Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/09/2024, 11:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe
-
Size
464KB
-
MD5
ed82058eda9e6ad70b2a81a3b3c0767c
-
SHA1
19e729460740a8371c408b91fbb28358f6b635f8
-
SHA256
a9b2531420fa9044d3a9c4d8f73c947751f4233aa913ea9a7d6cf8835de5c8bc
-
SHA512
721627d74703832c208c1c9fdd587ec52174571c11331c49f37b406bc25bda4c1540ea0244686885366533e6595f14b5c419f92eb608fa6938d745984d579ce7
-
SSDEEP
6144:8eXajnXTrkY9Nfl7ZOD9aelcbhSF1nfWpVbPP/KCIxijzUd/qHBdjK0DdvRgfAvP:8eX0rkcfstvnf9Cvjod/qSOJ2AvP
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" hgvdkbgzrqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" hgvdkbgzrqf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" eigss.exe -
Adds policy Run key to start application 2 TTPs 31 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wgkcixdoeln = "iyigsnzqmzhmhvifq.exe" hgvdkbgzrqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wgkcixdoeln = "eymoedtoofrazrijybsma.exe" hgvdkbgzrqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wgkcixdoeln = "eymoedtoofrazrijybsma.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wgkcixdoeln = "pivwljysrhsaypfftvle.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wgkcixdoeln = "iyigsnzqmzhmhvifq.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wgkcixdoeln = "cuggurfywlvczpedqrg.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wgkcixdoeln = "cuggurfywlvczpedqrg.exe" hgvdkbgzrqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ryzordgo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ritsfbogdragcrfdpp.exe" hgvdkbgzrqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ryzordgo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ritsfbogdragcrfdpp.exe" eigss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wgkcixdoeln = "bqzwhbmcxjquobnj.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ryzordgo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bqzwhbmcxjquobnj.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wgkcixdoeln = "pivwljysrhsaypfftvle.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wgkcixdoeln = "iyigsnzqmzhmhvifq.exe" eigss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run hgvdkbgzrqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ryzordgo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iyigsnzqmzhmhvifq.exe" hgvdkbgzrqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ryzordgo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pivwljysrhsaypfftvle.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wgkcixdoeln = "ritsfbogdragcrfdpp.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ryzordgo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eymoedtoofrazrijybsma.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ryzordgo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cuggurfywlvczpedqrg.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ryzordgo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bqzwhbmcxjquobnj.exe" eigss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run hgvdkbgzrqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wgkcixdoeln = "cuggurfywlvczpedqrg.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wgkcixdoeln = "ritsfbogdragcrfdpp.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ryzordgo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pivwljysrhsaypfftvle.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ryzordgo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eymoedtoofrazrijybsma.exe" hgvdkbgzrqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ryzordgo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eymoedtoofrazrijybsma.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ryzordgo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iyigsnzqmzhmhvifq.exe" eigss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wgkcixdoeln = "eymoedtoofrazrijybsma.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wgkcixdoeln = "bqzwhbmcxjquobnj.exe" eigss.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" hgvdkbgzrqf.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" eigss.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" eigss.exe -
Executes dropped EXE 4 IoCs
pid Process 2216 hgvdkbgzrqf.exe 2812 eigss.exe 1588 eigss.exe 2840 hgvdkbgzrqf.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend eigss.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc eigss.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power eigss.exe -
Loads dropped DLL 8 IoCs
