Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/11/2024, 01:49
Static task
static1
Behavioral task
behavioral1
Sample
8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe
-
Size
644KB
-
MD5
8e8d8dd457411eaf96c3e5f1cf646ec5
-
SHA1
b03b741382822e3f012bc8d1c87331aaefeff1a4
-
SHA256
b6b2b9e959b52d90742beac4f6b23a72e4c2cb5e802bbb9e7da138098d30cd24
-
SHA512
e6cf6ea96fbc9befaf59e1b0a876e7afadc5439918ee294dbe584d474310cc79db4ff7091645e29e0f367561a7a3a71cd80ec4200ebbd7809fd5e738bc58878c
-
SSDEEP
12288:/6bvdl0zCB8EDItMTzwg7lMQsvNuqZBRbZEYTwdD7IjLgmb4qtz4g:AvdezCByqTtlMQsFuqzRbzI7IXb46N
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" fpbadygypzl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" fpbadygypzl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" uaiqyen.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uaiqyen.exe -
Adds policy Run key to start application 2 TTPs 28 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmtahm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\havqlearrwpkseizajcx.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiscmufla = "havqlearrwpkseizajcx.exe" uaiqyen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run fpbadygypzl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiscmufla = "havqlearrwpkseizajcx.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmtahm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqiasibpmoewbklzx.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmtahm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tizqhwobxyneiqqd.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiscmufla = "jatmfwqfdgxqwgixwd.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmtahm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umgaumhxwasmtehxxfx.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmtahm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqmieyvnouoktgldfpjfb.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiscmufla = "jatmfwqfdgxqwgixwd.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmtahm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqiasibpmoewbklzx.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiscmufla = "wqmieyvnouoktgldfpjfb.exe" fpbadygypzl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiscmufla = "wqmieyvnouoktgldfpjfb.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiscmufla = "aqiasibpmoewbklzx.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiscmufla = "aqiasibpmoewbklzx.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmtahm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jatmfwqfdgxqwgixwd.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiscmufla = "umgaumhxwasmtehxxfx.exe" fpbadygypzl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmtahm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqmieyvnouoktgldfpjfb.exe" fpbadygypzl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiscmufla = "wqmieyvnouoktgldfpjfb.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmtahm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\havqlearrwpkseizajcx.exe" uaiqyen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run fpbadygypzl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmtahm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tizqhwobxyneiqqd.exe" fpbadygypzl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiscmufla = "tizqhwobxyneiqqd.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmtahm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umgaumhxwasmtehxxfx.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmtahm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqmieyvnouoktgldfpjfb.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\aiscmufla = "umgaumhxwasmtehxxfx.exe" uaiqyen.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uaiqyen.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fpbadygypzl.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uaiqyen.exe -
Executes dropped EXE 4 IoCs
pid Process 2368 fpbadygypzl.exe 2812 uaiqyen.exe 2664 uaiqyen.exe 2628 fpbadygypzl.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend uaiqyen.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc uaiqyen.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power uaiqyen.exe -
