Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22-09-2024 13:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f2201039a561e5769e358067eb515967_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
f2201039a561e5769e358067eb515967_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
f2201039a561e5769e358067eb515967_JaffaCakes118.exe
-
Size
202KB
-
MD5
f2201039a561e5769e358067eb515967
-
SHA1
e09f64763149330dc566857a22b6b9d5bfb983ae
-
SHA256
98f045d8f7daec9e2c0c899ab4780601c9968c8daab11db22bc7f0c7ea9672aa
-
SHA512
884fdb9943af21f35251953b1a04cb56014b9fde5cc2be5cce3a14bbfa1aad6962b2bebd334c053eebf4670a2f51180701fe8e25bf4bc227d08af5d8eae4c188
-
SSDEEP
3072:AJPbQZZ5tMT21JOGB2gTFfPIVzyU2MsZEDYRktsqRkRxjZ9xV3n0HB0MFdtKE:qPbYZoCfOlgJhUKZssqmRxC0MtKE
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Checks computer location settings 2 TTPs 13 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation f2201039a561e5769e358067eb515967_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wnpfsx.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wnpfsx.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wnpfsx.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wnpfsx.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wnpfsx.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wnpfsx.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wnpfsx.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wnpfsx.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wnpfsx.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wnpfsx.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wnpfsx.exe Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation wnpfsx.exe -
Deletes itself 1 IoCs
pid Process 3596 wnpfsx.exe -
Executes dropped EXE 26 IoCs
pid Process 1724 wnpfsx.exe 3596 wnpfsx.exe 1136 wnpfsx.exe 2072 wnpfsx.exe 4748 wnpfsx.exe 4276 wnpfsx.exe 880 wnpfsx.exe 1072 wnpfsx.exe 3840 wnpfsx.exe 3468 wnpfsx.exe 3672 wnpfsx.exe 4168 wnpfsx.exe 5012 wnpfsx.exe 4548 wnpfsx.exe 4888 wnpfsx.exe 4324 wnpfsx.exe 2640 wnpfsx.exe 2968 wnpfsx.exe 1724 wnpfsx.exe 4640 wnpfsx.exe 3924 wnpfsx.exe 4900 wnpfsx.exe 5100 wnpfsx.exe 752 wnpfsx.exe 4808 wnpfsx.exe 456 wnpfsx.exe -
resource yara_rule behavioral2/memory/4668-1-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4668-2-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4668-5-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4668-0-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4668-8-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4668-7-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4668-6-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4668-42-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3596-51-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3596-54-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3596-53-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3596-52-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3596-56-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2072-66-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2072-65-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2072-64-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2072-63-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2072-70-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4276-77-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4276-79-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4276-80-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4276-82-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/1072-90-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/1072-95-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3468-103-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/3468-108-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4168-118-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4168-124-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4548-131-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4548-138-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4324-147-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/2968-160-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4640-174-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/4900-187-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral2/memory/752-200-0x0000000000400000-0x000000000046C000-memory.dmp upx -
Drops file in System32 directory 26 IoCs
