Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 10:24
Behavioral task
behavioral1
Sample
17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe
-
Size
20KB
-
MD5
17b4cacaa258654d10cbf083d0d3c350
-
SHA1
7cb87f63202cde1e18deb0f7d18e8083c9ec2225
-
SHA256
432d9fbf7c68caf68fce7f533e3d00a2876a1e99bce4168a4946766a8dd4e93e
-
SHA512
c35b9908dc136fe280a1979c3e4dc956c15ec929fbcb6bbd2a3cd707d048a7880d2db96e0df12213f44552ad0f84930e47112732e154cbee8a341d15f88d3efd
-
SSDEEP
384:g58AcUoUQKNRYELxQUHDvmk3E+KDvB77777J77c77c77c72qh5eZEKup9Ebir:g5BOFKksO1mE9B77777J77c77c77c71b
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"C:\\Windows\\728166.exe\"" 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"C:\\Windows\\728166.exe\"" 728166.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"C:\\Windows\\728166.exe\"" 728166RQSUQW.exe -
Executes dropped EXE 5 IoCs
pid Process 4296 728166.exe 3148 728166RQSUQW.exe 3592 728166RQSUQW.exe 2576 728166.exe 4060 728166.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\728166.exe = "C:\\Windows\\728166.exe" 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\728166.exe = "C:\\Windows\\728166.exe" 728166.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\728166.exe = "C:\\Windows\\728166.exe" 728166RQSUQW.exe -
resource yara_rule behavioral2/memory/3960-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x00070000000234d4-7.dat upx behavioral2/files/0x00070000000234d3-9.dat upx behavioral2/memory/3592-19-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3592-23-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2576-29-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4060-35-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3960-37-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4296-38-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3148-39-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3148-41-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4296-40-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3148-43-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4296-42-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4296-44-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3148-45-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4296-46-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3148-47-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4296-48-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3148-49-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3148-51-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4296-50-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4296-52-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3148-53-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3148-55-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4296-54-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3148-57-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4296-56-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4296-58-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3148-59-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3148-61-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4296-60-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4296-62-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3148-63-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4296-64-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3148-65-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4296-66-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3148-67-0x0000000000400000-0x000000000040F000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\728166.exe 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe File opened for modification C:\Windows\728166RQSUQW.exe 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 48 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 728166.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 728166.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 728166RQSUQW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 728166.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 728166RQSUQW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe -
Kills process with taskkill 42 IoCs
pid Process 4256 TASKKILL.exe 1440 TASKKILL.exe 3836 TASKKILL.exe 1032 TASKKILL.exe 1792 TASKKILL.exe 4780 TASKKILL.exe 1020 TASKKILL.exe 800 TASKKILL.exe 2988 TASKKILL.exe 2956 TASKKILL.exe 4776 TASKKILL.exe 4872 TASKKILL.exe 2344 TASKKILL.exe 2232 TASKKILL.exe 1308 TASKKILL.exe 2336 TASKKILL.exe 2996 TASKKILL.exe 1416 TASKKILL.exe 4068 TASKKILL.exe 4796 TASKKILL.exe 3996 TASKKILL.exe 3888 TASKKILL.exe 3260 TASKKILL.exe 3312 TASKKILL.exe 4568 TASKKILL.exe 1992 TASKKILL.exe 4100 TASKKILL.exe 4200 TASKKILL.exe 4288 TASKKILL.exe 1744 TASKKILL.exe 3984 TASKKILL.exe 1496 TASKKILL.exe 4460 TASKKILL.exe 1736 TASKKILL.exe 1724 TASKKILL.exe 4708 TASKKILL.exe 4092 TASKKILL.exe 2924 TASKKILL.exe 3560 TASKKILL.exe 2088 TASKKILL.exe 4616 TASKKILL.exe 5096 TASKKILL.