Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2024, 00:25
Static task
static1
Behavioral task
behavioral1
Sample
80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe
-
Size
548KB
-
MD5
80cdc7c264ea951dedde8d7cda97fe25
-
SHA1
9961e22ff166d873068b85f829c0b17f8680c889
-
SHA256
a7b6fb08d17320632c5a3f97d3f265a5e594035fc2b92585b81d0aba16a46df1
-
SHA512
1efb232e4569fbb233dd9e60f2d38225cc6e091008a2375f6834e5f0785dddd71970c005b78540123ffb9735df1949933937748d554450e51cd9c302f0d44e53
-
SSDEEP
12288:N6bvdl0zCB8EDItMTzwg7lMQsvNuqZBRbZEYTwdD7IjLgWgho+5:GvdezCByqTtlMQsFuqzRbzI7IVQ5
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" lurwhzlcveb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" lurwhzlcveb.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" jtszeo.exe -
Adds policy Run key to start application 2 TTPs 29 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run lurwhzlcveb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jtszeo = "cxhzpkaohaladofdv.exe" lurwhzlcveb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jtszeo = "cxhzpkaohaladofdv.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ipl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtfzrogwrmzqvibbvua.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ipl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhslcypeyseuykcbus.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ipl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhupigzqmiwouicdyyfd.exe" lurwhzlcveb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ipl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhupigzqmiwouicdyyfd.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jtszeo = "jhupigzqmiwouicdyyfd.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ipl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpypeynaskuikukh.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jtszeo = "yxlhbaumjgvovkfhdemlz.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ipl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpypeynaskuikukh.exe" lurwhzlcveb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jtszeo = "vpypeynaskuikukh.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jtszeo = "wtfzrogwrmzqvibbvua.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ipl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpypeynaskuikukh.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ipl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxhzpkaohaladofdv.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jtszeo = "wtfzrogwrmzqvibbvua.exe" lurwhzlcveb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ipl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxlhbaumjgvovkfhdemlz.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ipl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhslcypeyseuykcbus.exe" jtszeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run lurwhzlcveb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jtszeo = "wtfzrogwrmzqvibbvua.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ipl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhupigzqmiwouicdyyfd.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ipl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxhzpkaohaladofdv.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jtszeo = "jhupigzqmiwouicdyyfd.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jtszeo = "vpypeynaskuikukh.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jtszeo = "cxhzpkaohaladofdv.exe" jtszeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jtszeo = "yxlhbaumjgvovkfhdemlz.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ipl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxlhbaumjgvovkfhdemlz.exe" jtszeo.exe -
Disables RegEdit via registry modification 7 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jtszeo.exe Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lurwhzlcveb.exe Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lurwhzlcveb.exe Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jtszeo.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation lurwhzlcveb.exe -
