69f78fc3dd42063dbe2e6c0233067c34271d0dcf7d2d6c44b23463a25345b16c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Size

321KB
MD5

3ce380d5db10cc81fe689d502460971c
SHA1

b4b06941a63364f67e3d13fe0104dad7cbe66742
SHA256

69f78fc3dd42063dbe2e6c0233067c34271d0dcf7d2d6c44b23463a25345b16c
SHA512

20576563c8a425a7a00e2614e0cb9997aaece39694a6c02a60429844733c28b920d684fa80f10603e9ad001325dfacc3d9831c7f94d77c3ef0a3360d21e4f99e
SSDEEP

6144:ePdZrnE4ogL2B0lsdA+TyzQm74p/0QzMuSvi:g9nEo1lsdAgEQm74p/04Dai

Score

7^/10

bootkit discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
3940	SeFastInstall2_3218.exe
1688	41C85084.exe
2280	41C85084.exe
692	41C85084.exe
3932	41C85084.exe
4936	41C85084.exe
3176	41C85084.exe
2724	41C85084.exe

Loads dropped DLL 19 IoCs

pid	Process
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	SeFastInstall2_3218.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3940-23-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/files/0x000300000001e399-22.dat	upx
behavioral2/memory/3940-106-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/3940-108-0x0000000000400000-0x00000000004AB000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WinRAR\WinRAR.knl	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\WinRAR\WinRAR.knl	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
File created	C:\Program Files (x86)\Internet Explorer\IEXPLOR.EXE	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\IEXPLOR.EXE	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SeFastInstall2_3218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41C85084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41C85084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41C85084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41C85084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41C85084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41C85084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41C85084.exe

Modifies File Icons 2 IoCs

ransomware

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Shell Icons	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe

Modifies Shortcut Icons 2 IoCs

Modifies/removes arrow indicator from shortcut icons.