pid Process 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 2216 hgvdkbgzrqf.exe 2216 hgvdkbgzrqf.exe 2216 hgvdkbgzrqf.exe 2216 hgvdkbgzrqf.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sekemdlyqzdev = "pivwljysrhsaypfftvle.exe ." eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\tejcjzgsjruu = "ritsfbogdragcrfdpp.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tgnirjsgzjoqit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pivwljysrhsaypfftvle.exe ." hgvdkbgzrqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iqsimzdma = "pivwljysrhsaypfftvle.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wksoyrbqkvbexju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bqzwhbmcxjquobnj.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wksoyrbqkvbexju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ritsfbogdragcrfdpp.exe" eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sekemdlyqzdev = "bqzwhbmcxjquobnj.exe ." eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wksoyrbqkvbexju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cuggurfywlvczpedqrg.exe" hgvdkbgzrqf.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\iqsimzdma = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bqzwhbmcxjquobnj.exe" hgvdkbgzrqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bknejxcmbh = "iyigsnzqmzhmhvifq.exe ." eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wksoyrbqkvbexju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cuggurfywlvczpedqrg.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tgnirjsgzjoqit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iyigsnzqmzhmhvifq.exe ." eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bknejxcmbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eymoedtoofrazrijybsma.exe ." eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wksoyrbqkvbexju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pivwljysrhsaypfftvle.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iqsimzdma = "iyigsnzqmzhmhvifq.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iqsimzdma = "bqzwhbmcxjquobnj.exe" hgvdkbgzrqf.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\iqsimzdma = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iyigsnzqmzhmhvifq.exe" eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\tejcjzgsjruu = "cuggurfywlvczpedqrg.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iqsimzdma = "bqzwhbmcxjquobnj.exe" eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bknejxcmbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ritsfbogdragcrfdpp.exe ." eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bknejxcmbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iyigsnzqmzhmhvifq.exe ." eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tgnirjsgzjoqit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iyigsnzqmzhmhvifq.exe ." eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wksoyrbqkvbexju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pivwljysrhsaypfftvle.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tgnirjsgzjoqit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cuggurfywlvczpedqrg.exe ." hgvdkbgzrqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wksoyrbqkvbexju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cuggurfywlvczpedqrg.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wksoyrbqkvbexju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eymoedtoofrazrijybsma.exe" eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\tejcjzgsjruu = "eymoedtoofrazrijybsma.exe" eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bknejxcmbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cuggurfywlvczpedqrg.exe ." hgvdkbgzrqf.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\tejcjzgsjruu = "pivwljysrhsaypfftvle.exe" hgvdkbgzrqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wksoyrbqkvbexju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cuggurfywlvczpedqrg.exe" hgvdkbgzrqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wksoyrbqkvbexju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iyigsnzqmzhmhvifq.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iqsimzdma = "ritsfbogdragcrfdpp.exe" eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sekemdlyqzdev = "eymoedtoofrazrijybsma.exe ." eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tgnirjsgzjoqit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bqzwhbmcxjquobnj.exe ." eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\iqsimzdma = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ritsfbogdragcrfdpp.exe" eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bknejxcmbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ritsfbogdragcrfdpp.exe ." eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\iqsimzdma = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cuggurfywlvczpedqrg.exe" eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sekemdlyqzdev = "eymoedtoofrazrijybsma.exe ." eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\tejcjzgsjruu = "iyigsnzqmzhmhvifq.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wksoyrbqkvbexju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iyigsnzqmzhmhvifq.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tgnirjsgzjoqit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bqzwhbmcxjquobnj.exe ." eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tgnirjsgzjoqit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cuggurfywlvczpedqrg.exe ." eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\iqsimzdma = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iyigsnzqmzhmhvifq.exe" eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bknejxcmbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pivwljysrhsaypfftvle.exe ." eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iqsimzdma = "eymoedtoofrazrijybsma.exe" hgvdkbgzrqf.