Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2024 18:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe
-
Size
45KB
-
MD5
0c0b84c014377fcb7fd34e305cd7560b
-
SHA1
7440242af02ee3d7105661dad5ff9d69ca64ccb3
-
SHA256
e87a3ec4a623406eee7c077e267c50576780b415c07f8a62fbf8135b04e0fd60
-
SHA512
c83d421e9cff30638e1f988f00b556d57cd8213a4a2341ef1be0efddba058cf56b9f214902ce83ef724a6d9e3552012d1147c1ca6281aa219e9b55a75c114960
-
SSDEEP
768:E1AuwHyeFo6NPIFAoslbf8eRYLGXdoIFbb5omuKWcbsvwnoT9D88888888888JXo:EOxyeFo6NPCAosxYyXdF5oy3VoKo
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe -
Executes dropped EXE 12 IoCs
pid Process 2516 SVCHOST.EXE 2404 SVCHOST.EXE 2836 SVCHOST.EXE 380 SVCHOST.EXE 4068 SVCHOST.EXE 1936 SPOOLSV.EXE 4316 SVCHOST.EXE 4712 SVCHOST.EXE 1260 SPOOLSV.EXE 1308 SPOOLSV.EXE 3496 SVCHOST.EXE 4348 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe File opened for modification F:\Recycled\desktop.ini 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\Y: 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\P: 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe File opened (read-only) \??\Q: 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\K: 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe File opened (read-only) \??\W: 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\N: 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\M: 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe File opened (read-only) \??\O: 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe File opened (read-only) \??\U: 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe File opened (read-only) \??\V: 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\S: 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\R: 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe File opened (read-only) \??\X: 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\J: 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\G: 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\E: 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language userinit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\*\QuickTip = "prop:Type;Size" 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\*\TileInfo = "prop:Type;Size" 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4880 WINWORD.EXE 4880 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1936 SPOOLSV.EXE 1936 SPOOLSV.EXE 1936 SPOOLSV.EXE 1936 SPOOLSV.EXE 1936 SPOOLSV.EXE 1936 SPOOLSV.EXE 1936 SPOOLSV.EXE 1936 SPOOLSV.EXE 1936 SPOOLSV.EXE 1936 SPOOLSV.EXE 1936 SPOOLSV.EXE 1936 SPOOLSV.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2516 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 2836 SVCHOST.EXE 3844 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe 3844 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe 3844 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe 3844 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 3844 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe 2516 SVCHOST.EXE 2404 SVCHOST.EXE 2836 SVCHOST.EXE 380 SVCHOST.EXE 4068 SVCHOST.EXE 1936 SPOOLSV.EXE 4316 SVCHOST.EXE 4712 SVCHOST.EXE 1260 SPOOLSV.EXE 1308 SPOOLSV.EXE 3496 SVCHOST.EXE 4348 SPOOLSV.EXE 4880 WINWORD.EXE 4880 WINWORD.EXE 4880 WINWORD.EXE 4880 WINWORD.EXE 4880 WINWORD.EXE 4880 WINWORD.EXE 4880 WINWORD.EXE -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 3844 wrote to memory of 2516 3844 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe 82 PID 3844 wrote to memory of 2516 3844 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe 82 PID 3844 wrote to memory of 2516 3844 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe 82 PID 2516 wrote to memory of 2404 2516 SVCHOST.EXE 83 PID 2516 wrote to memory of 2404 2516 SVCHOST.EXE 83 PID 2516 wrote to memory of 2404 2516 SVCHOST.EXE 83 PID 2516 wrote to memory of 2836 2516 SVCHOST.EXE 84 PID 2516 wrote to memory of 2836 2516 SVCHOST.EXE 84 PID 2516 wrote to memory of 2836 2516 SVCHOST.EXE 84 PID 2836 wrote to memory of 380 2836 SVCHOST.EXE 85 PID 2836 wrote to memory of 