f190b82bd6cf16834fc5694ef5fb965c77b888436afe4fe0219bd3e7b0427561

Analysis

max time kernel
144s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Size

848KB
MD5

f5a1e7ca4cd5d995bac3eb5668900abd
SHA1

d4b38f598651dd7d45f38c7b0f79073962711c5f
SHA256

f190b82bd6cf16834fc5694ef5fb965c77b888436afe4fe0219bd3e7b0427561
SHA512

3ce39214cafef50fcbb1d90ee88e458b08a51d58e77f75eaca6123695eea0173d85b0c60e10e1df98c94950b70fc73b237b4f6c5726dbf9af4fa60e6f9a76e46
SSDEEP

12288:0qmpplpGoGL3etQoMiXM8gxf/Sj4yYd+HbfQOv6zjLrnErSn+B8Jus:2563ey8gZqj4yYI7fQY6zjH+Kk2v

Score

10^/10

aspackv2 discovery persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	services.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	services.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0009000000016ca2-63.dat	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	services.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	fservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	services.exe

Deletes itself 1 IoCs

pid	Process
1904	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2736	fservice.exe
2540	services.exe

Loads dropped DLL 7 IoCs

pid	Process
2440	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
2440	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
2540	services.exe
2540	services.exe
2736	fservice.exe
2440	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
2876	WerFault.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fservice.exe	services.exe
File created	C:\Windows\SysWOW64\fservice.exe	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File created	C:\Windows\SysWOW64\winkey.dll	services.exe
File created	C:\Windows\SysWOW64\reginv.dll	services.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2440-5-0x0000000000400000-0x00000000006AC000-memory.dmp	upx
behavioral1/files/0x0035000000016c3d-13.dat	upx
behavioral1/memory/2440-19-0x0000000000400000-0x00000000006AC000-memory.dmp	upx
behavioral1/memory/2736-27-0x0000000000400000-0x00000000006AC000-memory.dmp	upx
behavioral1/memory/2736-45-0x0000000003B60000-0x0000000003E0C000-memory.dmp	upx
behavioral1/memory/2540-52-0x0000000000400000-0x00000000006AC000-memory.dmp	upx
behavioral1/memory/2736-55-0x0000000000400000-0x00000000006AC000-memory.dmp	upx
behavioral1/memory/2736-76-0x0000000000400000-0x00000000006AC000-memory.dmp	upx
behavioral1/memory/2440-87-0x0000000000400000-0x00000000006AC000-memory.dmp	upx
behavioral1/memory/2540-92-0x0000000000400000-0x00000000006AC000-memory.dmp	upx
behavioral1/memory/2540-94-0x0000000000400000-0x00000000006AC000-memory.dmp	upx

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system\sservice.exe	fservice.exe
File opened for modification	C:\Windows\system\sservice.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	services.exe
File opened for modification	C:\Windows\system\sservice.exe	services.exe
File created	C:\Windows\system\sservice.exe	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
File opened for modification	C:\Windows\system\sservice.exe	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
File created	C:\Windows\services.exe	fservice.exe
File opened for modification	C:\Windows\services.exe	fservice.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2876	2540	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe

