e52
SHA51257d50ac553fecf6a06c37cdefded2481488a132764c906ac90a4da6b6c5006d5cb1aaddcdea0910c511b47298ccf8cf0b1695ada9b01d7edb25a6a2008a563ba
-
Filesize
459B
MD51093e0e1d16ba8ef355876f86022f162
SHA1caf6fcae0b0df34aec922451c15cd0ae0d8286f3
SHA256a0fd570b31f1a43ecdcc4714efc715af9dec659acc4a565ab863da4507698e4e
SHA51220d4dbfb31843fd1e932231c0fe03b6099bffb7eeb0b7ae8db67aacf1450c821c3a262bd2a64f609c3fd4a5ffadd0ac99ef4ddc3d1f8a8d3a2ab71118dc2d63c
-
Filesize
128KB
MD53e9d2974fd83d2c22b647d36a2ba7861
SHA13b1d50d42235439d456444f7d3b573f93ecdbe5f
SHA256339ad75878735d68ccf46bd6f2a73908e4b97be2b947b913e3472dda2c35135a
SHA512e97fdb1d0053d20e7d869d664662f3a845a8b64103e1876513793adff5a190b110d7c221b81102e7e1f6c902dcf0ade18ade2299d3083917d3673aa3ba4ebb9f