380 2836 SVCHOST.EXE 85 PID 2836 wrote to memory of 380 2836 SVCHOST.EXE 85 PID 2836 wrote to memory of 4068 2836 SVCHOST.EXE 86 PID 2836 wrote to memory of 4068 2836 SVCHOST.EXE 86 PID 2836 wrote to memory of 4068 2836 SVCHOST.EXE 86 PID 2836 wrote to memory of 1936 2836 SVCHOST.EXE 87 PID 2836 wrote to memory of 1936 2836 SVCHOST.EXE 87 PID 2836 wrote to memory of 1936 2836 SVCHOST.EXE 87 PID 1936 wrote to memory of 4316 1936 SPOOLSV.EXE 88 PID 1936 wrote to memory of 4316 1936 SPOOLSV.EXE 88 PID 1936 wrote to memory of 4316 1936 SPOOLSV.EXE 88 PID 1936 wrote to memory of 4712 1936 SPOOLSV.EXE 89 PID 1936 wrote to memory of 4712 1936 SPOOLSV.EXE 89 PID 1936 wrote to memory of 4712 1936 SPOOLSV.EXE 89 PID 1936 wrote to memory of 1260 1936 SPOOLSV.EXE 90 PID 1936 wrote to memory of 1260 1936 SPOOLSV.EXE 90 PID 1936 wrote to memory of 1260 1936 SPOOLSV.EXE 90 PID 2516 wrote to memory of 1308 2516 SVCHOST.EXE 91 PID 2516 wrote to memory of 1308 2516 SVCHOST.EXE 91 PID 2516 wrote to memory of 1308 2516 SVCHOST.EXE 91 PID 3844 wrote to memory of 3496 3844 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe 92 PID 3844 wrote to memory of 3496 3844 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe 92 PID 3844 wrote to memory of 3496 3844 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe 92 PID 2516 wrote to memory of 3468 2516 SVCHOST.EXE 93 PID 2516 wrote to memory of 3468 2516 SVCHOST.EXE 93 PID 2516 wrote to memory of 3468 2516 SVCHOST.EXE 93 PID 3844 wrote to memory of 4348 3844 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe 94 PID 3844 wrote to memory of 4348 3844 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe 94 PID 3844 wrote to memory of 4348 3844 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe 94 PID 3468 wrote to memory of 224 3468 userinit.exe 95 PID 3468 wrote to memory of 224 3468 userinit.exe 95 PID 3468 wrote to memory of 224 3468 userinit.exe 95 PID 3844 wrote to memory of 4880 3844 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe 97 PID 3844 wrote to memory of 4880 3844 0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2404
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:380
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4068
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4316
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4712
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1260
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1308
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\Explorer.exeExplorer.exe "C:\recycled\SVCHOST.exe"4⤵
- System Location Discovery: System Language Discovery
PID:224
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3496
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4348
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0c0b84c014377fcb7fd34e305cd7560b_JaffaCakes118.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4880
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD58a4a14f4db8652b3429532f84f8fc7b0
SHA1cfe555fce3cb6ee1739db97f8373495e0de997e7
SHA256aba896d21a239050b59f82af0cf2f2c92560954ea7b2bf6b13020bc9e7af6c7f
SHA51272783adf6571bd00523453cc0ad107376b486da4768332c7394bb985d28c97705419f884e84666c00e000742a2e8a4d02eaeef0af3f0ed3c1776ccc5f52e7635
-
Filesize
45KB
MD5bc1ac6dbd2734085fe748ecae444a733
SHA1a0eb1e011b397d67408cd18f82cf70523706186c
SHA256ca18a1ff4e7cddd04626ab64b97dbf915999023534e3d906217f4099c6e8f69a
SHA5127c5c8ad06d199b13f7d039b08b445bbcfe30b2402ad4218e2caadad1d090ad087bc06bf7dbd8c7f3be33a1b37fdf09e1dbc9514578a636e53d984a32c5d04531
-
Filesize
65B
MD5ad0b0b4416f06af436328a3c12dc491b
SHA1743c7ad130780de78ccbf75aa6f84298720ad3fa
SHA25623521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416
SHA512884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
45KB
MD54e1d4ec1d0dfecd81bef599b9c179e7f
SHA18ac27efad3aa39a21e3fe4e902e74a178b31a60d
SHA2569448ddc87e9cb92bccc571714983a76a1960aaad32e4a10d06a78929dbaee32f
SHA5123ecd19561aefc599d67059164a02c67616fd01e32585a90802c75c7fabd0e50b96c572f6b1b4982fede996883d240e2fe4431870855e2716b698f6e3bd68ecf2