Executes dropped EXE 4 IoCs
pid Process 4056 lurwhzlcveb.exe 1708 jtszeo.exe 4476 jtszeo.exe 2332 lurwhzlcveb.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager jtszeo.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys jtszeo.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc jtszeo.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power jtszeo.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys jtszeo.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc jtszeo.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\whhpvgm = "yxlhbaumjgvovkfhdemlz.exe" jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\whhpvgm = "yxlhbaumjgvovkfhdemlz.exe" jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxuz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhslcypeyseuykcbus.exe" jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\yhflp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpypeynaskuikukh.exe ." jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxuz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhupigzqmiwouicdyyfd.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjmxgudkwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhupigzqmiwouicdyyfd.exe" lurwhzlcveb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxuz = "vpypeynaskuikukh.exe" jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lxyhoahm = "cxhzpkaohaladofdv.exe ." jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cprbjwekv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxlhbaumjgvovkfhdemlz.exe ." jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\yhflp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhslcypeyseuykcbus.exe ." jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\yhflp = "cxhzpkaohaladofdv.exe ." jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\yhflp = "jhupigzqmiwouicdyyfd.exe ." jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\yhflp = "yxlhbaumjgvovkfhdemlz.exe ." jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\whhpvgm = "wtfzrogwrmzqvibbvua.exe" lurwhzlcveb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\whhpvgm = "lhslcypeyseuykcbus.exe" jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxuz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhupigzqmiwouicdyyfd.exe" jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\yhflp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhslcypeyseuykcbus.exe ." jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxuz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhslcypeyseuykcbus.exe" jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\whhpvgm = "cxhzpkaohaladofdv.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxuz = "lhslcypeyseuykcbus.exe" jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxuz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpypeynaskuikukh.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxuz = "yxlhbaumjgvovkfhdemlz.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\yhflp = "lhslcypeyseuykcbus.exe ." jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cprbjwekv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpypeynaskuikukh.exe ." jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lxyhoahm = "jhupigzqmiwouicdyyfd.exe ." jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjmxgudkwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhupigzqmiwouicdyyfd.exe" jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxuz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpypeynaskuikukh.exe" lurwhzlcveb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cprbjwekv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhslcypeyseuykcbus.exe ." jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjmxgudkwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhslcypeyseuykcbus.exe" jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lxyhoahm = "lhslcypeyseuykcbus.exe ." jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\whhpvgm = "wtfzrogwrmzqvibbvua.exe" jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxuz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxlhbaumjgvovkfhdemlz.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxuz = "lhslcypeyseuykcbus.exe" lurwhzlcveb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lxyhoahm = "vpypeynaskuikukh.exe ." lurwhzlcveb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\yhflp = "wtfzrogwrmzqvibbvua.exe ." jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lxyhoahm = "jhupigzqmiwouicdyyfd.exe ." jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjmxgudkwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxlhbaumjgvovkfhdemlz.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxuz = "lhslcypeyseuykcbus.exe" jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\yhflp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpypeynaskuikukh.exe ." jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjmxgudkwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtfzrogwrmzqvibbvua.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\yhflp = "vpypeynaskuikukh.exe ." jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjmxgudkwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpypeynaskuikukh.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxuz = "wtfzrogwrmzqvibbvua.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cprbjwekv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtfzrogwrmzqvibbvua.exe ." jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\yhflp = "yxlhbaumjgvovkfhdemlz.exe ." lurwhzlcveb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lxyhoahm = "yxlhbaumjgvovkfhdemlz.exe ." jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjmxgudkwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxhzpkaohaladofdv.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxuz = "cxhzpkaohaladofdv.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cprbjwekv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxhzpkaohaladofdv.exe ." jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lxyhoahm = "yxlhbaumjgvovkfhdemlz.exe ." jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lxyhoahm = "wtfzrogwrmzqvibbvua.exe ." jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjmxgudkwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpypeynaskuikukh.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vjmxgudkwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtfzrogwrmzqvibbvua.exe" jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\yhflp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhupigzqmiwouicdyyfd.exe ." jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxuz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpypeynaskuikukh.exe" jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\yhflp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxhzpkaohaladofdv.exe ." jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lxyhoahm = "vpypeynaskuikukh.exe ." jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxuz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxlhbaumjgvovkfhdemlz.exe" jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\yhflp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtfzrogwrmzqvibbvua.exe ." jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxuz = "yxlhbaumjgvovkfhdemlz.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cprbjwekv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpypeynaskuikukh.exe ." jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxuz = "wtfzrogwrmzqvibbvua.exe" jtszeo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxuz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxhzpkaohaladofdv.exe" jtszeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\yhflp = "vpypeynaskuikukh.exe ." jtszeo.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lurwhzlcveb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jtszeo.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jtszeo.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lurwhzlcveb.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" jtszeo.exe -