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 4100 TASKKILL.exe Token: SeDebugPrivilege 2988 TASKKILL.exe Token: SeDebugPrivilege 4068 TASKKILL.exe Token: SeDebugPrivilege 3984 TASKKILL.exe Token: SeDebugPrivilege 4708 TASKKILL.exe Token: SeDebugPrivilege 5096 TASKKILL.exe Token: SeDebugPrivilege 4796 TASKKILL.exe Token: SeDebugPrivilege 3888 TASKKILL.exe Token: SeDebugPrivilege 4872 TASKKILL.exe Token: SeDebugPrivilege 3996 TASKKILL.exe Token: SeDebugPrivilege 2344 TASKKILL.exe Token: SeDebugPrivilege 3260 TASKKILL.exe Token: SeDebugPrivilege 1032 TASKKILL.exe Token: SeDebugPrivilege 4616 TASKKILL.exe Token: SeDebugPrivilege 4092 TASKKILL.exe Token: SeDebugPrivilege 1020 TASKKILL.exe Token: SeDebugPrivilege 3560 TASKKILL.exe Token: SeDebugPrivilege 2996 TASKKILL.exe Token: SeDebugPrivilege 1440 TASKKILL.exe Token: SeDebugPrivilege 2232 TASKKILL.exe Token: SeDebugPrivilege 1744 TASKKILL.exe Token: SeDebugPrivilege 800 TASKKILL.exe Token: SeDebugPrivilege 1736 TASKKILL.exe Token: SeDebugPrivilege 2956 TASKKILL.exe Token: SeDebugPrivilege 3312 TASKKILL.exe Token: SeDebugPrivilege 2924 TASKKILL.exe Token: SeDebugPrivilege 4780 TASKKILL.exe Token: SeDebugPrivilege 1792 TASKKILL.exe Token: SeDebugPrivilege 4776 TASKKILL.exe Token: SeDebugPrivilege 1496 TASKKILL.exe Token: SeDebugPrivilege 2336 TASKKILL.exe Token: SeDebugPrivilege 1992 TASKKILL.exe Token: SeDebugPrivilege 3836 TASKKILL.exe Token: SeDebugPrivilege 1416 TASKKILL.exe Token: SeDebugPrivilege 1724 TASKKILL.exe Token: SeDebugPrivilege 4256 TASKKILL.exe Token: SeDebugPrivilege 4288 TASKKILL.exe Token: SeDebugPrivilege 2088 TASKKILL.exe Token: SeDebugPrivilege 4200 TASKKILL.exe Token: SeDebugPrivilege 4568 TASKKILL.exe Token: SeDebugPrivilege 1308 TASKKILL.exe Token: SeDebugPrivilege 4460 TASKKILL.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 4296 728166.exe 3148 728166RQSUQW.exe 3592 728166RQSUQW.exe 2576 728166.exe 4060 728166.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3960 wrote to memory of 4068 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 83 PID 3960 wrote to memory of 4068 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 83 PID 3960 wrote to memory of 4068 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 83 PID 3960 wrote to memory of 3260 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 84 PID 3960 wrote to memory of 3260 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 84 PID 3960 wrote to memory of 3260 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 84 PID 3960 wrote to memory of 3888 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 85 PID 3960 wrote to memory of 3888 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 85 PID 3960 wrote to memory of 3888 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 85 PID 3960 wrote to memory of 3984 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 86 PID 3960 wrote to memory of 3984 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 86 PID 3960 wrote to memory of 3984 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 86 PID 3960 wrote to memory of 3996 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 87 PID 3960 wrote to memory of 3996 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 87 PID 3960 wrote to memory of 3996 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 87 PID 3960 wrote to memory of 4092 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 88 PID 3960 wrote to memory of 4092 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 88 PID 3960 wrote to memory of 4092 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 88 PID 3960 wrote to memory of 2988 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 89 PID 3960 wrote to memory of 2988 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 89 PID 3960 wrote to memory of 2988 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 89 PID 3960 wrote to memory of 4796 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 90 PID 3960 wrote to memory of 4796 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 90 PID 3960 wrote to memory of 4796 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 90 PID 3960 wrote to memory of 4100 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 91 PID 3960 wrote to memory of 4100 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 91 PID 3960 wrote to memory of 4100 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 91 PID 3960 wrote to memory of 4708 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 92 PID 3960 wrote to memory of 4708 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 92 PID 3960 wrote to memory of 4708 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 92 PID 3960 wrote to memory of 5096 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 93 PID 3960 wrote to memory of 5096 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 93 PID 3960 wrote to memory of 5096 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 93 PID 3960 wrote to memory of 4872 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 94 PID 3960 wrote to memory of 4872 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 94 PID 3960 wrote to memory of 4872 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 94 PID 3960 wrote to memory of 2344 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 95 PID 3960 wrote to memory of 2344 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 95 PID 3960 wrote to memory of 2344 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 95 PID 3960 wrote to memory of 1032 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 96 PID 3960 wrote to memory of 1032 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 96 PID 3960 wrote to memory of 1032 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 96 PID 3960 wrote to memory of 4296 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 111 PID 3960 wrote to memory of 4296 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 111 PID 3960 wrote to memory of 4296 3960 17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe 111 PID 4296 wrote to memory of 1736 4296 728166.exe 112 PID 4296 wrote to memory of 1736 4296 728166.exe 112 PID 4296 wrote to memory of 1736 4296 728166.exe 112 PID 4296 wrote to memory of 4776 4296 728166.exe 113 PID 4296 wrote to memory of 4776 4296 728166.exe 113 PID 4296 wrote to memory of 4776 4296 728166.exe 113 PID 4296 wrote to memory of 800 4296 728166.exe 114 PID 4296 wrote to memory of 800 4296 728166.exe 114 PID 4296 wrote to memory of 800 4296 728166.exe 114 PID 4296 wrote to memory of 1496 4296 728166.exe 115 PID 4296 wrote to memory of 1496 4296 728166.exe 115 PID 4296 wrote to memory of 1496 4296 728166.exe 115 PID 4296 wrote to memory of 3312 4296 728166.exe 116 PID 4296 wrote to memory of 3312 4296 728166.exe 116 PID 4296 wrote to memory of 3312 4296 728166.exe 116 PID 4296 wrote to memory of 2924 4296 728166.exe 117 PID 4296 wrote to memory of 2924 4296 728166.exe 117 PID 4296 wrote to memory of 2924 4296 728166.exe 117 PID 4296 wrote to memory of 2232 4296 728166.