205d204777afb49d6639e90caded6358619a1cc6b4fd893c61b83652ea33a8e2

Analysis

max time kernel
149s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fb46fba7ac18e7ce99020b71f4c9ec84_JaffaCakes118.exe
Size 110KB
Sample240928-ca22ea1bmp
SHA256 205d204777afb49d6639e90caded6358619a1cc6b4fd893c61b83652ea33a8e2
MD5 fb46fba7ac18e7ce99020b71f4c9ec84
SHA1 0d3c37bc1c886961652e3f732eaa9a6e07463114
SHA512 a728545985246be96babdb370c7d43c94ede1112da9328d8916765cade10fdc3985a1c0aa99c44ee5962b4999499bb8de86a34bbf37ef139b344a55934abd1c8
SSDEEP 1536:xV1XF99fQgtVXMWnT8YtFzii7lF/BSNL9l2xisFtVlzkAyHCVDmi:dp/LnT8YtF+ihxBSNhsisFtDyi1
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
4672	takeown.exe
2140	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	fb46fba7ac18e7ce99020b71f4c9ec84_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
3508	regsvr32.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
3508	regsvr32.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4672	takeown.exe
2140	icacls.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\A:	svchost.exe
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\Z:	svchost.exe
File opened (read-only)	\??\B:	svchost.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File created	C:\Windows\SysWOW64\rpcss.dll	regsvr32.exe
File opened for modification	C:\Windows\SysWOW64\rpcss.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\SysWOW64\apa.dll	regsvr32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb46fba7ac18e7ce99020b71f4c9ec84_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	svchost.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02hhzlmqhqmdnbtr	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\ValidDeviceId = "02hhzlmqhqmdnbtr"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02hhzlmqhqmdnbtr\AppIdList = "{AFDA72BF-3409-413A-B54E-2AB8D66A7826};"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02hhzlmqhqmdnbtr\DeviceId = "<Data LastUpdatedTime=\"1727488404\"><User username=\"02HHZLMQHQMDNBTR\"><HardwareInfo BoundTime=\"1727488405\" TpmKeyStateClient=\"1\" TpmKeyStateServer=\"3\" LicenseKeySequence=\"1\" LicenseInstallError=\"0\" LicenseKeyVersion=\"2\"/></User></Data>\r\n"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02qqasztjisycqxi\AppIdList	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\DeviceLicenseUpdateFailureCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02hhzlmqhqmdnbtr\DeviceId = "<Data LastUpdatedTime=\"1727488404\"><User username=\"02HHZLMQHQMDNBTR\"/></Data>\r\n"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02hhzlmqhqmdnbtr\DeviceId = "<Data LastUpdatedTime=\"1727488404\"><User username=\"02HHZLMQHQMDNBTR\"><HardwareInfo BoundTime=\"1727488404\" TpmKeyStateClient=\"1\" TpmKeyStateServer=\"3\" LicenseKeySequence=\"1\" LicenseInstallError=\"0\" LicenseKeyVersion=\"2\"/></User></Data>\r\n"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02hhzlmqhqmdnbtr\Provision Saturday, September 28, 2024 01:53:23 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA89SQAdXiBUexdfEvvjzwtQAAAAACAAAAAAAQZgAAAAEAACAAAABr/NYds/DA2Bj6VXeUclOURida6GSB/kU7GzekM443HQAAAAAOgAAAAAIAACAAAAA1wd4orOe5Dvbsrt7/MBoNbAqEwWjamv8RWSa5oR0d1iAAAADSGNSUXhVSGcNZVX27fC6S3kbBWeVenqb+Znn2vKuEpUAAAAD+a9O5Q5fyyGzEP1okJ54GXHccHqoDa7Cq3OXDNTUzH+660gFBJZnYaBQeLlWftHUYgpX/mm+R2PgSuUSVUGQ3"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02qqasztjisycqxi\Reason = "2147750679"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\ValidDeviceId	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02hhzlmqhqmdnbtr	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "00184010DCF1C8A6"	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3508	regsvr32.exe
