8cda444ded1ae7ceee618c59b9535a732295091621828c1f7f07ca044eeea239

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 17:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe
Size

608KB
MD5

145b2d57492686e1c4b6e4c748b762a1
SHA1

478ce27333abef93d976bc9003dc31357b1041cb
SHA256

8cda444ded1ae7ceee618c59b9535a732295091621828c1f7f07ca044eeea239
SHA512

ec02a818280356afb09fe8e9464fb644a9b0bd1a9e37ee2abf14a5002317564f24bb603ecffbfe03ac066aca0b083d77f67ff6cd03cdb4899bc1f8dc2806baa7
SSDEEP

12288:GBYDZJr1E+3JcdrXxE3Vq4Vcim38bJ6vKDn5gcPUbjC:GqF6+ydroLrJ6vKVgkUb

Score

10^/10

discovery evasion persistence spyware stealer upx

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	aUY5E15SY8.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	vuueruc.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	aUY5E15SY8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe

Executes dropped EXE 9 IoCs

pid	Process
2000	aUY5E15SY8.exe
5092	vuueruc.exe
4284	2nua.exe
4512	2nua.exe
4532	2nua.exe
3144	2nua.exe
3672	2nua.exe
5004	2nua.exe
3544	3nua.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /l"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /T"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /H"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /W"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /e"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /d"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /p"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /L"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /A"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /Q"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /F"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /x"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /y"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /h"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /C"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /g"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /m"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /t"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /a"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /N"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /v"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /Z"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /X"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /c"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /n"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /s"	aUY5E15SY8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /M"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /J"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /R"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /B"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /Y"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /I"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /u"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /k"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /S"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /f"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /w"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /D"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /r"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /o"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /V"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /O"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /j"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /z"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /U"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /i"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /b"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /E"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /s"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /K"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /G"	vuueruc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vuueruc = "C:\\Users\\Admin\\vuueruc.exe /q"	vuueruc.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2nua.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	2nua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2nua.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	2nua.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
1928	tasklist.exe
4288	tasklist.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4284 set thread context of 4512	4284	2nua.exe	87
PID 4284 set thread context of 4532	4284	2nua.exe	90
PID 4284 set thread context of 3144	4284	2nua.exe	91
PID 4284 set thread context of 3672	4284	2nua.exe	92
PID 4284 set thread context of 5004	4284	2nua.exe	93