description ioc Process File created C:\Windows\SysWOW64\wnpfsx.exe f2201039a561e5769e358067eb515967_JaffaCakes118.exe File created C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File created C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File created C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File opened for modification C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File opened for modification C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File created C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File created C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File created C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File opened for modification C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File opened for modification C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File opened for modification C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File created C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File opened for modification C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File opened for modification C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File created C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File opened for modification C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File created C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File opened for modification C:\Windows\SysWOW64\wnpfsx.exe f2201039a561e5769e358067eb515967_JaffaCakes118.exe File created C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File opened for modification C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File opened for modification C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File created C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File created C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File opened for modification C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe File opened for modification C:\Windows\SysWOW64\wnpfsx.exe wnpfsx.exe -
Suspicious use of SetThreadContext 13 IoCs
description pid Process procid_target PID 3416 set thread context of 4668 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe 81 PID 1724 set thread context of 3596 1724 wnpfsx.exe 90 PID 1136 set thread context of 2072 1136 wnpfsx.exe 92 PID 4748 set thread context of 4276 4748 wnpfsx.exe 96 PID 880 set thread context of 1072 880 wnpfsx.exe 98 PID 3840 set thread context of 3468 3840 wnpfsx.exe 100 PID 3672 set thread context of 4168 3672 wnpfsx.exe 102 PID 5012 set thread context of 4548 5012 wnpfsx.exe 104 PID 2640 set thread context of 2968 2640 wnpfsx.exe 108 PID 1724 set thread context of 4640 1724 wnpfsx.exe 110 PID 3924 set thread context of 4900 3924 wnpfsx.exe 112 PID 5100 set thread context of 752 5100 wnpfsx.exe 114 PID 4808 set thread context of 456 4808 wnpfsx.exe 116 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 27 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f2201039a561e5769e358067eb515967_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f2201039a561e5769e358067eb515967_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wnpfsx.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpfsx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ f2201039a561e5769e358067eb515967_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpfsx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpfsx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpfsx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpfsx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpfsx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpfsx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpfsx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpfsx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpfsx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpfsx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wnpfsx.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4668 f2201039a561e5769e358067eb515967_JaffaCakes118.exe 4668 f2201039a561e5769e358067eb515967_JaffaCakes118.exe 3596 wnpfsx.exe 3596 wnpfsx.exe 2072 wnpfsx.exe 2072 wnpfsx.exe 4276 wnpfsx.exe 4276 wnpfsx.exe 1072 wnpfsx.exe 1072 wnpfsx.exe 3468 wnpfsx.exe 3468 wnpfsx.exe 4168 wnpfsx.exe 4168 wnpfsx.exe 4548 wnpfsx.exe 4548 wnpfsx.exe 4324 wnpfsx.exe 4324 wnpfsx.exe 2968 wnpfsx.exe 2968 wnpfsx.exe 4640 wnpfsx.exe 4640 wnpfsx.exe 4900 wnpfsx.exe 4900 wnpfsx.exe 752 wnpfsx.exe 752 wnpfsx.exe 456 wnpfsx.exe 456 wnpfsx.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe Token: SeSecurityPrivilege 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3416 wrote to memory of 4668 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe 81 PID 3416 wrote to memory of 4668 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe 81 PID 3416 wrote to memory of 4668 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe 81 PID 3416 wrote to memory of 4668 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe 81 PID 3416 wrote to memory of 4668 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe 81 PID 3416 wrote to memory of 4668 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe 81 PID 3416 wrote to memory of 4668 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe 81 PID 3416 wrote to memory of 4668 3416 f2201039a561e5769e358067eb515967_JaffaCakes118.exe 