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\tejcjzgsjruu = "pivwljysrhsaypfftvle.exe" eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bknejxcmbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iyigsnzqmzhmhvifq.exe ." eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sekemdlyqzdev = "iyigsnzqmzhmhvifq.exe ." eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bknejxcmbh = "ritsfbogdragcrfdpp.exe ." eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bknejxcmbh = "pivwljysrhsaypfftvle.exe ." eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bknejxcmbh = "iyigsnzqmzhmhvifq.exe ." hgvdkbgzrqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bknejxcmbh = "bqzwhbmcxjquobnj.exe ." eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bknejxcmbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eymoedtoofrazrijybsma.exe ." eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bknejxcmbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bqzwhbmcxjquobnj.exe ." eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sekemdlyqzdev = "iyigsnzqmzhmhvifq.exe ." eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\tejcjzgsjruu = "iyigsnzqmzhmhvifq.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iqsimzdma = "cuggurfywlvczpedqrg.exe" eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bknejxcmbh = "cuggurfywlvczpedqrg.exe ." eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tgnirjsgzjoqit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ritsfbogdragcrfdpp.exe ." eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sekemdlyqzdev = "ritsfbogdragcrfdpp.exe ." eigss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wksoyrbqkvbexju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bqzwhbmcxjquobnj.exe" eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\tejcjzgsjruu = "pivwljysrhsaypfftvle.exe" eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\tejcjzgsjruu = "bqzwhbmcxjquobnj.exe" eigss.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sekemdlyqzdev = "cuggurfywlvczpedqrg.exe ." eigss.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" eigss.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" hgvdkbgzrqf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" hgvdkbgzrqf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" eigss.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" eigss.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 www.whatismyip.ca 3 whatismyipaddress.com 5 www.showmyipaddress.com 10 whatismyip.everdot.org -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf eigss.exe File created C:\autorun.inf eigss.exe File opened for modification F:\autorun.inf eigss.exe File created F:\autorun.inf eigss.exe -
Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\iyigsnzqmzhmhvifq.exe eigss.exe File opened for modification C:\Windows\SysWOW64\ritsfbogdragcrfdpp.exe eigss.exe File opened for modification C:\Windows\SysWOW64\vyvgfnmqzzumuvvfdppspazhgk.tog eigss.exe File opened for modification C:\Windows\SysWOW64\ritsfbogdragcrfdpp.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\SysWOW64\vqfizzqmnfsccvnpfjbwlo.exe eigss.exe File opened for modification C:\Windows\SysWOW64\bqzwhbmcxjquobnj.exe eigss.exe File opened for modification C:\Windows\SysWOW64\eymoedtoofrazrijybsma.exe eigss.exe File created C:\Windows\SysWOW64\wksoyrbqkvbexjupyvgucyiblauflohtezifq.mis eigss.exe File opened for modification C:\Windows\SysWOW64\eymoedtoofrazrijybsma.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\SysWOW64\pivwljysrhsaypfftvle.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\SysWOW64\iyigsnzqmzhmhvifq.exe eigss.exe File opened for modification C:\Windows\SysWOW64\ritsfbogdragcrfdpp.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\SysWOW64\bqzwhbmcxjquobnj.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\SysWOW64\vqfizzqmnfsccvnpfjbwlo.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\SysWOW64\pivwljysrhsaypfftvle.exe eigss.exe File created C:\Windows\SysWOW64\vyvgfnmqzzumuvvfdppspazhgk.tog eigss.exe File opened for modification C:\Windows\SysWOW64\bqzwhbmcxjquobnj.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\SysWOW64\pivwljysrhsaypfftvle.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\SysWOW64\iyigsnzqmzhmhvifq.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\SysWOW64\ritsfbogdragcrfdpp.exe eigss.exe File opened for modification C:\Windows\SysWOW64\cuggurfywlvczpedqrg.exe eigss.exe File opened for modification C:\Windows\SysWOW64\vqfizzqmnfsccvnpfjbwlo.exe eigss.exe File opened for modification C:\Windows\SysWOW64\cuggurfywlvczpedqrg.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\SysWOW64\cuggurfywlvczpedqrg.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\SysWOW64\eymoedtoofrazrijybsma.