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 24 www.showmyipaddress.com 29 whatismyipaddress.com 34 www.whatismyip.ca 41 www.whatismyip.ca 47 www.whatismyip.ca 21 whatismyip.everdot.org -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf jtszeo.exe File opened for modification F:\autorun.inf jtszeo.exe File created F:\autorun.inf jtszeo.exe File opened for modification C:\autorun.inf jtszeo.exe -
Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\cxhzpkaohaladofdv.exe jtszeo.exe File created C:\Windows\SysWOW64\nfmbogteukseemavkefxetgylwmckwwesncw.pwl jtszeo.exe File opened for modification C:\Windows\SysWOW64\cxhzpkaohaladofdv.exe lurwhzlcveb.exe File opened for modification C:\Windows\SysWOW64\vpypeynaskuikukh.exe lurwhzlcveb.exe File created C:\Windows\SysWOW64\iplpryaafkhixuxhlukrnrtac.hmj jtszeo.exe File opened for modification C:\Windows\SysWOW64\wtfzrogwrmzqvibbvua.exe lurwhzlcveb.exe File opened for modification C:\Windows\SysWOW64\jhupigzqmiwouicdyyfd.exe jtszeo.exe File opened for modification C:\Windows\SysWOW64\vpypeynaskuikukh.exe jtszeo.exe File opened for modification C:\Windows\SysWOW64\ppebwwrkigwqyoknkmvvkh.exe jtszeo.exe File opened for modification C:\Windows\SysWOW64\vpypeynaskuikukh.exe jtszeo.exe File opened for modification C:\Windows\SysWOW64\jhupigzqmiwouicdyyfd.exe lurwhzlcveb.exe File opened for modification C:\Windows\SysWOW64\jhupigzqmiwouicdyyfd.exe jtszeo.exe File opened for modification C:\Windows\SysWOW64\jhupigzqmiwouicdyyfd.exe lurwhzlcveb.exe File opened for modification C:\Windows\SysWOW64\cxhzpkaohaladofdv.exe lurwhzlcveb.exe File opened for modification C:\Windows\SysWOW64\yxlhbaumjgvovkfhdemlz.exe jtszeo.exe File opened for modification C:\Windows\SysWOW64\ppebwwrkigwqyoknkmvvkh.exe jtszeo.exe File opened for modification C:\Windows\SysWOW64\lhslcypeyseuykcbus.exe lurwhzlcveb.exe File opened for modification C:\Windows\SysWOW64\ppebwwrkigwqyoknkmvvkh.exe lurwhzlcveb.exe File opened for modification C:\Windows\SysWOW64\yxlhbaumjgvovkfhdemlz.exe lurwhzlcveb.exe File opened for modification C:\Windows\SysWOW64\lhslcypeyseuykcbus.exe jtszeo.exe File opened for modification C:\Windows\SysWOW64\wtfzrogwrmzqvibbvua.exe jtszeo.exe File opened for modification C:\Windows\SysWOW64\wtfzrogwrmzqvibbvua.exe jtszeo.exe File opened for modification C:\Windows\SysWOW64\wtfzrogwrmzqvibbvua.exe lurwhzlcveb.exe File opened for modification C:\Windows\SysWOW64\iplpryaafkhixuxhlukrnrtac.hmj jtszeo.exe File opened for modification C:\Windows\SysWOW64\yxlhbaumjgvovkfhdemlz.exe lurwhzlcveb.exe File opened for modification C:\Windows\SysWOW64\ppebwwrkigwqyoknkmvvkh.exe lurwhzlcveb.exe File opened for modification C:\Windows\SysWOW64\lhslcypeyseuykcbus.exe lurwhzlcveb.exe File opened for modification C:\Windows\SysWOW64\lhslcypeyseuykcbus.exe jtszeo.exe File opened for modification C:\Windows\SysWOW64\yxlhbaumjgvovkfhdemlz.exe jtszeo.exe File opened for modification C:\Windows\SysWOW64\nfmbogteukseemavkefxetgylwmckwwesncw.pwl jtszeo.exe File opened for modification C:\Windows\SysWOW64\vpypeynaskuikukh.exe lurwhzlcveb.exe File opened for modification C:\Windows\SysWOW64\cxhzpkaohaladofdv.exe jtszeo.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\iplpryaafkhixuxhlukrnrtac.hmj jtszeo.exe File created C:\Program Files (x86)\iplpryaafkhixuxhlukrnrtac.hmj jtszeo.exe File opened for modification C:\Program Files (x86)\nfmbogteukseemavkefxetgylwmckwwesncw.pwl jtszeo.exe File created C:\Program Files (x86)\nfmbogteukseemavkefxetgylwmckwwesncw.pwl jtszeo.exe -
Drops file in Windows directory 32 IoCs
description ioc Process File opened for modification C:\Windows\lhslcypeyseuykcbus.exe lurwhzlcveb.exe File opened for modification C:\Windows\ppebwwrkigwqyoknkmvvkh.exe jtszeo.exe File opened for modification C:\Windows\cxhzpkaohaladofdv.exe lurwhzlcveb.exe File opened for modification C:\Windows\jhupigzqmiwouicdyyfd.exe lurwhzlcveb.exe File opened for modification C:\Windows\cxhzpkaohaladofdv.exe jtszeo.exe File opened for modification C:\Windows\yxlhbaumjgvovkfhdemlz.exe jtszeo.exe File opened for modification C:\Windows\vpypeynaskuikukh.exe lurwhzlcveb.exe File opened for modification C:\Windows\jhupigzqmiwouicdyyfd.exe lurwhzlcveb.exe File