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4532-48-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/4532-52-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/5004-65-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/3672-62-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/3672-61-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/5004-60-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/3672-57-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/4532-56-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/4532-53-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/5004-66-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/5004-73-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/4532-79-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/3672-80-0x0000000000400000-0x0000000000407000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3200	4512	WerFault.exe	87
3160	3544	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aUY5E15SY8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3nua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2nua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2nua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2nua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vuueruc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2nua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2000	aUY5E15SY8.exe
2000	aUY5E15SY8.exe
2000	aUY5E15SY8.exe
2000	aUY5E15SY8.exe
3144	2nua.exe
3144	2nua.exe
4532	2nua.exe
4532	2nua.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
4532	2nua.exe
4532	2nua.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe
5092	vuueruc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	tasklist.exe
Token: SeDebugPrivilege	4288	tasklist.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1284	145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe
2000	aUY5E15SY8.exe
5092	vuueruc.exe
4284	2nua.exe
3672	2nua.exe
5004	2nua.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 2000	1284	145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe	82
PID 1284 wrote to memory of 2000	1284	145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe	82
PID 1284 wrote to memory of 2000	1284	145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe	82
PID 2000 wrote to memory of 5092	2000	aUY5E15SY8.exe	83
PID 2000 wrote to memory of 5092	2000	aUY5E15SY8.exe	83
PID 2000 wrote to memory of 5092	2000	aUY5E15SY8.exe	83
PID 2000 wrote to memory of 3504	2000	aUY5E15SY8.exe	84
PID 2000 wrote to memory of 3504	2000	aUY5E15SY8.exe	84
PID 2000 wrote to memory of 3504	2000	aUY5E15SY8.exe	84
PID 1284 wrote to memory of 4284	1284	145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe	85
PID 1284 wrote to memory of 4284	1284	145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe	85
PID 1284 wrote to memory of 4284	1284	145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe	85
PID 4284 wrote to memory of 4512	4284	2nua.exe	87
PID 4284 wrote to memory of 4512	4284	2nua.exe	87
PID 4284 wrote to memory of 4512	4284	2nua.exe	87
PID 4284 wrote to memory of 4512	4284	2nua.exe	87
PID 3504 wrote to memory of 1928	3504	cmd.exe	89
PID 3504 wrote to memory of 1928	3504	cmd.exe	89
PID 3504 wrote to memory of 1928	3504	cmd.exe	89
PID 4284 wrote to memory of 4532	4284	2nua.exe	90
PID 4284 wrote to memory of 4532	4284	2nua.exe	90
PID 4284 wrote to memory of 4532	4284	2nua.exe	90
PID 4284 wrote to memory of 4532	4284	2nua.exe	90
PID 4284 wrote to memory of 4532	4284	2nua.exe	90
PID 4284 wrote to memory of 4532	4284	2nua.exe	90
PID 4284 wrote to memory of 4532	4284	2nua.exe	90
PID 4284 wrote to memory of 4532	4284	2nua.exe	90
PID 4284 wrote to memory of 3144	4284	2nua.exe	91
PID 4284 wrote to memory of 3144	4284	2nua.exe	91
PID 4284 wrote to memory of 3144	4284	2nua.exe	91
PID 4284 wrote to memory of 3144	4284	2nua.exe	91
PID 4284 wrote to memory of 3144	4284	2nua.exe	91
PID 4284 wrote to memory of 3144	4284	2nua.exe	91
PID 4284 wrote to memory of 3144	4284	2nua.exe	91
PID 4284 wrote to memory of 3144	4284	2nua.exe	91
PID 4284 wrote to memory of 3144	4284	2nua.exe	91
PID 4284 wrote to memory of 3672	4284	2nua.exe	92
PID 4284 wrote to memory of 3672	4284	2nua.exe	92
PID 4284 wrote to memory of 3672	4284	2nua.exe	92
PID 4284 wrote to memory of 3672	4284	2nua.exe	92
PID 4284 wrote to memory of 3672	4284	2nua.exe	92
PID 4284 wrote to memory of 3672	4284	2nua.exe	92
PID 4284 wrote to memory of 3672	4284	2nua.exe	92
PID 4284 wrote to memory of 3672	4284	2nua.exe	92
PID 4284 wrote to memory of 5004	4284	2nua.exe	93
PID 4284 wrote to memory of 5004	4284	2nua.exe	93
PID 4284 wrote to memory of 5004	4284	2nua.exe	93
PID 4284 wrote to memory of 5004	4284	2nua.exe	93
PID 4284 wrote to memory of 5004	4284	2nua.exe	93
PID 4284 wrote to memory of 5004	4284	2nua.exe	93
PID 4284 wrote to memory of 5004	4284	2nua.exe	93
PID 4284 wrote to memory of 5004	4284	2nua.exe	93
PID 1284 wrote to memory of 3544	1284	145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe	97
PID 1284 wrote to memory of 3544	1284	145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe	97
PID 1284 wrote to memory of 3544	1284	145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe	97
PID 1284 wrote to memory of 1112	1284	145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe	100
PID 1284 wrote to memory of 1112	1284	145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe	100
PID 1284 wrote to memory of 1112	1284	145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe	100
PID 1112 wrote to memory of 4288	1112	cmd.exe	102
PID 1112 wrote to memory of 4288	1112	cmd.exe	102
PID 1112 wrote to memory of 4288	1112	cmd.exe	102
PID 5092 wrote to memory of 4288	5092	vuueruc.exe	102
PID 5092 wrote to memory of 4288	5092	vuueruc.exe	102