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\17b4cacaa258654d10cbf083d0d3c350_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4068
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM services.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3260
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM lsass.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3888
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM csrss.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM smss.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3996
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4092
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM svchost.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4796
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM services.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4100
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM lsass.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4708
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM csrss.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM smss.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4872
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM svchost.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1032
-
-
C:\Windows\728166.exeC:\Windows\728166.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1736
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM services.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4776
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM lsass.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:800
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM csrss.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1496
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM smss.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3312
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2924
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM svchost.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3560
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM services.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM lsass.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1744
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM csrss.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4616
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM smss.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1020
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM svchost.exe /T3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
-
C:\Windows\728166RQSUQW.exeC:\Windows\728166RQSUQW.exe3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3148 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM services.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4568
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM lsass.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2336
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM csrss.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM smss.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4780
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4256
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM svchost.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4288
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM services.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4460
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM lsass.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM csrss.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1416
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM smss.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4200
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1724
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /S COMPUTERNAME /F /IM svchost.exe /T4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3836
-
-
C:\Windows\728166RQSUQW.exeC:\Windows\728166RQSUQW.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3592
-
-
C:\Windows\728166.exeC:\Windows\728166.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2576
-
-
-
C:\Windows\728166.exeC:\Windows\728166.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4060
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5dd8458aedbbd4a0ef1cc0030fe232d87
SHA1425ce52efeed2db6d81d39b7c56555597578ab48
SHA25611dce98da4350436be3a2bd90d320839d418c832883dc81e9f421ba0a9c4919b
SHA512acf84e6a83eaefeea5beda5c000b878e662052964f1a2ec1e755cc3e4cef3b1db4f46c58b3e5939e5428ab9aa8363e8bea1ffdd1fd7c9d6806419f61faf29f72
-
Filesize
18KB
MD54340708f602a5d64e291e5410594d191
SHA16512cd9e3a3d154bbc948756bca286855a6e68ac
SHA256a4c683fd1b0f06c08bd975a253922ff830d339752210167e4ff7a8528d0edfd2
SHA512e0e843cac6198c289b519a009aba2c22d3a26378fa9d791e06c42aa63b12728b4a7229dd95903ef2e51bf010b09e5e11d3aeb7e706cf9172e23353083580d5da