opened for modification C:\Windows\vpypeynaskuikukh.exe jtszeo.exe File opened for modification C:\Windows\jhupigzqmiwouicdyyfd.exe jtszeo.exe File opened for modification C:\Windows\nfmbogteukseemavkefxetgylwmckwwesncw.pwl jtszeo.exe File opened for modification C:\Windows\ppebwwrkigwqyoknkmvvkh.exe jtszeo.exe File opened for modification C:\Windows\yxlhbaumjgvovkfhdemlz.exe lurwhzlcveb.exe File opened for modification C:\Windows\wtfzrogwrmzqvibbvua.exe jtszeo.exe File opened for modification C:\Windows\vpypeynaskuikukh.exe jtszeo.exe File opened for modification C:\Windows\yxlhbaumjgvovkfhdemlz.exe jtszeo.exe File opened for modification C:\Windows\wtfzrogwrmzqvibbvua.exe jtszeo.exe File opened for modification C:\Windows\lhslcypeyseuykcbus.exe lurwhzlcveb.exe File opened for modification C:\Windows\iplpryaafkhixuxhlukrnrtac.hmj jtszeo.exe File created C:\Windows\nfmbogteukseemavkefxetgylwmckwwesncw.pwl jtszeo.exe File opened for modification C:\Windows\wtfzrogwrmzqvibbvua.exe lurwhzlcveb.exe File opened for modification C:\Windows\vpypeynaskuikukh.exe lurwhzlcveb.exe File opened for modification C:\Windows\wtfzrogwrmzqvibbvua.exe lurwhzlcveb.exe File opened for modification C:\Windows\lhslcypeyseuykcbus.exe jtszeo.exe File opened for modification C:\Windows\yxlhbaumjgvovkfhdemlz.exe lurwhzlcveb.exe File opened for modification C:\Windows\ppebwwrkigwqyoknkmvvkh.exe lurwhzlcveb.exe File opened for modification C:\Windows\cxhzpkaohaladofdv.exe jtszeo.exe File created C:\Windows\iplpryaafkhixuxhlukrnrtac.hmj jtszeo.exe File opened for modification C:\Windows\ppebwwrkigwqyoknkmvvkh.exe lurwhzlcveb.exe File opened for modification C:\Windows\cxhzpkaohaladofdv.exe lurwhzlcveb.exe File opened for modification C:\Windows\lhslcypeyseuykcbus.exe jtszeo.exe File opened for modification C:\Windows\jhupigzqmiwouicdyyfd.exe jtszeo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lurwhzlcveb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtszeo.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 1708 jtszeo.exe 1708 jtszeo.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 1708 jtszeo.exe 1708 jtszeo.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1708 jtszeo.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4820 wrote to memory of 4056 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 87 PID 4820 wrote to memory of 4056 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 87 PID 4820 wrote to memory of 4056 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 87 PID 4056 wrote to memory of 1708 4056 lurwhzlcveb.exe 92 PID 4056 wrote to memory of 1708 4056 lurwhzlcveb.exe 92 PID 4056 wrote to memory of 1708 4056 lurwhzlcveb.exe 92 PID 4056 wrote to memory of 4476 4056 lurwhzlcveb.exe 93 PID 4056 wrote to memory of 4476 4056 lurwhzlcveb.exe 93 PID 4056 wrote to memory of 4476 4056 lurwhzlcveb.exe 93 PID 4820 wrote to memory of 2332 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 117 PID 4820 wrote to memory of 2332 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 117 PID 4820 wrote to memory of 2332 4820 80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe 117 -
System policy modification 1 TTPs 38 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lurwhzlcveb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" jtszeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" jtszeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer jtszeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" lurwhzlcveb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jtszeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System jtszeo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer lurwhzlcveb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" jtszeo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" jtszeo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\80cdc7c264ea951dedde8d7cda97fe25_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\lurwhzlcveb.exe"C:\Users\Admin\AppData\Local\Temp\lurwhzlcveb.exe" "c:\users\admin\appdata\local\temp\80cdc7c264ea951dedde8d7cda97fe25_jaffacakes118.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\jtszeo.exe"C:\Users\Admin\AppData\Local\Temp\jtszeo.exe" "-c:\users\admin\appdata\local\temp\80cdc7c264ea951dedde8d7cda97fe25_jaffacakes118.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1708
-
-
C:\Users\Admin\AppData\Local\Temp\jtszeo.exe"C:\Users\Admin\AppData\Local\Temp\jtszeo.exe" "-c:\users\admin\appdata\local\temp\80cdc7c264ea951dedde8d7cda97fe25_jaffacakes118.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:4476
-
-
-
C:\Users\Admin\AppData\Local\Temp\lurwhzlcveb.exe"C:\Users\Admin\AppData\Local\Temp\lurwhzlcveb.exe" "c:\users\admin\appdata\local\temp\80cdc7c264ea951dedde8d7cda97fe25_jaffacakes118.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2332
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272B
MD5c34c9f66ab04b38935fe9fce259c6bc9
SHA12226524afaa327d58b307e39aaf6a7a0c8bd033d
SHA256997ba8188035e37b3892d0bb05f8630929241f70b8e4a846ca1836e574bcbfe9
SHA512338a23a4ac35295b567d156ffe533ceb4cc234b6471f088b29948d07b1368eb2529f1811378e67fa885fcf5f4d76ad2fdcedda22b619cdb65ab060a90388be5d
-
Filesize
272B
MD5559f3411d6948d8e0d53e455c7c486b5
SHA1a843e5c322ded9161602af3b5a9ceb1e38790879
SHA256c6e9175af724ab68991198be1b2fdb0dfcb3e3afa0909f9da11c3ec6abbf6385
SHA512fee19aee29f5cb651494d966349a3448685ebeb92366dd83bbb02c6e40a4168fe569e8d05c4d7d868f594a43ca854590bbfb4c0f990a067078654eaacb6c2051
-
Filesize
272B
MD59432555061f5d97cc4c45427950b56f1
SHA1137ad9bdf40c295f6eecec25ed3127dd96aab382
SHA256a94d969c7978aaf67a17e30a9cf9b03295d8770df9f85f11deceabcb84979022
SHA51298a5436f4ef2ee5339f3103d64f09bd532b4f5612f850e2393286b81bd554c5878d78dd2982204050d366ebc013f518254273abf5b3cc99751783380dde26ec5
-
Filesize
272B
MD52c5849f4cfafaeb74d9c2e01f23b98fc
SHA13dcb85322e0aae26dcc38bb39f00055e6278df74
SHA25634b0c558204a90d66b7fe1a095a36bc770e20271537fbb6ae3dc861d01ccb7ca
SHA512b66d4ae4fe3efd8b376c25b7b7a66df4ae2673ecc444419be38198e952fea030dc19c6c35c36da8c94ca9c324503c660f0294a2d4e6faef5268b5248da3bc4a8
-
Filesize
704KB
MD549a9c0154cc052271825d57cc922a1dc
SHA16ff64ab519472480cf24e61a0829be7be27c382a
SHA2567d084645a008323bc93814434c5225b438caec09e49a17d4efc73711885e2bf5
SHA512909fd7bdadf4b45776d4208f402a3c3971ca7ae69fef3cf569ce362d2328862235dc86ae5a61fecc4acb12bf24a503572e8f6e7b392fca2987a647fb1762c0dc
-
Filesize
320KB
MD589ec3461ef4a893428c32f89de78b396
SHA18067cdc0901f0dc5bc1bb67a1c9037f502ea85f9
SHA2561849989ee704cda3b552b5021f3165012978d26d0daf7d22a09805deb6be2d0b
SHA5127804fa36e1f050115b00d21a9a94cf92436260a385da67106b0c73eb350abafca53f2dec42d377d4eccc095dd75ac92e841fb66e874e656e412cd71ed7909fe8
-
Filesize
272B
MD549e4ec9898fc7e6919e0cd197a895e2b
SHA159d11dbf1260efcf3bbb3a6410f4474033888b59
SHA2560e242e74664def0e8b61c303f9c67086873c851e31d9eef9492f300d13f84f3c
SHA5125fd18be016b410eb175501423da233c4384bac94edb68647dbe9318fcaf3e3308e0b8718e98ebadb9020db078f3cf446573754defabdd05c1bbddeb8d8778d00
-
Filesize
272B
MD564c88e6ed3c3eed43e5c7fb3488b82bc
SHA1a4cb8aa72641a4a47a8e016615bc428df9335629
SHA2562ed767c82dec28166166224327da373f168cddb9a0f87e153d48613640f15836
SHA5125da4af07520c2600ef192b992a22e1f2c709a61c2b01553a6ec1c3c83ebbfcf3c3fbf0feb5a734e047577d25d80653f1068ada023ac36d96385b7bc7927c9ff0
-
Filesize
272B
MD5fab835a6a4d9ca673f823057a995c4ca
SHA1dc39ebffec735685bf1a2b6adf670493abbfb57c
SHA25631cdfe72a78b6c915f12f19d4aff212817dfc1db21b7289db89233b05e2e42b3
SHA512750a68e21c5d44dec81121d496309324d7b60a9fef115792af10e3e4dbfd7795503518cf20c6993c2d413ffc986f3b885b0a3566cf530a9bb14d5d7016d7841b
-
Filesize
3KB
MD564d1d8ea2e7fd7ff09fafe138ed7c821
SHA188412af7ba6d5818e27d53db3bc5fe385fa2c47d
SHA25604ab8d7737d6a19b2230c66e233751df1ba0ca8c6905b19f09ce8bf45d8bfab8
SHA51278bc906b00da71ab1b4b81db11a21fa6dc87f8f82b24529714eb719dd1a118f0b412709f87091a75dd360a6dc67390be5ab00db499760bb484fab3e48fb7aa72
-
Filesize
548KB
MD580cdc7c264ea951dedde8d7cda97fe25
SHA19961e22ff166d873068b85f829c0b17f8680c889
SHA256a7b6fb08d17320632c5a3f97d3f265a5e594035fc2b92585b81d0aba16a46df1
SHA5121efb232e4569fbb233dd9e60f2d38225cc6e091008a2375f6834e5f0785dddd71970c005b78540123ffb9735df1949933937748d554450e51cd9c302f0d44e53