Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2024, 22:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
20 signatures
150 seconds
General
-
Target
645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe
-
Size
4.4MB
-
MD5
645dedcf4ad1806a8194c703061f1688
-
SHA1
86dd824ba2c80709bd47a2f5336e1636a2b031d2
-
SHA256
1f2a78766bb290fb2ed404f5ed05404986709175b39d152358087061b166dbe9
-
SHA512
b4217b88d4a2e915d35eb6f142ceccbcc31492804f31e7955b627a73c616a02fbfc6f47da2b6374a720cdb9e6398f3cd2215335810c317215255c73aa334c79c
-
SSDEEP
98304:5G48dZ7pekDE3sstJ/O9gSPCwXa+XwYDvAfg0yTcxXSUhVmz3s1nNAF:5l8dZ4kuAgkAYDvAfBfxirzciF
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" 856C.tmp -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 856C.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 856C.tmp -
Executes dropped EXE 4 IoCs
pid Process 3984 856C.tmp 4628 856C.tmp 2228 winupdate.exe 4760 winupdate.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" 856C.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe /onboot" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3984 856C.tmp 2228 winupdate.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3984 set thread context of 4628 3984 856C.tmp 85 PID 2228 set thread context of 4760 2228 winupdate.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 856C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 856C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winupdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 856C.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 856C.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 856C.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 856C.tmp -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 856C.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download FLV video content with IDM 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download all links with IDM\contexts = "243" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download all links with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEGetAll.htm" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download all links with IDM 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Low Rights 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download FLV video content with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEGetVL.htm" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download FLV video content with IDM\contexts = "243" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe -
Modifies registry class 18 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "293" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\https\ 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\ftp\ 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\http\ 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeRestorePrivilege 436 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 4628 856C.tmp Token: SeSecurityPrivilege 4628 856C.tmp Token: SeTakeOwnershipPrivilege 4628 856C.tmp Token: SeLoadDriverPrivilege 4628 856C.tmp Token: SeSystemProfilePrivilege 4628 856C.tmp Token: SeSystemtimePrivilege 4628 856C.tmp Token: SeProfSingleProcessPrivilege 4628 856C.tmp Token: SeIncBasePriorityPrivilege 4628 856C.tmp Token: SeCreatePagefilePrivilege 4628 856C.tmp Token: SeBackupPrivilege 4628 856C.tmp Token: SeRestorePrivilege 4628 856C.tmp Token: SeShutdownPrivilege 4628 856C.tmp Token: SeDebugPrivilege 4628 856C.tmp Token: SeSystemEnvironmentPrivilege 4628 856C.tmp Token: SeChangeNotifyPrivilege 4628 856C.tmp Token: SeRemoteShutdownPrivilege 4628 856C.tmp Token: SeUndockPrivilege 4628 856C.tmp Token: SeManageVolumePrivilege 4628 856C.tmp Token: SeImpersonatePrivilege 4628 856C.tmp Token: SeCreateGlobalPrivilege 4628 856C.tmp Token: 33 4628 856C.tmp Token: 34 4628 856C.tmp Token: 35 4628 856C.tmp Token: 36 4628 856C.tmp Token: SeIncreaseQuotaPrivilege 4760 winupdate.exe Token: SeSecurityPrivilege 4760 winupdate.exe Token: SeTakeOwnershipPrivilege 4760 winupdate.exe Token: SeLoadDriverPrivilege 4760 winupdate.exe Token: SeSystemProfilePrivilege 4760 winupdate.exe Token: SeSystemtimePrivilege 4760 winupdate.exe Token: SeProfSingleProcessPrivilege 4760 winupdate.exe Token: SeIncBasePriorityPrivilege 4760 winupdate.exe Token: SeCreatePagefilePrivilege 4760 winupdate.exe Token: SeBackupPrivilege 4760 winupdate.exe Token: SeRestorePrivilege 4760 winupdate.exe Token: SeShutdownPrivilege 4760 winupdate.exe Token: SeDebugPrivilege 4760 winupdate.exe Token: SeSystemEnvironmentPrivilege 4760 winupdate.exe Token: SeChangeNotifyPrivilege 4760 winupdate.exe Token: SeRemoteShutdownPrivilege 4760 winupdate.exe Token: SeUndockPrivilege 4760 winupdate.exe Token: SeManageVolumePrivilege 4760 winupdate.exe Token: SeImpersonatePrivilege 4760 winupdate.exe Token: SeCreateGlobalPrivilege 4760 winupdate.exe Token: 33 4760 winupdate.exe Token: 34 4760 winupdate.exe Token: 35 4760 winupdate.exe Token: 36 4760 winupdate.