Modifies registry class 31 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Verb\1\ = "&Open,0,2"	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\skwvpqxge = "BQe^v_GyD]h\x7fBBUznRhUm^B\|FifU"	fservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\skwvpqxge = "BQe^v_GyD]h\x7fBBUznRhUm^B\|FifU"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\gWeecyldimrkk = "amvt^URuiFvepI@zRIC\x7fx}Yp"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\gWeecyldimrkk = "amvt^URuiFveDI@zRI\\Wn]q@"	fservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\ = "Mail Management Module"	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Verb\1	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\jdWkjeokqUujr = "BvMjmn]NaWe`uzFH\|Gifm]wHZT@x"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Verb	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Verb\0\ = "&Edit,0,2"	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Adce = "pXMblZ~^aTCqd{XBj}}LxDkr^MFU_"	fservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\hfuppmlrnhxD = "H[XfoK[tsJCo\|PHE[IT"	fservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\jdWkjeokqUujr = "BvMjmnMNaWe`uzVH\|Gifm]wHZT@x"	fservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Verb\0	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\wydSBDiR = "\x7fYCKjAV{STKhEULI"	fservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\jdWkjeokqUujr = "BvMjmn}NaWe`uzfH\|Gifm]wHZT@x"	fservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\gWeecyldimrkk = "amvt^URuiFvehI@zRI`pzwcP"	fservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\gWeecyldimrkk = "amvt^URuiFvetI@zRIo}]]V`"	fservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\wydSBDiR = "\x7fYCKjAV{RTKhEx~Y"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\wydSBDiR = "\x7fYCKjAV{RTKhEx~Y"	fservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\lusrhkxkkHcd = "FMlfgXi@iTMWmH[bK"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\hfuppmlrnhxD = "H[XfoK[tsJCo\|PHE[IT"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\gWeecyldimrkk = "amvt^URuiFve\|I@zRINj^BsP"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\jdWkjeokqUujr = "BvMjmnMNaWe`uzVH\|Gifm]wHZT@x"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\jdWkjeokqUujr = "BvMjmn]NaWe`uzFH\|Gifm\\WHZT@x"	fservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\lusrhkxkkHcd = "FMlfgXi@iTMWmH[bK"	fservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Zfbltsj = "NB_VmpKjLbfen\\nt_KXYc"	fservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Adce = "pXMblZ~^aTCqd{XBj}}LxDkr^MFU_"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\Zfbltsj = "NB_VmpKjLbfen\\nt_KXYc"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD211730-848A-F6FE-25B7-CBFA4A410CDA}\gWeecyldimrkk = "amvt^URuiFvexI@zRIhNsMQ`"	fservice.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\TEMP:C980DA7D	fservice.exe
File opened for modification	C:\ProgramData\TEMP:C980DA7D	services.exe
File created	C:\ProgramData\TEMP:C980DA7D	fservice.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2540	services.exe
2540	services.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	2440	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2440	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
Token: 33	2736	fservice.exe
Token: SeIncBasePriorityPrivilege	2736	fservice.exe
Token: 33	2540	services.exe
Token: SeIncBasePriorityPrivilege	2540	services.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2540	services.exe
2540	services.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2736	2440	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2736	2440	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2736	2440	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe	30
PID 2440 wrote to memory of 2736	2440	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe	30
PID 2736 wrote to memory of 2540	2736	fservice.exe	31
PID 2736 wrote to memory of 2540	2736	fservice.exe	31
PID 2736 wrote to memory of 2540	2736	fservice.exe	31
PID 2736 wrote to memory of 2540	2736	fservice.exe	31
PID 2540 wrote to memory of 612	2540	services.exe	32
PID 2540 wrote to memory of 612	2540	services.exe	32
PID 2540 wrote to memory of 612	2540	services.exe	32
PID 2540 wrote to memory of 612	2540	services.exe	32
PID 2540 wrote to memory of 568	2540	services.exe	33
PID 2540 wrote to memory of 568	2540	services.exe	33
PID 2540 wrote to memory of 568	2540	services.exe	33
PID 2540 wrote to memory of 568	2540	services.exe	33
PID 2440 wrote to memory of 1904	2440	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe	36
PID 2440 wrote to memory of 1904	2440	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe	36
PID 2440 wrote to memory of 1904	2440	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe	36
PID 2440 wrote to memory of 1904	2440	f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe	36
PID 568 wrote to memory of 2528	568	NET.exe	38
PID 568 wrote to memory of 2528	568	NET.exe	38
PID 568 wrote to memory of 2528	568	NET.exe	38
PID 568 wrote to memory of 2528	568	NET.exe	38
PID 612 wrote to memory of 2872	612	NET.exe	39
PID 612 wrote to memory of 2872	612	NET.exe	39
PID 612 wrote to memory of 2872	612	NET.exe	39
PID 612 wrote to memory of 2872	612	NET.exe	39
PID 2540 wrote to memory of 2876	2540	services.exe	40
PID 2540 wrote to memory of 2876	2540	services.exe	40
PID 2540 wrote to memory of 2876	2540	services.exe	40
PID 2540 wrote to memory of 2876	2540	services.exe	40

C:\Users\Admin\AppData\Local\Temp\f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Checks BIOS information in registry
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\fservice.exe
  C:\Windows\system32\fservice.exe
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\services.exe
    C:\Windows\services.exe -XP
    3⤵
    - Modifies WinLogon for persistence
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies WinLogon
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\SysWOW64\NET.exe
      NET STOP srservice
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:612
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP srservice
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2872
  - - C:\Windows\SysWOW64\NET.exe
      NET STOP navapsvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:568
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP navapsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2528
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 772
      4⤵
      Loads dropped DLL
      Program crash
      PID:2876
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe.bat
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\TEMP:C980DA7D

Filesize
135B

MD5
f2a3408753a3daa085dc4a1a29d7c14a

SHA1
93d23dcf8f1e27a5662888b820db8fc20a0f6268

SHA256
59ab54ea8a889a4fe2f7d037ca94e3f979441e32a21170f16212be52473f4eb3

SHA512
ef2a179d783e6912ea744e64948a3510744bd0834a506beffd7b9c00a4dd208230a70b3309fb85acedceebca3d78c4dde06c2e30599bf178250312f5967b7572