3508	regsvr32.exe
3508	regsvr32.exe
3508	regsvr32.exe
3508	regsvr32.exe
3508	regsvr32.exe
3508	regsvr32.exe
3508	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3508	regsvr32.exe
Token: SeTakeOwnershipPrivilege	4672	takeown.exe
Token: SeAssignPrimaryTokenPrivilege	2256	svchost.exe
Token: SeIncreaseQuotaPrivilege	2256	svchost.exe
Token: SeSecurityPrivilege	2256	svchost.exe
Token: SeTakeOwnershipPrivilege	2256	svchost.exe
Token: SeLoadDriverPrivilege	2256	svchost.exe
Token: SeBackupPrivilege	2256	svchost.exe
Token: SeRestorePrivilege	2256	svchost.exe
Token: SeShutdownPrivilege	2256	svchost.exe
Token: SeSystemEnvironmentPrivilege	2256	svchost.exe
Token: SeManageVolumePrivilege	2256	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2256	svchost.exe
Token: SeIncreaseQuotaPrivilege	2256	svchost.exe
Token: SeSecurityPrivilege	2256	svchost.exe
Token: SeTakeOwnershipPrivilege	2256	svchost.exe
Token: SeLoadDriverPrivilege	2256	svchost.exe
Token: SeSystemtimePrivilege	2256	svchost.exe
Token: SeBackupPrivilege	2256	svchost.exe
Token: SeRestorePrivilege	2256	svchost.exe
Token: SeShutdownPrivilege	2256	svchost.exe
Token: SeSystemEnvironmentPrivilege	2256	svchost.exe
Token: SeUndockPrivilege	2256	svchost.exe
Token: SeManageVolumePrivilege	2256	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2256	svchost.exe
Token: SeIncreaseQuotaPrivilege	2256	svchost.exe
Token: SeSecurityPrivilege	2256	svchost.exe
Token: SeTakeOwnershipPrivilege	2256	svchost.exe
Token: SeLoadDriverPrivilege	2256	svchost.exe
Token: SeSystemtimePrivilege	2256	svchost.exe
Token: SeBackupPrivilege	2256	svchost.exe
Token: SeRestorePrivilege	2256	svchost.exe
Token: SeShutdownPrivilege	2256	svchost.exe
Token: SeSystemEnvironmentPrivilege	2256	svchost.exe
Token: SeUndockPrivilege	2256	svchost.exe
Token: SeManageVolumePrivilege	2256	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2256	svchost.exe
Token: SeIncreaseQuotaPrivilege	2256	svchost.exe
Token: SeSecurityPrivilege	2256	svchost.exe
Token: SeTakeOwnershipPrivilege	2256	svchost.exe
Token: SeLoadDriverPrivilege	2256	svchost.exe
Token: SeSystemtimePrivilege	2256	svchost.exe
Token: SeBackupPrivilege	2256	svchost.exe
Token: SeRestorePrivilege	2256	svchost.exe
Token: SeShutdownPrivilege	2256	svchost.exe
Token: SeSystemEnvironmentPrivilege	2256	svchost.exe
Token: SeUndockPrivilege	2256	svchost.exe
Token: SeManageVolumePrivilege	2256	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2256	svchost.exe
Token: SeIncreaseQuotaPrivilege	2256	svchost.exe
Token: SeSecurityPrivilege	2256	svchost.exe
Token: SeTakeOwnershipPrivilege	2256	svchost.exe
Token: SeLoadDriverPrivilege	2256	svchost.exe
Token: SeSystemtimePrivilege	2256	svchost.exe
Token: SeBackupPrivilege	2256	svchost.exe
Token: SeRestorePrivilege	2256	svchost.exe
Token: SeShutdownPrivilege	2256	svchost.exe
Token: SeSystemEnvironmentPrivilege	2256	svchost.exe
Token: SeUndockPrivilege	2256	svchost.exe
Token: SeManageVolumePrivilege	2256	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2256	svchost.exe
Token: SeIncreaseQuotaPrivilege	2256	svchost.exe
Token: SeSecurityPrivilege	2256	svchost.exe
Token: SeTakeOwnershipPrivilege	2256	svchost.exe