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\SysWOW64\bqzwhbmcxjquobnj.exe eigss.exe File opened for modification C:\Windows\SysWOW64\wksoyrbqkvbexjupyvgucyiblauflohtezifq.mis eigss.exe File opened for modification C:\Windows\SysWOW64\iyigsnzqmzhmhvifq.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\SysWOW64\vqfizzqmnfsccvnpfjbwlo.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\SysWOW64\cuggurfywlvczpedqrg.exe eigss.exe File opened for modification C:\Windows\SysWOW64\eymoedtoofrazrijybsma.exe eigss.exe File opened for modification C:\Windows\SysWOW64\pivwljysrhsaypfftvle.exe eigss.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\wksoyrbqkvbexjupyvgucyiblauflohtezifq.mis eigss.exe File opened for modification C:\Program Files (x86)\vyvgfnmqzzumuvvfdppspazhgk.tog eigss.exe File created C:\Program Files (x86)\vyvgfnmqzzumuvvfdppspazhgk.tog eigss.exe File opened for modification C:\Program Files (x86)\wksoyrbqkvbexjupyvgucyiblauflohtezifq.mis eigss.exe -
Drops file in Windows directory 32 IoCs
description ioc Process File created C:\Windows\vyvgfnmqzzumuvvfdppspazhgk.tog eigss.exe File opened for modification C:\Windows\wksoyrbqkvbexjupyvgucyiblauflohtezifq.mis eigss.exe File opened for modification C:\Windows\vqfizzqmnfsccvnpfjbwlo.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\pivwljysrhsaypfftvle.exe eigss.exe File opened for modification C:\Windows\pivwljysrhsaypfftvle.exe eigss.exe File created C:\Windows\wksoyrbqkvbexjupyvgucyiblauflohtezifq.mis eigss.exe File opened for modification C:\Windows\iyigsnzqmzhmhvifq.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\cuggurfywlvczpedqrg.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\ritsfbogdragcrfdpp.exe eigss.exe File opened for modification C:\Windows\eymoedtoofrazrijybsma.exe eigss.exe File opened for modification C:\Windows\vqfizzqmnfsccvnpfjbwlo.exe eigss.exe File opened for modification C:\Windows\bqzwhbmcxjquobnj.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\eymoedtoofrazrijybsma.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\bqzwhbmcxjquobnj.exe eigss.exe File opened for modification C:\Windows\ritsfbogdragcrfdpp.exe eigss.exe File opened for modification C:\Windows\cuggurfywlvczpedqrg.exe eigss.exe File opened for modification C:\Windows\eymoedtoofrazrijybsma.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\pivwljysrhsaypfftvle.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\bqzwhbmcxjquobnj.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\pivwljysrhsaypfftvle.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\iyigsnzqmzhmhvifq.exe eigss.exe File opened for modification C:\Windows\eymoedtoofrazrijybsma.exe eigss.exe File opened for modification C:\Windows\cuggurfywlvczpedqrg.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\ritsfbogdragcrfdpp.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\ritsfbogdragcrfdpp.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\vyvgfnmqzzumuvvfdppspazhgk.tog eigss.exe File opened for modification C:\Windows\vqfizzqmnfsccvnpfjbwlo.exe hgvdkbgzrqf.exe File opened for modification C:\Windows\bqzwhbmcxjquobnj.exe eigss.exe File opened for modification C:\Windows\cuggurfywlvczpedqrg.exe eigss.exe File opened for modification C:\Windows\vqfizzqmnfsccvnpfjbwlo.exe eigss.exe File opened for modification C:\Windows\iyigsnzqmzhmhvifq.exe eigss.exe File opened for modification C:\Windows\iyigsnzqmzhmhvifq.exe hgvdkbgzrqf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hgvdkbgzrqf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eigss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 2812 eigss.exe 2812 eigss.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 2812 eigss.exe 2812 eigss.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 2812 eigss.exe 2812 eigss.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 2812 eigss.exe 2812 eigss.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 2812 eigss.exe 2812 eigss.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 2812 eigss.exe 2812 eigss.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 2812 eigss.exe 2812 eigss.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 2812 eigss.exe 2812 eigss.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 2812 eigss.exe 2812 eigss.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 2812 eigss.exe 2812 eigss.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 2812 eigss.exe 2812 eigss.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 2812 eigss.exe 2812 eigss.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 2812 eigss.exe 2812 eigss.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 2812 eigss.exe 2812 eigss.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2812 eigss.