81 PID 4668 wrote to memory of 1724 4668 f2201039a561e5769e358067eb515967_JaffaCakes118.exe 87 PID 4668 wrote to memory of 1724 4668 f2201039a561e5769e358067eb515967_JaffaCakes118.exe 87 PID 4668 wrote to memory of 1724 4668 f2201039a561e5769e358067eb515967_JaffaCakes118.exe 87 PID 1724 wrote to memory of 3596 1724 wnpfsx.exe 90 PID 1724 wrote to memory of 3596 1724 wnpfsx.exe 90 PID 1724 wrote to memory of 3596 1724 wnpfsx.exe 90 PID 1724 wrote to memory of 3596 1724 wnpfsx.exe 90 PID 1724 wrote to memory of 3596 1724 wnpfsx.exe 90 PID 1724 wrote to memory of 3596 1724 wnpfsx.exe 90 PID 1724 wrote to memory of 3596 1724 wnpfsx.exe 90 PID 1724 wrote to memory of 3596 1724 wnpfsx.exe 90 PID 3596 wrote to memory of 1136 3596 wnpfsx.exe 91 PID 3596 wrote to memory of 1136 3596 wnpfsx.exe 91 PID 3596 wrote to memory of 1136 3596 wnpfsx.exe 91 PID 1136 wrote to memory of 2072 1136 wnpfsx.exe 92 PID 1136 wrote to memory of 2072 1136 wnpfsx.exe 92 PID 1136 wrote to memory of 2072 1136 wnpfsx.exe 92 PID 1136 wrote to memory of 2072 1136 wnpfsx.exe 92 PID 1136 wrote to memory of 2072 1136 wnpfsx.exe 92 PID 1136 wrote to memory of 2072 1136 wnpfsx.exe 92 PID 1136 wrote to memory of 2072 1136 wnpfsx.exe 92 PID 1136 wrote to memory of 2072 1136 wnpfsx.exe 92 PID 2072 wrote to memory of 4748 2072 wnpfsx.exe 94 PID 2072 wrote to memory of 4748 2072 wnpfsx.exe 94 PID 2072 wrote to memory of 4748 2072 wnpfsx.exe 94 PID 4748 wrote to memory of 4276 4748 wnpfsx.exe 96 PID 4748 wrote to memory of 4276 4748 wnpfsx.exe 96 PID 4748 wrote to memory of 4276 4748 wnpfsx.exe 96 PID 4748 wrote to memory of 4276 4748 wnpfsx.exe 96 PID 4748 wrote to memory of 4276 4748 wnpfsx.exe 96 PID 4748 wrote to memory of 4276 4748 wnpfsx.exe 96 PID 4748 wrote to memory of 4276 4748 wnpfsx.exe 96 PID 4748 wrote to memory of 4276 4748 wnpfsx.exe 96 PID 4276 wrote to memory of 880 4276 wnpfsx.exe 97 PID 4276 wrote to memory of 880 4276 wnpfsx.exe 97 PID 4276 wrote to memory of 880 4276 wnpfsx.exe 97 PID 880 wrote to memory of 1072 880 wnpfsx.exe 98 PID 880 wrote to memory of 1072 880 wnpfsx.exe 98 PID 880 wrote to memory of 1072 880 wnpfsx.exe 98 PID 880 wrote to memory of 1072 880 wnpfsx.exe 98 PID 880 wrote to memory of 1072 880 wnpfsx.exe 98 PID 880 wrote to memory of 1072 880 wnpfsx.exe 98 PID 880 wrote to memory of 1072 880 wnpfsx.exe 98 PID 880 wrote to memory of 1072 880 wnpfsx.exe 98 PID 1072 wrote to memory of 3840 1072 wnpfsx.exe 99 PID 1072 wrote to memory of 3840 1072 wnpfsx.exe 99 PID 1072 wrote to memory of 3840 1072 wnpfsx.exe 99 PID 3840 wrote to memory of 3468 3840 wnpfsx.exe 100 PID 3840 wrote to memory of 3468 3840 wnpfsx.exe 100 PID 3840 wrote to memory of 3468 3840 wnpfsx.exe 100 PID 3840 wrote to memory of 3468 3840 wnpfsx.exe 100 PID 3840 wrote to memory of 3468 3840 wnpfsx.exe 100 PID 3840 wrote to memory of 3468 3840 wnpfsx.exe 100 PID 3840 wrote to memory of 3468 3840 wnpfsx.exe 100 PID 3840 wrote to memory of 3468 3840 wnpfsx.exe 100 PID 3468 wrote to memory of 3672 3468 wnpfsx.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2201039a561e5769e358067eb515967_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2201039a561e5769e358067eb515967_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\f2201039a561e5769e358067eb515967_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2201039a561e5769e358067eb515967_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Users\Admin\AppData\Local\Temp\F22010~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Users\Admin\AppData\Local\Temp\F22010~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3672 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4168 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5012 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4548 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4888 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4324 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2640 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2968 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1724 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4640 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3924 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4900 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5100 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:752 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4808 -
C:\Windows\SysWOW64\wnpfsx.exe"C:\Windows\system32\wnpfsx.exe" C:\Windows\SysWOW64\wnpfsx.exe28⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
202KB
MD5f2201039a561e5769e358067eb515967
SHA1e09f64763149330dc566857a22b6b9d5bfb983ae
SHA25698f045d8f7daec9e2c0c899ab4780601c9968c8daab11db22bc7f0c7ea9672aa
SHA512884fdb9943af21f35251953b1a04cb56014b9fde5cc2be5cce3a14bbfa1aad6962b2bebd334c053eebf4670a2f51180701fe8e25bf4bc227d08af5d8eae4c188