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 436 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 436 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3984 856C.tmp 3984 856C.tmp 2228 winupdate.exe 2228 winupdate.exe 4760 winupdate.exe 436 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe 436 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe 436 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 436 wrote to memory of 3984 436 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe 84 PID 436 wrote to memory of 3984 436 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe 84 PID 436 wrote to memory of 3984 436 645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe 84 PID 3984 wrote to memory of 4628 3984 856C.tmp 85 PID 3984 wrote to memory of 4628 3984 856C.tmp 85 PID 3984 wrote to memory of 4628 3984 856C.tmp 85 PID 3984 wrote to memory of 4628 3984 856C.tmp 85 PID 3984 wrote to memory of 4628 3984 856C.tmp 85 PID 3984 wrote to memory of 4628 3984 856C.tmp 85 PID 3984 wrote to memory of 4628 3984 856C.tmp 85 PID 3984 wrote to memory of 4628 3984 856C.tmp 85 PID 3984 wrote to memory of 4628 3984 856C.tmp 85 PID 3984 wrote to memory of 4628 3984 856C.tmp 85 PID 3984 wrote to memory of 4628 3984 856C.tmp 85 PID 3984 wrote to memory of 4628 3984 856C.tmp 85 PID 3984 wrote to memory of 4628 3984 856C.tmp 85 PID 3984 wrote to memory of 4628 3984 856C.tmp 85 PID 4628 wrote to memory of 2228 4628 856C.tmp 89 PID 4628 wrote to memory of 2228 4628 856C.tmp 89 PID 4628 wrote to memory of 2228 4628 856C.tmp 89 PID 2228 wrote to memory of 4760 2228 winupdate.exe 90 PID 2228 wrote to memory of 4760 2228 winupdate.exe 90 PID 2228 wrote to memory of 4760 2228 winupdate.exe 90 PID 2228 wrote to memory of 4760 2228 winupdate.exe 90 PID 2228 wrote to memory of 4760 2228 winupdate.exe 90 PID 2228 wrote to memory of 4760 2228 winupdate.exe 90 PID 2228 wrote to memory of 4760 2228 winupdate.exe 90 PID 2228 wrote to memory of 4760 2228 winupdate.exe 90 PID 2228 wrote to memory of 4760 2228 winupdate.exe 90 PID 2228 wrote to memory of 4760 2228 winupdate.exe 90 PID 2228 wrote to memory of 4760 2228 winupdate.exe 90 PID 2228 wrote to memory of 4760 2228 winupdate.exe 90 PID 2228 wrote to memory of 4760 2228 winupdate.exe 90 PID 2228 wrote to memory of 4760 2228 winupdate.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\645dedcf4ad1806a8194c703061f1688_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\856C.tmpC:\Users\Admin\AppData\Local\Temp\856C.tmp2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\856C.tmpC:\Users\Admin\AppData\Local\Temp\856C.tmp3⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windupdt\winupdate.exeC:\Windupdt\winupdate.exe5⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4760
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD56b863c3170f533bb92a08b7fb876b7a2
SHA1580e5348c15e5698f14a9f8b685c2adeb08343a6
SHA25601c39ca09524f3372595b7c75d42fd95a88514d51df62d0ed1449852960ca68c
SHA51282c6f1d6453e4563a349e81a5a78ff52871e991eadbb41a8c164ef3f9b47af78381115cfe3202b1728c22fcabad42da96da7488bcc6a60bd73eb43b02468eced
-
Filesize
298B
MD5081efb97b5d20b41451267ac92b064e0
SHA15dbfdf6a6ef60f99bc6e499d828dbafa858210ef
SHA256b7f1b15ca1a74fcce768ab08c8013cc337ed96699175b582dd3f1f440c3a5b92
SHA512cc5a13376227aa4844bc0ba5517881a033464ac2a4fb92d05ee31c30bb9c59bab7d669c2b24f803401b373c634f677cd98cab3683abb2d5d9c55c4f828615864
-
Filesize
887B
MD501c819667671b539c84658115daeb138
SHA1d60e4155d3260325aea5cef1a9e74be42dfce4fc
SHA2560d78ee99d9e8b2ff972210691f7571d75e43ec437ed5b1b6548fd76ad21d4b4b
SHA5127a76bb6b784ed5b5ad386844a714e4a63cddb8862c4b7a4c9aa95d56e8d25d626a7ab9d39312f60059acedf4c9b6be6b15c99d5fefe21fbe82bb03a2a61ba539
-
Filesize
1KB
MD54895973f43e500cbbd4b502bea927924
SHA1b608142e70e1d69dab23ac292a140ce2a6a36a2d
SHA256a0e009977680aee4887755584e147c7806888e86027bdf10fda7a0f92909ba4e
SHA51294f4465ac99c2ccd8e1b02a40bb1e9af0f8d10b63fd9d21d95b70cda77bab1cf00ab1c00d772ae6a8c2eaa523f36e55caaac21c1972bd05a9ae500c8e8ff33f5
-
Filesize
14B
MD520d5a113e78088087945bff38b2df7f9
SHA1cb94c5de154d38d1da46c8a6fe3020332360278d
SHA256c1f85c8b4d73a39568082e05c1bbac8bfa63ba913f362fbdb5bb2bb8926f8037
SHA5126432878cd0afdfb5ed3696ec65057549d06cb1c28a4f6db2a02cc27eed5c9fe0b41421cc9ecfdaa9d5805572af9a1ed2c53d68512661947b1df94a9c5d6f26f2