Loads dropped DLL 8 IoCs
pid Process 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 2368 fpbadygypzl.exe 2368 fpbadygypzl.exe 2368 fpbadygypzl.exe 2368 fpbadygypzl.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lwjwjuirjgre = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqmieyvnouoktgldfpjfb.exe ." uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umgaumhxwasmtehxxfx.exe" fpbadygypzl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lwjwjuirjgre = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tizqhwobxyneiqqd.exe ." uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lwjwjuirjgre = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqiasibpmoewbklzx.exe ." uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jatmfwqfdgxqwgixwd.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "jatmfwqfdgxqwgixwd.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "umgaumhxwasmtehxxfx.exe" fpbadygypzl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jqziryin = "havqlearrwpkseizajcx.exe ." uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\tcnyjselbw = "aqiasibpmoewbklzx.exe" uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oykwisfneak = "aqiasibpmoewbklzx.exe ." uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\tcnyjselbw = "havqlearrwpkseizajcx.exe" uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oykwisfneak = "jatmfwqfdgxqwgixwd.exe ." uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oykwisfneak = "aqiasibpmoewbklzx.exe ." uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kwkymynxqoaop = "C:\\Users\\Admin\\AppData\\Local\\Temp\\havqlearrwpkseizajcx.exe" uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oykwisfneak = "havqlearrwpkseizajcx.exe ." uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tizqhwobxyneiqqd.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lwjwjuirjgre = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umgaumhxwasmtehxxfx.exe ." uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\tcnyjselbw = "aqiasibpmoewbklzx.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jqziryin = "aqiasibpmoewbklzx.exe ." uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lwjwjuirjgre = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqmieyvnouoktgldfpjfb.exe ." uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jqziryin = "wqmieyvnouoktgldfpjfb.exe ." uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oykwisfneak = "wqmieyvnouoktgldfpjfb.exe ." uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kwkymynxqoaop = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jatmfwqfdgxqwgixwd.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "jatmfwqfdgxqwgixwd.exe" uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jqziryin = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqiasibpmoewbklzx.exe ." uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "umgaumhxwasmtehxxfx.exe" fpbadygypzl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "aqiasibpmoewbklzx.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jqziryin = "tizqhwobxyneiqqd.exe ." uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lwjwjuirjgre = "C:\\Users\\Admin\\AppData\\Local\\Temp\\havqlearrwpkseizajcx.exe ." uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqiasibpmoewbklzx.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "jatmfwqfdgxqwgixwd.exe" fpbadygypzl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jqziryin = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umgaumhxwasmtehxxfx.exe ." uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tizqhwobxyneiqqd.exe" uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\tcnyjselbw = "wqmieyvnouoktgldfpjfb.exe" uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\tcnyjselbw = "aqiasibpmoewbklzx.exe" fpbadygypzl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\havqlearrwpkseizajcx.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kwkymynxqoaop = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqiasibpmoewbklzx.exe" uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oykwisfneak = "umgaumhxwasmtehxxfx.exe ." uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\tcnyjselbw = "umgaumhxwasmtehxxfx.exe" uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqmieyvnouoktgldfpjfb.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kwkymynxqoaop = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqiasibpmoewbklzx.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kwkymynxqoaop = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqmieyvnouoktgldfpjfb.exe" uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jqziryin = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jatmfwqfdgxqwgixwd.exe ." uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jatmfwqfdgxqwgixwd.exe" uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jatmfwqfdgxqwgixwd.exe" fpbadygypzl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jqziryin = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tizqhwobxyneiqqd.exe ." uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jqziryin = "aqiasibpmoewbklzx.exe ." uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oykwisfneak = "tizqhwobxyneiqqd.exe ." uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\tcnyjselbw = "tizqhwobxyneiqqd.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kwkymynxqoaop = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tizqhwobxyneiqqd.exe" uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jqziryin = "C:\\Users\\Admin\\AppData\\Local\\Temp\\havqlearrwpkseizajcx.exe ." uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "wqmieyvnouoktgldfpjfb.exe" uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jqziryin = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tizqhwobxyneiqqd.exe ." uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jqziryin = "havqlearrwpkseizajcx.exe ." fpbadygypzl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jqziryin = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqiasibpmoewbklzx.exe ." fpbadygypzl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\tcnyjselbw = "tizqhwobxyneiqqd.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jqziryin = "umgaumhxwasmtehxxfx.exe ." uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqiasibpmoewbklzx.exe" uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\uaiqyen = "C:\\Users\\Admin\\AppData\\Local\\Temp\\havqlearrwpkseizajcx.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kwkymynxqoaop = "C:\\Users\\Admin\\AppData\\Local\\Temp\\havqlearrwpkseizajcx.exe" uaiqyen.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kwkymynxqoaop = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tizqhwobxyneiqqd.exe" fpbadygypzl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jqziryin = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umgaumhxwasmtehxxfx.exe ." fpbadygypzl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jqziryin = "tizqhwobxyneiqqd.exe ." uaiqyen.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\tcnyjselbw = "jatmfwqfdgxqwgixwd.exe" uaiqyen.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uaiqyen.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fpbadygypzl.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fpbadygypzl.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uaiqyen.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" uaiqyen.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 whatismyip.everdot.org 3 www.showmyipaddress.com 5 www.whatismyip.ca 7 whatismyipaddress.com -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf uaiqyen.exe File created F:\autorun.inf uaiqyen.exe File opened for modification C:\autorun.inf uaiqyen.exe File created C:\autorun.inf uaiqyen.exe -
Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\jatmfwqfdgxqwgixwd.exe fpbadygypzl.exe File opened for modification C:\Windows\SysWOW64\nifczuslnupmwkqjmxspmj.exe fpbadygypzl.exe File opened for modification C:\Windows\SysWOW64\nifczuslnupmwkqjmxspmj.exe uaiqyen.exe File opened for modification C:\Windows\SysWOW64\nqvafiopzorwokyzkdglqvyefp.hme uaiqyen.exe File opened for modification C:\Windows\SysWOW64\aqiasibpmoewbklzx.exe uaiqyen.exe File opened for modification C:\Windows\SysWOW64\jatmfwqfdgxqwgixwd.exe uaiqyen.exe File created C:\Windows\SysWOW64\nqvafiopzorwokyzkdglqvyefp.hme uaiqyen.exe File opened for modification C:\Windows\SysWOW64\aqiasibpmoewbklzx.exe fpbadygypzl.exe File opened for modification C:\Windows\SysWOW64\nifczuslnupmwkqjmxspmj.exe fpbadygypzl.exe File opened for modification C:\Windows\SysWOW64\tizqhwobxyneiqqd.exe uaiqyen.exe File opened for modification C:\Windows\SysWOW64\ocsiymdpkkyoryxjfjxndthykfftjmtseaesi.oct uaiqyen.exe File opened for modification C:\Windows\SysWOW64\tizqhwobxyneiqqd.exe fpbadygypzl.exe File opened for modification C:\Windows\SysWOW64\jatmfwqfdgxqwgixwd.exe fpbadygypzl.exe File opened for modification C:\Windows\SysWOW64\umgaumhxwasmtehxxfx.exe uaiqyen.exe File opened for modification C:\Windows\SysWOW64\havqlearrwpkseizajcx.exe uaiqyen.exe File opened for modification C:\Windows\SysWOW64\nifczuslnupmwkqjmxspmj.exe uaiqyen.exe File opened for modification C:\Windows\SysWOW64\umgaumhxwasmtehxxfx.exe uaiqyen.exe File opened for modification C:\Windows\SysWOW64\wqmieyvnouoktgldfpjfb.exe fpbadygypzl.exe File opened for modification C:\Windows\SysWOW64\aqiasibpmoewbklzx.exe fpbadygypzl.exe File opened for modification C:\Windows\SysWOW64\havqlearrwpkseizajcx.exe fpbadygypzl.exe File opened for modification C:\Windows\SysWOW64\wqmieyvnouoktgldfpjfb.exe uaiqyen.exe File opened for modification C:\Windows\SysWOW64\tizqhwobxyneiqqd.exe fpbadygypzl.exe File opened for modification C:\Windows\SysWOW64\umgaumhxwasmtehxxfx.exe fpbadygypzl.exe File opened for modification C:\Windows\SysWOW64\umgaumhxwasmtehxxfx.exe fpbadygypzl.exe File opened for modification C:\Windows\SysWOW64\havqlearrwpkseizajcx.exe uaiqyen.exe File opened for modification C:\Windows\SysWOW64\wqmieyvnouoktgldfpjfb.exe uaiqyen.exe File opened for modification C:\Windows\SysWOW64\jatmfwqfdgxqwgixwd.exe uaiqyen.exe File opened for modification C:\Windows\SysWOW64\aqiasibpmoewbklzx.exe uaiqyen.exe File created C:\Windows\SysWOW64\ocsiymdpkkyoryxjfjxndthykfftjmtseaesi.oct uaiqyen.exe File opened for modification C:\Windows\SysWOW64\havqlearrwpkseizajcx.exe fpbadygypzl.exe File opened for modification C:\Windows\SysWOW64\wqmieyvnouoktgldfpjfb.exe fpbadygypzl.exe File opened for modification C:\Windows\SysWOW64\tizqhwobxyneiqqd.exe uaiqyen.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\nqvafiopzorwokyzkdglqvyefp.hme uaiqyen.exe File created C:\Program Files (x86)\nqvafiopzorwokyzkdglqvyefp.hme uaiqyen.exe File opened for modification C:\Program Files (x86)\ocsiymdpkkyoryxjfjxndthykfftjmtseaesi.oct uaiqyen.exe File created C:\Program Files (x86)\ocsiymdpkkyoryxjfjxndthykfftjmtseaesi.oct uaiqyen.exe -
Drops file in Windows directory 32 IoCs
description ioc Process File opened for modification C:\Windows\nifczuslnupmwkqjmxspmj.exe uaiqyen.exe File opened for modification C:\Windows\umgaumhxwasmtehxxfx.exe uaiqyen.exe File opened for modification C:\Windows\wqmieyvnouoktgldfpjfb.exe uaiqyen.exe File created C:\Windows\nqvafiopzorwokyzkdglqvyefp.hme uaiqyen.exe File opened for modification C:\Windows\ocsiymdpkkyoryxjfjxndthykfftjmtseaesi.oct uaiqyen.exe File opened for modification C:\Windows\jatmfwqfdgxqwgixwd.exe uaiqyen.exe File opened for modification C:\Windows\havqlearrwpkseizajcx.exe fpbadygypzl.exe File opened for modification C:\Windows\aqiasibpmoewbklzx.exe uaiqyen.exe File opened for modification C:\Windows\aqiasibpmoewbklzx.exe fpbadygypzl.exe File opened for modification C:\Windows\umgaumhxwasmtehxxfx.exe uaiqyen.exe File opened for modification C:\Windows\aqiasibpmoewbklzx.exe uaiqyen.exe File opened for modification C:\Windows\nqvafiopzorwokyzkdglqvyefp.hme uaiqyen.exe File opened for modification C:\Windows\umgaumhxwasmtehxxfx.exe fpbadygypzl.exe File opened for modification C:\Windows\wqmieyvnouoktgldfpjfb.exe fpbadygypzl.exe File opened for modification C:\Windows\aqiasibpmoewbklzx.exe fpbadygypzl.exe File opened for modification C:\Windows\umgaumhxwasmtehxxfx.exe fpbadygypzl.exe File opened for modification C:\Windows\havqlearrwpkseizajcx.exe fpbadygypzl.exe File opened for modification C:\Windows\nifczuslnupmwkqjmxspmj.exe fpbadygypzl.exe File opened for modification C:\Windows\tizqhwobxyneiqqd.exe uaiqyen.exe File opened for modification