Suspicious use of UnmapMainImage 4 IoCs

pid	Process
2404	svchost.exe
2404	svchost.exe
2404	svchost.exe
2404	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 3508	2160	fb46fba7ac18e7ce99020b71f4c9ec84_JaffaCakes118.exe	82
PID 2160 wrote to memory of 3508	2160	fb46fba7ac18e7ce99020b71f4c9ec84_JaffaCakes118.exe	82
PID 2160 wrote to memory of 3508	2160	fb46fba7ac18e7ce99020b71f4c9ec84_JaffaCakes118.exe	82
PID 3508 wrote to memory of 4672	3508	regsvr32.exe	83
PID 3508 wrote to memory of 4672	3508	regsvr32.exe	83
PID 3508 wrote to memory of 4672	3508	regsvr32.exe	83
PID 3508 wrote to memory of 2140	3508	regsvr32.exe	85
PID 3508 wrote to memory of 2140	3508	regsvr32.exe	85
PID 3508 wrote to memory of 2140	3508	regsvr32.exe	85
PID 3508 wrote to memory of 816	3508	regsvr32.exe	10
PID 3508 wrote to memory of 816	3508	regsvr32.exe	10
PID 3508 wrote to memory of 920	3508	regsvr32.exe	11
PID 3508 wrote to memory of 920	3508	regsvr32.exe	11
PID 3508 wrote to memory of 972	3508	regsvr32.exe	12
PID 3508 wrote to memory of 972	3508	regsvr32.exe	12
PID 3508 wrote to memory of 532	3508	regsvr32.exe	14
PID 3508 wrote to memory of 532	3508	regsvr32.exe	14
PID 3508 wrote to memory of 884	3508	regsvr32.exe	15
PID 3508 wrote to memory of 884	3508	regsvr32.exe	15
PID 3508 wrote to memory of 1060	3508	regsvr32.exe	16
PID 3508 wrote to memory of 1060	3508	regsvr32.exe	16
PID 3508 wrote to memory of 1064	3508	regsvr32.exe	17
PID 3508 wrote to memory of 1064	3508	regsvr32.exe	17
PID 3508 wrote to memory of 1084	3508	regsvr32.exe	18
PID 3508 wrote to memory of 1084	3508	regsvr32.exe	18
PID 3508 wrote to memory of 1092	3508	regsvr32.exe	19
PID 3508 wrote to memory of 1092	3508	regsvr32.exe	19
PID 3508 wrote to memory of 1168	3508	regsvr32.exe	20
PID 3508 wrote to memory of 1168	3508	regsvr32.exe	20
PID 3508 wrote to memory of 1272	3508	regsvr32.exe	21
PID 3508 wrote to memory of 1272	3508	regsvr32.exe	21
PID 3508 wrote to memory of 1300	3508	regsvr32.exe	22
PID 3508 wrote to memory of 1300	3508	regsvr32.exe	22
PID 3508 wrote to memory of 1328	3508	regsvr32.exe	23
PID 3508 wrote to memory of 1328	3508	regsvr32.exe	23
PID 3508 wrote to memory of 1372	3508	regsvr32.exe	24
PID 3508 wrote to memory of 1372	3508	regsvr32.exe	24
PID 3508 wrote to memory of 1480	3508	regsvr32.exe	25
PID 3508 wrote to memory of 1480	3508	regsvr32.exe	25
PID 3508 wrote to memory of 1504	3508	regsvr32.exe	26
PID 3508 wrote to memory of 1504	3508	regsvr32.exe	26
PID 3508 wrote to memory of 1516	3508	regsvr32.exe	27
PID 3508 wrote to memory of 1516	3508	regsvr32.exe	27
PID 3508 wrote to memory of 1628	3508	regsvr32.exe	28
PID 3508 wrote to memory of 1628	3508	regsvr32.exe	28
PID 3508 wrote to memory of 1660	3508	regsvr32.exe	29
PID 3508 wrote to memory of 1660	3508	regsvr32.exe	29
PID 3508 wrote to memory of 1684	3508	regsvr32.exe	30
PID 3508 wrote to memory of 1684	3508	regsvr32.exe	30
PID 3508 wrote to memory of 1740	3508	regsvr32.exe	31
PID 3508 wrote to memory of 1740	3508	regsvr32.exe	31
PID 3508 wrote to memory of 1836	3508	regsvr32.exe	32
PID 3508 wrote to memory of 1836	3508	regsvr32.exe	32
PID 3508 wrote to memory of 1952	3508	regsvr32.exe	33
PID 3508 wrote to memory of 1952	3508	regsvr32.exe	33
PID 3508 wrote to memory of 1984	3508	regsvr32.exe	34
PID 3508 wrote to memory of 1984	3508	regsvr32.exe	34
PID 3508 wrote to memory of 2012	3508	regsvr32.exe	35
PID 3508 wrote to memory of 2012	3508	regsvr32.exe	35
PID 3508 wrote to memory of 1136	3508	regsvr32.exe	36
PID 3508 wrote to memory of 1136	3508	regsvr32.exe	36
PID 3508 wrote to memory of 2072	3508	regsvr32.exe	38
PID 3508 wrote to memory of 2072	3508	regsvr32.exe	38
PID 3508 wrote to memory of 2128	3508	regsvr32.exe	39

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:816
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:4552
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:1268
- C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
  C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
  2⤵
  PID:4360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2072

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
- Suspicious use of UnmapMainImage
PID:2404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Enumerates connected drives
PID:2480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2372

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2096

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4000

C:\Users\Admin\AppData\Local\Temp\fb46fba7ac18e7ce99020b71f4c9ec84_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb46fba7ac18e7ce99020b71f4c9ec84_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" /s C:\Users\Admin\AppData\Local\Temp\~~e57b0b2.tmp ,C:\Users\Admin\AppData\Local\Temp\fb46fba7ac18e7ce99020b71f4c9ec84_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f "C:\Windows\system32\rpcss.dll"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Windows\system32\rpcss.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2140
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del %%SystemRoot%%\system32\rpcss.dll~*
    3⤵
    - System Location Discovery: System Language Discovery
    PID:320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~~e57b0b2.tmp

Path C:\Users\Admin\AppData\Local\Temp\~~e57b0b2.tmp
Size 1.0MB
SHA256 0a3601cdccd57ec2756b53568a24bc1270c29ea120983efd0ed4afbfe880e691
MD5 43821b168664c892c277c164697fabf5
SHA1 1194ac07bb3f05504d7849fd518b2b7fb54185fa
SHA512 baaf3e4543339f195a9937342dd46af89195a23f1c9cbe0f1a881089d2e85c318522c93be2a7c7507be490a8210c0874d02f7e851b093e6a07bde0263a76ea76
SSDEEP 3072:xEgET5hstyh9S9T/oIAfW978gy8VX7PxA:egET/stKPfW978gyE7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

apa.dll

Path C:\Windows\SysWOW64\apa.dll
Size 197B
SHA256 d7bd61f28408740a30b1a9cb8735a60a7986cca423569afebf7c903d4143ba6f
MD5 16292cd61a219c79b07defcb420a1ca7
SHA1 ba8d3711f21b7be77b6fb84ec1974fefc4958fb1
SHA512 b8be5a3bff525d13defa76f4cde2f6c46a17c6c7cb58e616537e432977cd9e26d74fd5825791697bf4f55ece8efeda63facd2d48214367c77991ce5a2b62afd4
MD5 SHA1 SHA512

Submit Download

Schedule Maintenance Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
Size 2KB
SHA256 129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
MD5 f313c5b4f95605026428425586317353
SHA1 06be66fa06e1cffc54459c38d3d258f46669d01a
SHA512 b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890
MD5 SHA1 SHA512

Submit Download

Schedule Maintenance Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
Size 2KB
SHA256 ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea
MD5 8abf2d6067c6f3191a015f84aa9b6efe
SHA1 98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7
SHA512 c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63
MD5 SHA1 SHA512

Submit Download

Schedule Wake To Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Size 2KB
SHA256 98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
MD5 ceb7caa4e9c4b8d760dbf7e9e5ca44c5
SHA1 a3879621f9493414d497ea6d70fbf17e283d5c08
SHA512 1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
MD5 SHA1 SHA512

Submit Download

Schedule Wake To Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
Size 2KB
SHA256 727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
MD5 7d612892b20e70250dbd00d0cdd4f09b
SHA1 63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
SHA512 f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
MD5 SHA1 SHA512

Submit Download

Schedule Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Size 2KB
SHA256 55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
MD5 1e8e2076314d54dd72e7ee09ff8a52ab
SHA1 5fd0a67671430f66237f483eef39ff599b892272
SHA512 5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
MD5 SHA1 SHA512

Submit Download

Schedule Work

Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
Size 2KB
SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
MD5 0b990e24f1e839462c0ac35fef1d119e
SHA1 9e17905f8f68f9ce0a2024d57b537aa8b39c6708
SHA512 c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
MD5 SHA1 SHA512

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 404B
SHA256 555cbbcca88192169f02d23592c82442aa869c1ffdeb98a32a088433863e5fef
MD5 fcb6c0128b2ff08fe5cf48e1f9f924ee
SHA1 f265584e1fd72ce337215eeb47227da048602100
SHA512 4cc3f8ea2280d93c23aad5679eeb80542cb8a9c24acb6724da5fa8afc5f44a3b3579e4438b359a6d60a97c67bb069db2473eb511314064597e0308823a9489b8
MD5 SHA1 SHA512

Submit Download