ransomware

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\29 = "C:\\Windows\\system32\\shell32.dll,50"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\29 = "C:\\Windows\\system32\\shell32.dll,50"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.knl\ = "wfile"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Open2\ = "ÔÚÃüÁîÌáÊ¾·ûÖÐ´ò¿ª(&W)"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ShellEx\DropHandler\ = "{60254CA5-953B-11CF-8C96-00AA00B8708C}"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1C1D8F-7673-48E8-B19C-25BC357B5605}\ShellFolder\Attributes = "0"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\DefaultIcon\ = "%SystemRoot%\\SysWow64\\WScript.exe,3"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Print	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\shell\ = "open"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Print\ = "´òÓ¡(&P)"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Open\Command	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\CLSID\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1C1D8F-7673-48E8-B19C-25BC357B5605}	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\FriendlyTypeName = "@%SystemRoot%\\System32\\wshext.dll,-4805"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\shell\open\command\ = "WScript.exe \"C:\\Program Files (x86)\\WinRAR\\winrar.knl\" \"%1\""	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\shellex	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ScriptEngine	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Print\Command\ = "%SystemRoot%\\SysWow64\\Notepad.exe /p %1"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.qc\ = "qcfile"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\DefaultIcon	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Edit\Command\ = "%SystemRoot%\\SysWow64\\Notepad.exe %1"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Open\Command\ = "%SystemRoot%\\SysWow64\\WScript.exe \"%1\" %*"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1C1D8F-7673-48E8-B19C-25BC357B5605}\Shell	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Edit\Command	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ShellEx\PropertySheetHandlers\WSHProps	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.qc	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Edit\ = "±à¼\u00ad(&E)"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\shellex\ContextMenuHandlers	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\shellex\IconHandler\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1C1D8F-7673-48E8-B19C-25BC357B5605}\InfoTip = "Intrnet Explerer"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1C1D8F-7673-48E8-B19C-25BC357B5605}\ShellFolder	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Edit	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Open2	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\shell	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\shell\open	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ScriptEngine\ = "JScript.Encode"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ShellEx\PropertySheetHandlers\WSHProps\ = "{60254CA5-953B-11CF-8C96-00AA00B8708C}"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\NeverShowExt	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\DefaultIcon\ = "%SystemRoot%\\SysWow64\\url.dll,0"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ShellEx	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\DefaultIcon	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Open	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\shell\open\command	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.knl	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ShellEx\DropHandler	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1C1D8F-7673-48E8-B19C-25BC357B5605}\ = "Intrnet Explerer"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1C1D8F-7673-48E8-B19C-25BC357B5605}\DefaultIcon\ = "C:\\Windows\\SysWow64\\SHELL32.DLL,220"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Print\Command	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ShellEx\PropertySheetHandlers	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\ = "¿ì½Ý·½Ê½"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\qcfile\shellex\ContextMenuHandlers\	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\ = "JScript ÒÑ±àÂëµÄ Script ÎÄ¼þ"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Open\ = "´ò¿ª(&O)"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Open2\Command	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\wFile\Shell\Open2\Command\ = "%SystemRoot%\\SysWow64\\CScript.exe \"%1\" %*"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1C1D8F-7673-48E8-B19C-25BC357B5605}\DefaultIcon	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1C1D8F-7673-48E8-B19C-25BC357B5605}\Shell\Internet Explorer\Command\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe http://www.pp2345.com"	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1C1D8F-7673-48E8-B19C-25BC357B5605}\Shell\Internet Explorer	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3940	SeFastInstall2_3218.exe
3940	SeFastInstall2_3218.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 4252	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	85
PID 3936 wrote to memory of 4252	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	85
PID 3936 wrote to memory of 4252	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	85
PID 3936 wrote to memory of 3940	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	89
PID 3936 wrote to memory of 3940	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	89
PID 3936 wrote to memory of 3940	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	89
PID 3936 wrote to memory of 1688	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	90
PID 3936 wrote to memory of 1688	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	90
PID 3936 wrote to memory of 1688	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	90
PID 3936 wrote to memory of 2280	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	92
PID 3936 wrote to memory of 2280	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	92
PID 3936 wrote to memory of 2280	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	92
PID 3936 wrote to memory of 692	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	95
PID 3936 wrote to memory of 692	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	95
PID 3936 wrote to memory of 692	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	95
PID 3936 wrote to memory of 3932	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	97
PID 3936 wrote to memory of 3932	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	97
PID 3936 wrote to memory of 3932	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	97
PID 3936 wrote to memory of 4936	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	99
PID 3936 wrote to memory of 4936	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	99
PID 3936 wrote to memory of 4936	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	99
PID 3936 wrote to memory of 3176	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	101
PID 3936 wrote to memory of 3176	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	101
PID 3936 wrote to memory of 3176	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	101
PID 3936 wrote to memory of 2724	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	103
PID 3936 wrote to memory of 2724	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	103
PID 3936 wrote to memory of 2724	3936	3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe	103

C:\Users\Admin\AppData\Local\Temp\3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3ce380d5db10cc81fe689d502460971c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies File Icons
- Modifies Shortcut Icons
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SysWOW64\WScript.exe
  "WScript.exe" "C:\Program Files (x86)\WinRAR\WinRAR.knl"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4252
- C:\Users\Admin\AppData\Local\Temp\SeFastInstall2_3218.exe
  "C:\Users\Admin\AppData\Local\Temp\SeFastInstall2_3218.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3940
- C:\Users\Admin\AppData\Local\Temp\41C85084.exe
  C:\Users\Admin\AppData\Local\Temp\41C85084.exe "C:\Users\Public\Desktop\Internet Explerer" /P "Admin":F /y
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1688
- C:\Users\Admin\AppData\Local\Temp\41C85084.exe
  C:\Users\Admin\AppData\Local\Temp\41C85084.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Æô¶¯ Internet Explerer ä¯ÀÀÆ÷.lnk" /P "Admin":F /y
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2280
- C:\Users\Admin\AppData\Local\Temp\41C85084.exe
  C:\Users\Admin\AppData\Local\Temp\41C85084.exe "C:\Users\Public\Desktop" /P "Admin":R /y
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:692
- C:\Users\Admin\AppData\Local\Temp\41C85084.exe
  C:\Users\Admin\AppData\Local\Temp\41C85084.exe "C:\Users\Public\Desktop" /E /G "Admin":W /y
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3932
- C:\Users\Admin\AppData\Local\Temp\41C85084.exe
  C:\Users\Admin\AppData\Local\Temp\41C85084.exe "C:\Users\Public\Desktop" /E /G "Admin":C /y
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4936
- C:\Users\Admin\AppData\Local\Temp\41C85084.exe
  C:\Users\Admin\AppData\Local\Temp\41C85084.exe "C:\Users\Public\Desktop\Internet Explerer.lnk" /d "Admin" /y
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3176
- C:\Users\Admin\AppData\Local\Temp\41C85084.exe
  C:\Users\Admin\AppData\Local\Temp\41C85084.exe "C:\Users\Public\Desktop\Internet Explerer.lnk" /E /G "Admin":R /y
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\WinRAR\WinRAR.knl