C:\Windows\nifczuslnupmwkqjmxspmj.exe uaiqyen.exe File opened for modification C:\Windows\wqmieyvnouoktgldfpjfb.exe fpbadygypzl.exe File opened for modification C:\Windows\havqlearrwpkseizajcx.exe uaiqyen.exe File created C:\Windows\ocsiymdpkkyoryxjfjxndthykfftjmtseaesi.oct uaiqyen.exe File opened for modification C:\Windows\tizqhwobxyneiqqd.exe fpbadygypzl.exe File opened for modification C:\Windows\havqlearrwpkseizajcx.exe uaiqyen.exe File opened for modification C:\Windows\tizqhwobxyneiqqd.exe fpbadygypzl.exe File opened for modification C:\Windows\jatmfwqfdgxqwgixwd.exe fpbadygypzl.exe File opened for modification C:\Windows\wqmieyvnouoktgldfpjfb.exe uaiqyen.exe File opened for modification C:\Windows\tizqhwobxyneiqqd.exe uaiqyen.exe File opened for modification C:\Windows\jatmfwqfdgxqwgixwd.exe uaiqyen.exe File opened for modification C:\Windows\jatmfwqfdgxqwgixwd.exe fpbadygypzl.exe File opened for modification C:\Windows\nifczuslnupmwkqjmxspmj.exe fpbadygypzl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpbadygypzl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uaiqyen.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 2812 uaiqyen.exe 2812 uaiqyen.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 2812 uaiqyen.exe 2812 uaiqyen.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 2812 uaiqyen.exe 2812 uaiqyen.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 2812 uaiqyen.exe 2812 uaiqyen.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 2812 uaiqyen.exe 2812 uaiqyen.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 2812 uaiqyen.exe 2812 uaiqyen.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 2812 uaiqyen.exe 2812 uaiqyen.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 2812 uaiqyen.exe 2812 uaiqyen.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 2812 uaiqyen.exe 2812 uaiqyen.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 2812 uaiqyen.exe 2812 uaiqyen.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 2812 uaiqyen.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 2812 uaiqyen.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 2812 uaiqyen.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2812 uaiqyen.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2368 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 30 PID 3020 wrote to memory of 2368 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 30 PID 3020 wrote to memory of 2368 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 30 PID 3020 wrote to memory of 2368 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 30 PID 2368 wrote to memory of 2812 2368 fpbadygypzl.exe 31 PID 2368 wrote to memory of 2812 2368 fpbadygypzl.exe 31 PID 2368 wrote to memory of 2812 2368 fpbadygypzl.exe 31 PID 2368 wrote to memory of 2812 2368 fpbadygypzl.exe 31 PID 2368 wrote to memory of 2664 2368 fpbadygypzl.exe 32 PID 2368 wrote to memory of 2664 2368 fpbadygypzl.exe 32 PID 2368 wrote to memory of 2664 2368 fpbadygypzl.exe 32 PID 2368 wrote to memory of 2664 2368 fpbadygypzl.exe 32 PID 3020 wrote to memory of 2628 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 34 PID 3020 wrote to memory of 2628 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 34 PID 3020 wrote to memory of 2628 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 34 PID 3020 wrote to memory of 2628 3020 8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe 34 -
System policy modification 1 TTPs 38 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" uaiqyen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" uaiqyen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" uaiqyen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" fpbadygypzl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" fpbadygypzl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uaiqyen.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer uaiqyen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fpbadygypzl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System fpbadygypzl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8e8d8dd457411eaf96c3e5f1cf646ec5_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\fpbadygypzl.exe"C:\Users\Admin\AppData\Local\Temp\fpbadygypzl.exe" "c:\users\admin\appdata\local\temp\8e8d8dd457411eaf96c3e5f1cf646ec5_jaffacakes118.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\uaiqyen.exe"C:\Users\Admin\AppData\Local\Temp\uaiqyen.exe" "-C:\Users\Admin\AppData\Local\Temp\tizqhwobxyneiqqd.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2812
-
-
C:\Users\Admin\AppData\Local\Temp\uaiqyen.exe"C:\Users\Admin\AppData\Local\Temp\uaiqyen.exe" "-C:\Users\Admin\AppData\Local\Temp\tizqhwobxyneiqqd.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2664
-
-
-
C:\Users\Admin\AppData\Local\Temp\fpbadygypzl.exe"C:\Users\Admin\AppData\Local\Temp\fpbadygypzl.exe" "c:\users\admin\appdata\local\temp\8e8d8dd457411eaf96c3e5f1cf646ec5_jaffacakes118.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2628
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272B
MD5bd39d78d7257cad3b57b0cf6852d2459
SHA1b756bf07bf0fcc0cb8ddf7b6737df9141167e011
SHA256fcb7a2258f089d9f5e46c4d3bceb4f5b35fcc16f59bed7dbcc41c6e5d34bd122
SHA51280c6ee23826c6dbf5e00295656e0f355f96f742b8a73a85a334e0b6e9ac504ee44e923239d7c739b656827db66b201b18ac221275c045b663759343026302793
-
Filesize
272B
MD53fc0a394b24744c76b7b91a1c10d8216
SHA1c5fda7b3b22e94d0cac838f81140fbf1bed64de2
SHA25697be1d6f4501cccdd73226f047d64184481dd20916d9835d0ea42f728db8f42b
SHA5125899959af2c785ea64b04f6a26627bcbd3cf9756fdf514de4f15ba9affe0917faa0f0851ede9d825929c3c7637a437779019e5d6e0293552b6f879637357edb8
-
Filesize
272B
MD5866fe1afe131d8c1261d54666cf4461e
SHA1ae9496f14e1c5125f19b972c69740a4fd99e92b5
SHA25635eaf9bfc1f7baa4f54feec2ed0bf94f920d41499d87e60cee387f651f7549d1
SHA512250726839b7acb471f24e96eea8b69682daeda1eb94c1d9f574877c947b0671938553a1716c7ec627d009438b71fde5ddd493ea465dd591c6ab0a51d5db9da77
-
Filesize
272B
MD5afcfeda83189dface8078661956399f0
SHA170216e651ac58ca32855d7a361e2528a7663824f
SHA2568562896a03298191bfae64441e7a7b9d1eb6b8fca82b9e56b056eaf6606ef789
SHA512ebb646251eabe7345a4f26330f22914f064ccb9104384b6ddf71ce3dc45e0d08f9bec464b420ca3b55c4672708dc36c58c66e2a3100d422e7daf9e0cb57bec1f
-
Filesize
272B
MD51899d28db807e607993661504212d169
SHA1e9c8ac80b89d14963ec923fb8aa71c667a5154e6
SHA25636f0306064b4a8debcee15fe9cb1a936aafa2168c31362433caf71e610b7be8b
SHA51239e8864d1a28b5ec8637569d18426261f8ad3a5aa9f389f0af73e9897a437a919d84aba5dc92b0a3998a7be7f7893ff53fcf7258d0b2f596a3f2b0b957c66f55
-
Filesize
272B
MD544acbf916ee6657437ea243c6157ae69
SHA10dce3dc316cfd0ad192a81e70f1b987616389203
SHA256102d6d89480a5555a0102ca85dd3b3a24a8fbcdf947f0b3c2c76dffc1da614c3
SHA512eeead8db0c51d0b9ccdccddc218ac83b65852045c352f8567ae225e34bf4af16ebaf997b21862492dc62d28cb972fbe0f308ff0a946dc0bfc9fc9a73a44ab5e2
-
Filesize
272B
MD51b87b226dcd3c7aff0bdad467faa0d18
SHA14d22da62b305839fe384af9b6cc0578b004f5f91
SHA256be256f4662ad980ffa475ab489785ca70cfbfbff3cdb0df554fd316a7e5cf560
SHA5126b265d736f94ecfe0ab3245e3aa4721015ba5c5dc9c21b1893ce2f6e4809324a9b5880feb6fe8cc882569f2dca7a074f99d5996d3deb70a696cab7fe5230d757
-
Filesize
3KB
MD5fdb045e2e1dcc48616e29bc3025ce190
SHA10fc9224af1fcedd19e0148449e764fded354f4eb
SHA25611ce6bb298e9cb10b90438860c781a2f7c505f698c9fd44ad660c6d376bf3338
SHA512d61382f07e34bc2234001ab4fbcfa85ed3a158c3ef3764e8a01e3e5c69edc82e044a5b030839760d44f1bcfbc80a13fa375da7763c7264e73fa67e0425ff92e6
-
Filesize
644KB
MD58e8d8dd457411eaf96c3e5f1cf646ec5
SHA1b03b741382822e3f012bc8d1c87331aaefeff1a4
SHA256b6b2b9e959b52d90742beac4f6b23a72e4c2cb5e802bbb9e7da138098d30cd24
SHA512e6cf6ea96fbc9befaf59e1b0a876e7afadc5439918ee294dbe584d474310cc79db4ff7091645e29e0f367561a7a3a71cd80ec4200ebbd7809fd5e738bc58878c
-
Filesize
320KB
MD589ec3461ef4a893428c32f89de78b396
SHA18067cdc0901f0dc5bc1bb67a1c9037f502ea85f9
SHA2561849989ee704cda3b552b5021f3165012978d26d0daf7d22a09805deb6be2d0b
SHA5127804fa36e1f050115b00d21a9a94cf92436260a385da67106b0c73eb350abafca53f2dec42d377d4eccc095dd75ac92e841fb66e874e656e412cd71ed7909fe8
-
Filesize
684KB
MD5fc013097dbb4c255478016b15df67f97
SHA15b48b446353bb1df09b143e07901442cf18c0662
SHA2564e6799862185f6bd77a9715a3748b0cc6a7594d730fecedd5e3736bbf58b7f61
SHA512c366f94fcd5340cc6308c535c19dd470eb7b79a3909de8daacd8ac1fc67f3c1ea38c6fdeee750046ced6ecfb552a934088585f1bcc3e6772185205c1be873013