Download Submit
C:\ProgramData\TEMP:C980DA7D

Filesize
135B

MD5
97e2ae54494ae6386b99cf6219c1cc9b

SHA1
d44c58c163d21e266b35a31bf17147ecb4d435f6

SHA256
b03d842ca7b8a41b797ff2d78bb160a6bd64ba63fedb8a7869c39fc9355bd4e3

SHA512
f395e0ab36e52557e75a0056028518625a89696488bdcb8ded0d9d86aa117fff817e369e9d73657e1836e419ee3e501a72466aa0e577b19f33210f5e6fcb6b91

Download Submit
C:\Users\Admin\AppData\Local\Temp\f5a1e7ca4cd5d995bac3eb5668900abd_JaffaCakes118.exe.bat

Filesize
133B

MD5
17df996749711e16b5d6445e44d442a8

SHA1
3de270c2f284ff4ff014a8071a1cacb3f56ca397

SHA256
ea9a39f3da27e4db4890fda6a185302d1424bdad9c2abd19fbecdbd32b17424d

SHA512
2c5e1fe2d381eabe231ac6af14e752db0c26fa20a0938d58de1937ddf447c30d98012b3d2cd7f9ee63584513d7639309ac1ae93cc841633b4a415763af484931

Download Submit
C:\Windows\SysWOW64\fservice.exe

Filesize
848KB

MD5
f5a1e7ca4cd5d995bac3eb5668900abd

SHA1
d4b38f598651dd7d45f38c7b0f79073962711c5f

SHA256
f190b82bd6cf16834fc5694ef5fb965c77b888436afe4fe0219bd3e7b0427561

SHA512
3ce39214cafef50fcbb1d90ee88e458b08a51d58e77f75eaca6123695eea0173d85b0c60e10e1df98c94950b70fc73b237b4f6c5726dbf9af4fa60e6f9a76e46

Download Submit
\Windows\SysWOW64\reginv.dll

Filesize
36KB

MD5
562e0d01d6571fa2251a1e9f54c6cc69

SHA1
83677ad3bc630aa6327253c7b3deffbd4a8ce905

SHA256
c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6

SHA512
166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea

Download Submit
\Windows\SysWOW64\winkey.dll

Filesize
13KB

MD5
b4c72da9fd1a0dcb0698b7da97daa0cd

SHA1
b25a79e8ea4c723c58caab83aed6ea48de7ed759

SHA256
45d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f

SHA512
f5f184416c5381d275bc093c9275e9fdb35c58e2c401d188aef097950013de6e43269da5d4dd5e7baea34735bd7de664d15fe487b2292fd66926c9845b0cd066

Download Submit
memory/2440-19-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/2440-85-0x0000000001EF0000-0x0000000001F3D000-memory.dmp

Filesize
308KB

Download
memory/2440-7-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/2440-18-0x00000000037E0000-0x0000000003A8C000-memory.dmp

Filesize
2.7MB

Download
memory/2440-30-0x0000000001EF0000-0x0000000001F3D000-memory.dmp

Filesize
308KB

Download
memory/2440-6-0x0000000001EF0000-0x0000000001F3D000-memory.dmp

Filesize
308KB

Download
memory/2440-34-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/2440-0-0x0000000001EF0000-0x0000000001F3D000-memory.dmp

Filesize
308KB

Download
memory/2440-38-0x00000000037E0000-0x0000000003A8C000-memory.dmp

Filesize
2.7MB

Download
memory/2440-87-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/2440-5-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/2540-96-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/2540-52-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/2540-89-0x00000000001B0000-0x00000000001FD000-memory.dmp

Filesize
308KB

Download
memory/2540-60-0x00000000001B0000-0x00000000001FD000-memory.dmp

Filesize
308KB

Download
memory/2540-61-0x0000000000770000-0x0000000000771000-memory.dmp

Filesize
4KB

Download
memory/2540-46-0x00000000001B0000-0x00000000001FD000-memory.dmp

Filesize
308KB

Download
memory/2540-65-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2540-92-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/2540-95-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/2540-94-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/2736-55-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/2736-76-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download
memory/2736-74-0x0000000000220000-0x000000000026D000-memory.dmp

Filesize
308KB

Download
memory/2736-56-0x0000000000220000-0x000000000026D000-memory.dmp

Filesize
308KB

Download
memory/2736-45-0x0000000003B60000-0x0000000003E0C000-memory.dmp

Filesize
2.7MB

Download
memory/2736-39-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/2736-33-0x0000000000220000-0x000000000026D000-memory.dmp

Filesize
308KB

Download
memory/2736-21-0x0000000000220000-0x000000000026D000-memory.dmp

Filesize
308KB

Download
memory/2736-27-0x0000000000400000-0x00000000006AC000-memory.dmp

Filesize
2.7MB

Download