Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-10-2024 22:00
Static task
static1
Behavioral task
behavioral1
Sample
53f22538d90e23e311265cf9f948f772_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
53f22538d90e23e311265cf9f948f772_JaffaCakes118.exe
-
Size
232KB
-
MD5
53f22538d90e23e311265cf9f948f772
-
SHA1
af79ad12b3597d5dda7cb2b6c992fc67ea0e2306
-
SHA256
fb21688fff23ffa928a80384f0f467e1ca3dc4145153e6c9a82cc5a21fca8d3a
-
SHA512
ae3064f172066ccacf23a5a1dd2daf5d42129bc2d3fd7d4e76d8abf221ed0437c5865b0c3045260437f13cac511784664638ba4717afdcb4b05650dc5bb9674e
-
SSDEEP
6144:z2JR6jBaplmtyCrAotVvp+/cWD0QBZeP2ljm:SJwd9y4JtVvp+EdOeP
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" waiyaa.exe Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" qr5i4eI0.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation qr5i4eI0.exe -
Executes dropped EXE 7 IoCs
pid Process 1860 qr5i4eI0.exe 4700 2eet.exe 3888 waiyaa.exe 4500 2eet.exe 2324 2eet.exe 1424 2eet.exe 2184 2eet.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /P" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /o" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /I" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /D" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /V" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /q" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /g" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /L" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /Z" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /s" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /m" qr5i4eI0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /k" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /N" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /n" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /z" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /y" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /e" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /h" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /H" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /t" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /Y" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /Q" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /W" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /F" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /C" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /G" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /T" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /S" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /d" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /O" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /K" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /M" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /E" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /c" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /r" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /f" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /x" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /i" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /u" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /U" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /m" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /J" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /A" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /X" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /R" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /b" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /v" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /w" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /l" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /a" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /j" waiyaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\waiyaa = "C:\\Users\\Admin\\waiyaa.exe /p" waiyaa.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2eet.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2eet.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 1300 tasklist.exe 2216 tasklist.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4700 set thread context of 4500 4700 2eet.exe 98 PID 4700 set thread context of 2324 4700 2eet.exe 99 PID 4700 set thread context of 1424 4700 2eet.exe 100 PID 4700 set thread context of 2184 4700 2eet.exe 101 -
resource yara_rule behavioral2/memory/4500-37-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2324-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-44-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/2184-54-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/1424-53-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/1424-52-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2184-61-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/2324-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-47-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/2324-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-42-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4500-39-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4500-35-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4500-62-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/2324-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-64-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4500-71-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qr5i4eI0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2eet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2eet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2eet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2eet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53f22538d90e23e311265cf9f948f772_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language waiyaa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 22 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1860 qr5i4eI0.exe 1860 qr5i4eI0.exe 1860 qr5i4eI0.exe 1860 qr5i4eI0.exe 2324 2eet.exe 2324 2eet.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 2324 2eet.exe 2324 2eet.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe 3888 waiyaa.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1300 tasklist.exe Token: SeDebugPrivilege 2216 tasklist.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4996 53f22538d90e23e311265cf9f948f772_JaffaCakes118.exe 1860 qr5i4eI0.exe 3888 waiyaa.exe 4700 2eet.exe 4500 2eet.exe 2184 2eet.exe 1424 2eet.exe -
Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 4996 wrote to memory of 1860 4996 53f22538d90e23e311265cf9f948f772_JaffaCakes118.exe 86 PID 4996 wrote to memory of 1860 4996 53f22538d90e23e311265cf9f948f772_JaffaCakes118.exe 86 PID 4996 wrote to memory of 1860 4996 53f22538d90e23e311265cf9f948f772_JaffaCakes118.exe 86 PID 1860 wrote to memory of 3888 1860 qr5i4eI0.exe 93 PID 1860 wrote to memory of 3888 1860 qr5i4eI0.exe 93 PID 1860 wrote to memory of 3888 1860 qr5i4eI0.exe 93 PID 4996 wrote to memory of 4700 4996 53f22538d90e23e311265cf9f948f772_JaffaCakes118.exe 94 PID 4996 wrote to memory of 4700 4996 53f22538d90e23e311265cf9f948f772_JaffaCakes118.exe 94 PID 4996 wrote to memory of 4700 4996 53f22538d90e23e311265cf9f948f772_JaffaCakes118.exe 94 PID 1860 wrote to memory of 3296 1860 qr5i4eI0.exe 95 PID 1860 wrote to memory of 3296 1860 qr5i4eI0.exe 95 PID 1860 wrote to memory of 3296 1860 qr5i4eI0.exe 95 PID 3296 wrote to memory of 1300 3296 cmd.exe 97 PID 3296 wrote to memory of 1300 3296 cmd.exe 97 PID 3296 wrote to memory of 1300 3296 cmd.exe 97 PID 4700 wrote to memory of 4500 4700 2eet.exe 98 PID 4700 wrote to memory of 4500 4700 2eet.exe 98 PID 4700 wrote to memory of 4500 4700 2eet.exe 98 PID 4700 wrote to memory of 4500 4700 2eet.exe 98 PID 4700 wrote to memory of 4500 4700 2eet.exe 98 PID 4700 wrote to memory of 4500 4700 2eet.exe 98 PID 4700 wrote to memory of 4500 4700 2eet.exe 98 PID 4700 wrote to memory of 4500 4700 2eet.exe 98 PID 4700 wrote to memory of 2324 4700 2eet.exe 99 PID 4700 wrote to memory of 2324 4700 2eet.exe 99 PID 4700 wrote to memory of 2324 4700 2eet.exe 99 PID 4700 wrote to memory of 2324 4700 2eet.exe 99 PID 4700 wrote to memory of 2324 4700 2eet.exe 99 PID 4700 wrote to memory of 2324 4700 2eet.exe 99 PID 4700 wrote to memory of 2324 4700 2eet.exe 99 PID 4700 wrote to memory of 2324 4700 2eet.exe 99 PID 4700 wrote to memory of 1424 4700 2eet.exe 100 PID 4700 wrote to memory of 1424 4700 2eet.exe 100 PID 4700 wrote to memory of 1424 4700 2eet.exe 100 PID 4700 wrote to memory of 1424 4700 2eet.exe 100 PID 4700 wrote to memory of 1424 4700 2eet.exe 100 PID 4700 wrote to memory of 1424 4700 2eet.exe 100 PID 4700 wrote to memory of 1424 4700 2eet.exe 100 PID 4700 wrote to memory of 1424 4700 2eet.exe 100 PID 4700 wrote to memory of 2184 4700 2eet.exe 101 PID 4700 wrote to memory of 2184 4700 2eet.exe 101 PID 4700 wrote to memory of 2184 4700 2eet.exe 101 PID 4700 wrote to memory of 2184 4700 2eet.exe 101 PID 4700 wrote to memory of 2184 4700 2eet.exe 101 PID 4700 wrote to memory of 2184 4700 2eet.exe 101 PID 4700 wrote to memory of 2184 4700 2eet.exe 101 PID 4700 wrote to memory of 2184 4700 2eet.exe 101 PID 4996 wrote to memory of 4728 4996 53f22538d90e23e311265cf9f948f772_JaffaCakes118.exe 102 PID 4996 wrote to memory of 4728 4996 53f22538d90e23e311265cf9f948f772_JaffaCakes118.exe 102 PID 4996 wrote to memory of 4728 4996 53f22538d90e23e311265cf9f948f772_JaffaCakes118.exe 102 PID 4728 wrote to memory of 2216 4728 cmd.exe 104 PID 4728 wrote to memory of 2216 4728 cmd.exe 104 PID 4728 wrote to memory of 2216 4728 cmd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\53f22538d90e23e311265cf9f948f772_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\53f22538d90e23e311265cf9f948f772_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\qr5i4eI0.exeC:\Users\Admin\qr5i4eI0.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\waiyaa.exe"C:\Users\Admin\waiyaa.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3888
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del qr5i4eI0.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
-
-
-
C:\Users\Admin\2eet.exeC:\Users\Admin\2eet.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\2eet.exe"C:\Users\Admin\2eet.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4500
-
-
C:\Users\Admin\2eet.exe"C:\Users\Admin\2eet.exe"3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2324
-
-
C:\Users\Admin\2eet.exe"C:\Users\Admin\2eet.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1424
-
-
C:\Users\Admin\2eet.exe"C:\Users\Admin\2eet.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2184
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c tasklist&&del 53f22538d90e23e311265cf9f948f772_JaffaCakes118.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD590d23730203c3fa5dbcb8a068fc28f7c
SHA1d24dd53a400d27984aadc060a7a0ef084cb5a005
SHA2563084caf108ff772dc16ecc24eff4f8dc4b49eb2971b4754c2c38683c17597eb8
SHA51213992ab89bda13b478aceeddad66391e1fd514794d8112001e5f61a76f72efbbf74bbdf8a8b509175d2ae79765febc4d804012a0251d90a1444377b3464e4726
-
Filesize
328KB
MD5ed270a209f35e4fadd970371a6295c7d
SHA18f2d66fc5b71de4e2374899497274552cd78f31e
SHA256e3595b20420990c88a734542a5cc930c3a7cb7c03989947dada31a92fd25168f
SHA512d37c661b6c52ddccea1f69b322bbd234037284182cf94d63bff537e706e3cecfc006bb9d290a1256d72bf97effc20b82e233a6a1f7c3f23010f7541eadf9bc46
-
Filesize
328KB
MD51f47b68c1b5ed0f55af82c6b1c5398f1
SHA1b6497b2c013b44575285dfe5203d33e15acc7848
SHA256394c9ee37af1704c83e1f6275fb0e33f9000ce00b933594e2eec4abb873ab1ac
SHA51260ef19fe95ba899a7bc419eb2ffca684464b0f6ef427dc07c5e5f5bb4a5534f96f067167783002cde6bc30759d00628316dc07f630b10a78cb375ac37322e83d