C:\Users\Admin\AppData\Local\Temp\145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\aUY5E15SY8.exe
  C:\Users\Admin\aUY5E15SY8.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Users\Admin\vuueruc.exe
    "C:\Users\Admin\vuueruc.exe"
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5092
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del aUY5E15SY8.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1928
- C:\Users\Admin\2nua.exe
  C:\Users\Admin\2nua.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Users\Admin\2nua.exe
    "C:\Users\Admin\2nua.exe"
    3⤵
    - Executes dropped EXE
    PID:4512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 80
      4⤵
      Program crash
      PID:3200
- - C:\Users\Admin\2nua.exe
    "C:\Users\Admin\2nua.exe"
    3⤵
    - Executes dropped EXE
    - Maps connected drives based on registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4532
- - C:\Users\Admin\2nua.exe
    "C:\Users\Admin\2nua.exe"
    3⤵
    - Executes dropped EXE
    - Maps connected drives based on registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3144
- - C:\Users\Admin\2nua.exe
    "C:\Users\Admin\2nua.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3672
- - C:\Users\Admin\2nua.exe
    "C:\Users\Admin\2nua.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5004
- C:\Users\Admin\3nua.exe
  C:\Users\Admin\3nua.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 612
    3⤵
    - Program crash
    PID:3160
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c tasklist&&del 145b2d57492686e1c4b6e4c748b762a1_JaffaCakes118.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4512 -ip 4512
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3544 -ip 3544
1⤵
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\2nua.exe

Filesize
224KB

MD5
b64185be04a7c3882871c07358450544

SHA1
6dd00c5f29490e210639ac155e732f7c33e746af

SHA256
c7968bba96e5bc1c47dd24c4b61763eb9d227e89bb259add8ac010711a875f0d

SHA512
604aa723229eddd5225c13d64993966d9a79f0e34aa6b31bb8cfc00e1765319886eaefff276222831e6c5a82cf50634f04a9d59c141329b07a632fc586e4ed21

Download Submit
C:\Users\Admin\3nua.exe

Filesize
273KB

MD5
0fcecac14065f03c4f83bf5ae6ac415b

SHA1
f71aa4708e16a2a3bf15e2a99cc0ce609b08769b

SHA256
79f4527215b4a213f69cf618440202131afa6eb61d2bc6046b718dd4b4ddb787

SHA512
49195c9f00c434228dd76151042dc03f7f87b77438734861face0f4ec40391649ed784aaf82b756113a55d55126c9b18c27e44d0c47ca75564ea079eed161003

Download Submit
C:\Users\Admin\aUY5E15SY8.exe

Filesize
208KB

MD5
380575fdf47f22e24cc214c89f098f9d

SHA1
5d5584fab3dc5267ffacfd4c331555f4f7703fb6

SHA256
04fc572ba5e2e941d3510ed1504cc04490c7f5ff3ec651e6c8ffd6645ef2e0c9

SHA512
70ce73ac9a14224c608e1ab60e21dd8bbd5ebcc8c75bb670c0861c8fc4a478965d39a450d32907ff90baa3a8a2fc9e50a9cc8d7385a330b373d3c9854cc8e7e2

Download Submit
C:\Users\Admin\vuueruc.exe

Filesize
208KB

MD5
be664f45c5087455130f61f02b288f38

SHA1
d86b51076ae6c48e6e60822a72d5afec86de0c66

SHA256
baec319734284e869ecfdef85f668474e59908bca80bf27c0c83ee63d0013522

SHA512
d51a8d59685850f31724e8e6faaa384161e14caeeb16f6c737d040df25f90ec61d1396f69333251ceb02ff95121b2cc6c6ce1919058ece747aed01ec5252f196

Download Submit
memory/3144-54-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3144-82-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3144-59-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/3544-78-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3672-62-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3672-61-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3672-57-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3672-80-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/4532-52-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4532-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4532-53-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4532-79-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4532-48-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5004-65-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5004-73-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5004-66-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5004-60-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download