Filesize
10KB

MD5
591a029ecb2a408a7d830fe2a5489f86

SHA1
275969c227d35cf93d37c1f2835be63d4b5c85aa

SHA256
88da1f80916de92da0ee9b98766c2fcd9a7098f281e1db78363165e283e869f4

SHA512
c6f4e8373a049b4096e29e62af4f25eae357e8826339303a3508b4ebe22fb3d12eff12e1cdd58dc872e1cf5675ff7cd635052cc671867bfb42c8203b6c069adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\41C85084.exe

Filesize
44KB

MD5
78fd41a1e1d2cf1c7657cf80bdde1164

SHA1
acb97223f909ab20dd0b0e655a8869e78b056d2b

SHA256
01259b3cd50d39ca21b03af4e22a7bca2b91cf11ab4ce78661c646f08f6bce00

SHA512
317e4013bdd70cd50d28961581fe7b774116ea83083718c9db921a86adab5c8d2d3a5cdedd9d172ba65b7a3c7b0699aa8546061b995d3f62e10062f568b78077

Download Submit
C:\Users\Admin\AppData\Local\Temp\SeFastInstall2_3218.exe

Filesize
227KB

MD5
006bcf6d8e9bcda4ad8323f3622e245b

SHA1
45b88bd752ea8853a3aebf5779ae47666253251c

SHA256
8854b97a765d20e2f15cc2da23bd78584bc3f67ec05a7e3f16020690f25d3821

SHA512
4008fbce2719618acd2a4f852a601517935a018f56ff361c4c08a88fb1446f2e35652c8128ed86b313bd198966ffb8892c6ee7000132551d396dbcb40ba48ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyC1AB.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyC1AB.tmp\inetc.dll

Filesize
20KB

MD5
8d8fdad7e153d6b82913f6fdc407d12c

SHA1
aabbeed33cd5221e4cb22aab6e48310df94facfd

SHA256
e727c8bba6686c4814602f2bc089af4b4cf3498d1dbe1a08d8c4732da5ba046b

SHA512
42bc0ce1aca63904c34025307fd4b1d9f480ae47e42e7dfa48bbbf8286d947de2989435ad7a748951291307949217afeebcd31d10a1356c9366d3187085773a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyC1AB.tmp\md5dll.dll

Filesize
8KB

MD5
a7d710e78711d5ab90e4792763241754

SHA1
f31cecd926c5d497aba163a17b75975ec34beb13

SHA256
9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2

SHA512
f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyC1AB.tmp\nsExec.dll

Filesize
6KB

MD5
e54eb27fb5048964e8d1ec7a1f72334b

SHA1
2b76d7aedafd724de96532b00fbc6c7c370e4609

SHA256
ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824

SHA512
c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4

Download Submit
C:\Users\Public\Desktop\Internet Explerer.lnk

Filesize
1KB

MD5
77f024b26c7931586edd0c0a1ca2795e

SHA1
606fa93037023e41c710b2ed676c992689155d43

SHA256
f65fe38bf3d95dd3ccb941a4fa142dd9fe60b4de4f9f845b843492216f1029f7

SHA512
647ca3e7ad514531faf10d8cfc4bb4fa3afa15df84efeac93f3059c2b87da8532e678143e23d9dc5f4a584a6da10ada157aa31f863b13d1d955aafcc80e56185

Download Submit
memory/3940-23-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/3940-106-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/3940-108-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads