fe0cc2324a4aeb784b297c4d2db23f69e7b311231f6671d25f0ca9b49f758512

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

052ca5f7b4c0290089a34faa8cabbebe_JaffaCakes118.exe
Size

195KB
MD5

052ca5f7b4c0290089a34faa8cabbebe
SHA1

669ff4abed46f24e35c0149eb293f03c444e174b
SHA256

fe0cc2324a4aeb784b297c4d2db23f69e7b311231f6671d25f0ca9b49f758512
SHA512

90d2fcb2ad7b902badab0080740b1faf3f3dbff57ad70fc0ae7c5ece53ed4136a1ebf5e774f7f5485f8c15e344225297292f133b88f217ac498e5c6f21df01fb
SSDEEP

3072:0z+dXw6kjcHp4uTc9+Mz+T+Xo3CpjP00H+5tBwBWIuzTS5lKP7zmf3o1Wgm2m:0z+y6k2/TAadypjP0T5teBM8lKP+vwP

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\Beep.sys	QvodSetuPlus3.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arswp.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mcshield.exe	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EGHOST.exe	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPF.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQKav.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zxsweep.exe	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.exe	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpfSrv.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRepair.com\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RawCopy.exe	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GFRing3.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NPFMntor.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RawCopy.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBCleaner.exe	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctorMain.exe	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQKav.exe	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe	QvodSetuPlus3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscanx.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SelfUpdate.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe\Debugger = "ntsd -d"	QvodSetuPlus3.exe

Executes dropped EXE 6 IoCs

pid	Process
2860	QvodSetuPlus3.exe
2436	svchost.exe
572	svchost.exe
2528	svchost.exe
876	svchost.exe
316	svchost.exe

Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\POWER	QvodSetuPlus3.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\PROFSVC	QvodSetuPlus3.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WINDEFEND	QvodSetuPlus3.exe

Loads dropped DLL 33 IoCs

pid	Process
2148	052ca5f7b4c0290089a34faa8cabbebe_JaffaCakes118.exe
2148	052ca5f7b4c0290089a34faa8cabbebe_JaffaCakes118.exe
2148	052ca5f7b4c0290089a34faa8cabbebe_JaffaCakes118.exe
2148	052ca5f7b4c0290089a34faa8cabbebe_JaffaCakes118.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2436	svchost.exe
2436	svchost.exe
2436	svchost.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2528	svchost.exe
2528	svchost.exe
2528	svchost.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
876	svchost.exe
876	svchost.exe
876	svchost.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
316	svchost.exe
316	svchost.exe
316	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	052ca5f7b4c0290089a34faa8cabbebe_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QvodSetuPlus3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe
2860	QvodSetuPlus3.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
476	Process not Found
476	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2860	QvodSetuPlus3.exe
Token: SeDebugPrivilege	2860	QvodSetuPlus3.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2860	2148	052ca5f7b4c0290089a34faa8cabbebe_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2860	2148	052ca5f7b4c0290089a34faa8cabbebe_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2860	2148	052ca5f7b4c0290089a34faa8cabbebe_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2860	2148	052ca5f7b4c0290089a34faa8cabbebe_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2860	2148	052ca5f7b4c0290089a34faa8cabbebe_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2860	2148	052ca5f7b4c0290089a34faa8cabbebe_JaffaCakes118.exe	31
PID 2148 wrote to memory of 2860	2148	052ca5f7b4c0290089a34faa8cabbebe_JaffaCakes118.exe	31
PID 2860 wrote to memory of 2732	2860	QvodSetuPlus3.exe	32
PID 2860 wrote to memory of 2732	2860	QvodSetuPlus3.exe	32
PID 2860 wrote to memory of 2732	2860	QvodSetuPlus3.exe	32
PID 2860 wrote to memory of 2732	2860	QvodSetuPlus3.exe	32
PID 2860 wrote to memory of 2436	2860	QvodSetuPlus3.exe	34
PID 2860 wrote to memory of 2436	2860	QvodSetuPlus3.exe	34
PID 2860 wrote to memory of 2436	2860	QvodSetuPlus3.exe	34
PID 2860 wrote to memory of 2436	2860	QvodSetuPlus3.exe	34
PID 2860 wrote to memory of 2436	2860	QvodSetuPlus3.exe	34
PID 2860 wrote to memory of 2436	2860	QvodSetuPlus3.exe	34
PID 2860 wrote to memory of 2436	2860	QvodSetuPlus3.exe	34
PID 2860 wrote to memory of 572	2860	QvodSetuPlus3.exe	39
PID 2860 wrote to memory of 572	2860	QvodSetuPlus3.exe	39
PID 2860 wrote to memory of 572	2860	QvodSetuPlus3.exe	39
PID 2860 wrote to memory of 572	2860	QvodSetuPlus3.exe	39
PID 2860 wrote to memory of 572	2860	QvodSetuPlus3.exe	39
PID 2860 wrote to memory of 572	2860	QvodSetuPlus3.exe	39
PID 2860 wrote to memory of 572	2860	QvodSetuPlus3.exe	39
PID 2860 wrote to memory of 2528	2860	QvodSetuPlus3.exe	44
PID 2860 wrote to memory of 2528	2860	QvodSetuPlus3.exe	44
PID 2860 wrote to memory of 2528	2860	QvodSetuPlus3.exe	44
PID 2860 wrote to memory of 2528	2860	QvodSetuPlus3.exe	44
PID 2860 wrote to memory of 2528	2860	QvodSetuPlus3.exe	44
PID 2860 wrote to memory of 2528	2860	QvodSetuPlus3.exe	44
PID 2860 wrote to memory of 2528	2860	QvodSetuPlus3.exe	44
PID 2860 wrote to memory of 876	2860	QvodSetuPlus3.exe	50
PID 2860 wrote to memory of 876	2860	QvodSetuPlus3.exe	50
PID 2860 wrote to memory of 876	2860	QvodSetuPlus3.exe	50
PID 2860 wrote to memory of 876	2860	QvodSetuPlus3.exe	50
PID 2860 wrote to memory of 876	2860	QvodSetuPlus3.exe	50
PID 2860 wrote to memory of 876	2860	QvodSetuPlus3.exe	50
PID 2860 wrote to memory of 876	2860	QvodSetuPlus3.exe	50
PID 2860 wrote to memory of 316	2860	QvodSetuPlus3.exe	55
PID 2860 wrote to memory of 316	2860	QvodSetuPlus3.exe	55
PID 2860 wrote to memory of 316	2860	QvodSetuPlus3.exe	55
PID 2860 wrote to memory of 316	2860	QvodSetuPlus3.exe	55
PID 2860 wrote to memory of 316	2860	QvodSetuPlus3.exe	55
PID 2860 wrote to memory of 316	2860	QvodSetuPlus3.exe	55
PID 2860 wrote to memory of 316	2860	QvodSetuPlus3.exe	55

C:\Users\Admin\AppData\Local\Temp\052ca5f7b4c0290089a34faa8cabbebe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\052ca5f7b4c0290089a34faa8cabbebe_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\QvodSetuPlus3.exe
  "C:\Users\Admin\AppData\Local\Temp\QvodSetuPlus3.exe"
  2⤵
  - Drops file in Drivers directory
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Impair Defenses: Safe Mode Boot
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\explorer.exe
    C:\Windows\explorer.exe
    3⤵
    PID:2732
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\\svchost.exe 10.127.0.1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2436
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\\svchost.exe 10.127.0.2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:572
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\\svchost.exe 10.127.0.3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\\svchost.exe 10.127.0.4
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:876
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\\svchost.exe 10.127.0.5
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\QvodSetuPlus3.exe

Filesize
16KB

MD5
e9b1168dfa8380f3a4386121dc521f14

SHA1
e34b21ddce0f58d7b102d3ec20dbc2ad56d7fc50

SHA256
8754a5c1bca666c3c0d9405d26680115c67df90e55f68ddd4ab91807c1464243

SHA512
deaa8691493f59ad679931bdb1f2bc2aa4cbeba3dae404f45e37e8fefd69bb97fad0b8763fb767ab24890a30ecb7f6e5b80b8cd5e46e7eed32f0e9e307dc536d

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
5KB

MD5
e7572d408f825a614409a5b84b9a256a

SHA1
8feb82d74753a1443baf2ab5680027de3635c4ab

SHA256
4040246d0f051cd885f43ede9220cbde8b0134e23d529973fcb41399010b4023

SHA512
5b817205daeb2392f2170cc1857daf0067fa3a7b51bf2ef83e30c5f4cfe1b2d5db1fd93ecac003466d376a4f39578bd56c40fa8a7c06cb1d57360c35c76c3ef5

Download Submit
\Users\Admin\AppData\Local\Temp\urlm0n.dll

Filesize
1.1MB

MD5
2ee1e467d73642afddb03019f58c252b

SHA1
ea1f3b03f46db029a955190692cecbc571e1d46c

SHA256
5a7d5dafe22082b3ed035d640578ed7b5005edfe80e5c911774ec77a2caff1b3

SHA512
3482715d7c9adbfe61f7834120d1a8fce47ae5d70add285ddcfe8802a5d4a95ae00ae82079b9b9639c5d4fa5126ecfc61e1b09a141c0fea86926e26fc22f9082

Download Submit
memory/2148-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2148-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2860-21-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/2860-49-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download