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1580 wrote to memory of 2216 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 29 PID 1580 wrote to memory of 2216 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 29 PID 1580 wrote to memory of 2216 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 29 PID 1580 wrote to memory of 2216 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 29 PID 2216 wrote to memory of 2812 2216 hgvdkbgzrqf.exe 30 PID 2216 wrote to memory of 2812 2216 hgvdkbgzrqf.exe 30 PID 2216 wrote to memory of 2812 2216 hgvdkbgzrqf.exe 30 PID 2216 wrote to memory of 2812 2216 hgvdkbgzrqf.exe 30 PID 2216 wrote to memory of 1588 2216 hgvdkbgzrqf.exe 31 PID 2216 wrote to memory of 1588 2216 hgvdkbgzrqf.exe 31 PID 2216 wrote to memory of 1588 2216 hgvdkbgzrqf.exe 31 PID 2216 wrote to memory of 1588 2216 hgvdkbgzrqf.exe 31 PID 1580 wrote to memory of 2840 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 32 PID 1580 wrote to memory of 2840 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 32 PID 1580 wrote to memory of 2840 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 32 PID 1580 wrote to memory of 2840 1580 ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe 32 -
System policy modification 1 TTPs 38 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" eigss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" hgvdkbgzrqf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" eigss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer eigss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" eigss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System hgvdkbgzrqf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" hgvdkbgzrqf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" hgvdkbgzrqf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" eigss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" eigss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ed82058eda9e6ad70b2a81a3b3c0767c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\hgvdkbgzrqf.exe"C:\Users\Admin\AppData\Local\Temp\hgvdkbgzrqf.exe" "c:\users\admin\appdata\local\temp\ed82058eda9e6ad70b2a81a3b3c0767c_jaffacakes118.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\eigss.exe"C:\Users\Admin\AppData\Local\Temp\eigss.exe" "-C:\Users\Admin\AppData\Local\Temp\bqzwhbmcxjquobnj.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2812
-
-
C:\Users\Admin\AppData\Local\Temp\eigss.exe"C:\Users\Admin\AppData\Local\Temp\eigss.exe" "-C:\Users\Admin\AppData\Local\Temp\bqzwhbmcxjquobnj.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:1588
-
-
-
C:\Users\Admin\AppData\Local\Temp\hgvdkbgzrqf.exe"C:\Users\Admin\AppData\Local\Temp\hgvdkbgzrqf.exe" "c:\users\admin\appdata\local\temp\ed82058eda9e6ad70b2a81a3b3c0767c_jaffacakes118.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2840
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD5bb8cda3c423b4166957c588ed290114a
SHA1837c8b2907c038a7ac10fb76804cf7f0295eb6e7
SHA256cc8be84e35533caf3160ee681413937d91d5a77037b041c99f349f8f814cd160
SHA5120a71bbe62522624a44a987dc5e1c7dca76bc124f36925cae612d248e13d027883c6fe40a4399b067380d787109c9760a0950b8cffbb716895e42d9fee63f2c0f
-
Filesize
280B
MD5681235d60dc44b5fa3ee02a0f9335e6b
SHA148b562434c02e77c699146cfd630f389d149d5ac
SHA2566e5fdf3efb89baa08f4cb783837bb52ef950b8be204ea4e74499a5d57e3b8ca7
SHA51279404e1048f443817db472b9d223b63ff82d60b1cc4306bc90098fa0f0b360947c8df43d14931b1d90fc77ca1b469c73b1cfb068567a81b01f17b0f76d05e412
-
Filesize
280B
MD5d4497288f89e4c6603308669361bce39
SHA1004b3f08ef5a020374024ad7582429dbf996b9c3
SHA256602f1122909ea673ad0fe7b837e97faaefea88bff8c13e599ff12f002e2ae2fb
SHA5127fcc705c2f65a8c2a696ce02d5f6a007f97cea98be2faf4b74cbcf96b406cad11540c27a91308dc6440fe5ef05e042af6d4ac670c0499f5740e2617b012edb1a
-
Filesize
280B
MD5aee3cfe052f3795a0e106e84c52a3944
SHA1d1b0736b8b0ebfc7967604af81198596262607b5
SHA25691081e04b89133a94d3a781cafb208a6bb75a1726103bd243b910efbc94c6594
SHA5123db80bb14cfd85ac43f35636c15ec70570f998f83993f27ec7a2247433f83e39a83680b7648414dfd2cc720567136e2bb819f6abe2406aa5d3d1dd1cee285fc0
-
Filesize
4KB
MD5991267c37b8d57049a114cfd757c9c81
SHA16afddc6d3d87e6c0c5cf05862ea0c275bea47c31
SHA25690f66b77f79ad15b36c2c71102328f8a42121a81aea08ca3560ca9cc3a865bb2
SHA512dc2943d917d17fc04fe58949bcfc94517e9876b805bee0e186dbf95c0b7ce33bcff5d2e29f8020bde3a8bce2210d280b8840a59c239da6bfce4068119aa2315d
-
Filesize
464KB
MD5ed82058eda9e6ad70b2a81a3b3c0767c
SHA119e729460740a8371c408b91fbb28358f6b635f8
SHA256a9b2531420fa9044d3a9c4d8f73c947751f4233aa913ea9a7d6cf8835de5c8bc
SHA512721627d74703832c208c1c9fdd587ec52174571c11331c49f37b406bc25bda4c1540ea0244686885366533e6595f14b5c419f92eb608fa6938d745984d579ce7
-
Filesize
708KB
MD55c65bd3c6557d1e42f5f652eae2cb45c
SHA1fdfeaeea460fbb6929b7f8c6b3ab04d803ae7e7a
SHA2563e82fa36c7c2e5f6383645cda14c517d28a08ada363b6a36de56967aa0a97c24
SHA512400a57c57ebe81eb0ca415d8f8aa1901b24254e49672c15cb33598258edf54edcd8c0c417cfb5a6496832a132bba58542882ae986761befc1f95ae2eb72b56bf
-
Filesize
320KB
MD56757c3b0cecc46db779ec99820e8fcac
SHA1a93b71ecca0324eb30bcd1b7cbbac786c8e7ebd9
SHA256f8f2bdfc663d028a02e2e83aaf2c5401f7b2bb25e8a01bacd383584a62bd0eb7
SHA512b070947d2b468b5f53b9abe6c21743e02d0206eaa5029a73fc4fcdd7357073bc4496e50401fdc969447d1a27deb8c5a0e56c583ebfef2debea31467d0786e970