Malware Analysis Report

2025-01-02 06:55

Sample ID 241125-p6ft9sxmhz
Target 9b9da065249e8fe54710e673923b7cd5_JaffaCakes118
SHA256 56290c2104affa1cf206123446540929c031486b6c3b3519b2de9a96963c9710
Tags
evasion execution persistence privilege_escalation r77 rootkit
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

56290c2104affa1cf206123446540929c031486b6c3b3519b2de9a96963c9710

Threat Level: Known bad

The file 9b9da065249e8fe54710e673923b7cd5_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion execution persistence privilege_escalation r77 rootkit

R77 family

r77

r77 rootkit payload

Modifies Windows Firewall

Downloads MZ/PE file

Command and Scripting Interpreter: PowerShell

Event Triggered Execution: AppInit DLLs

Loads dropped DLL

Drops startup file

Checks computer location settings

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Views/modifies file attributes

Suspicious use of AdjustPrivilegeToken

Modifies system certificate store

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-25 12:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-25 12:56

Reported

2024-11-25 12:58

Platform

win7-20240708-en

Max time kernel

143s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe"

Signatures

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-SystemProcessor.exe C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-SystemProcessor.exe C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\ProgramData\\Microsoft\\$77-SystemProcessor.exe" C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\ProgramData\\Microsoft\\$77-SystemProcessor.exe" C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\$77-SystemProcessor.exe" C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\$77-SystemProcessor.exe" C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\ProgramData\\Microsoft\\$77-SystemProcessor.exe" C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\ProgramData\\Microsoft\\$77-SystemProcessor.exe" C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1724 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe C:\Windows\system32\cmd.exe
PID 1724 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe C:\Windows\system32\cmd.exe
PID 1724 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe C:\Windows\system32\cmd.exe
PID 2248 wrote to memory of 2760 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2248 wrote to memory of 2760 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2248 wrote to memory of 2760 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 1724 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe C:\ProgramData\Microsoft\$77-SystemProcessor.exe
PID 1724 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe C:\ProgramData\Microsoft\$77-SystemProcessor.exe
PID 1724 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe C:\ProgramData\Microsoft\$77-SystemProcessor.exe
PID 2912 wrote to memory of 2020 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 2912 wrote to memory of 2020 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 2912 wrote to memory of 2020 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 2020 wrote to memory of 1604 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 1604 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2020 wrote to memory of 1604 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2912 wrote to memory of 2904 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 2912 wrote to memory of 2904 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 2912 wrote to memory of 2904 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 2904 wrote to memory of 2900 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2900 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2904 wrote to memory of 2900 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2912 wrote to memory of 2844 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 2912 wrote to memory of 2844 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 2912 wrote to memory of 2844 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 2844 wrote to memory of 2656 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2844 wrote to memory of 2656 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2844 wrote to memory of 2656 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2912 wrote to memory of 556 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 2912 wrote to memory of 556 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 2912 wrote to memory of 556 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 556 wrote to memory of 1668 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 556 wrote to memory of 1668 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 556 wrote to memory of 1668 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2912 wrote to memory of 2612 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\system32\netsh.exe
PID 2912 wrote to memory of 2612 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\system32\netsh.exe
PID 2912 wrote to memory of 2612 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\system32\netsh.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe"

C:\Windows\system32\cmd.exe

cmd.exe /c attrib -h -r -s "C:\ProgramData\Microsoft\$77-SystemProcessor.exe"

C:\Windows\system32\attrib.exe

attrib -h -r -s "C:\ProgramData\Microsoft\$77-SystemProcessor.exe"

C:\ProgramData\Microsoft\$77-SystemProcessor.exe

"C:\ProgramData\Microsoft\$77-SystemProcessor.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-SystemProcessor.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-SystemProcessor.exe'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\r77-x64.dll'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\r77-x64.dll'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\r77-x86.dll'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\r77-x86.dll'

C:\Windows\system32\netsh.exe

netsh firewall delete allowedprogram "C:\ProgramData\Microsoft\$77-SystemProcessor.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 crl.comodoca.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 todaytor.duckdns.org udp
NG 102.22.220.167:4040 todaytor.duckdns.org tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 88.221.134.83:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
NG 102.22.220.167:4040 todaytor.duckdns.org tcp
NG 102.22.220.167:4040 todaytor.duckdns.org tcp
US 8.8.8.8:53 todaytor.duckdns.org udp
NG 102.22.220.167:4040 todaytor.duckdns.org tcp

Files

memory/1724-0-0x000007FEF5803000-0x000007FEF5804000-memory.dmp

memory/1724-1-0x00000000000E0000-0x00000000000F0000-memory.dmp

C:\ProgramData\Microsoft\$77-SystemProcessor.exe

MD5 9b9da065249e8fe54710e673923b7cd5
SHA1 855744b965629510b6929fa1d2e19cd6c796f030
SHA256 56290c2104affa1cf206123446540929c031486b6c3b3519b2de9a96963c9710
SHA512 4a38a4bc84911ece6042746aa631e5077373197b2cec269c3b89b7bbb4bf0b0fd992b080f69d7c1daab608b9653be9f48cbce0c9bb9ac6a89a3ca2ffc566d1f3

memory/2912-7-0x0000000000A40000-0x0000000000A50000-memory.dmp

memory/1724-8-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

memory/2912-9-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabC9B7.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarC9D9.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

memory/2912-45-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

memory/1604-234-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

memory/1604-235-0x0000000002790000-0x0000000002798000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 3b4b68f91b5e128bf9def0d3263be572
SHA1 06855333e85d3613f7f3854f811140401322c647
SHA256 fa1ba972874b5e6b8ecbdc07aef156c2cda65fa0bfdfdea85071ffede8596604
SHA512 c0118314eb41d40925fcf43f59a4e4e5bc8978e238ffd50a8340e47bc02a1554d123a174052da3b75fc0e7b081090c3c89e99475514d0bd6f92015da2e19bb2a

memory/2900-241-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

memory/2900-242-0x0000000002820000-0x0000000002828000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-25 12:56

Reported

2024-11-25 12:58

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe"

Signatures

R77 family

r77

r77

rootkit r77

r77 rootkit payload

Description Indicator Process Target
N/A N/A N/A N/A

Downloads MZ/PE file

Event Triggered Execution: AppInit DLLs

persistence privilege_escalation

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-SystemProcessor.exe C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-SystemProcessor.exe C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SYSTEM32\netsh.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\ProgramData\\Microsoft\\$77-SystemProcessor.exe" C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\ProgramData\\Microsoft\\$77-SystemProcessor.exe" C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\$77-SystemProcessor.exe" C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\$77-SystemProcessor.exe" C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\ProgramData\\Microsoft\\$77-SystemProcessor.exe" C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77-SystemProcessor = "C:\\ProgramData\\Microsoft\\$77-SystemProcessor.exe" C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\SYSTEM32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\SYSTEM32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\SYSTEM32\netsh.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
N/A N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
N/A N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
N/A N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
N/A N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
N/A N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
N/A N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
N/A N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
N/A N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
N/A N/A C:\Windows\SYSTEM32\netsh.exe N/A
N/A N/A C:\Windows\SYSTEM32\netsh.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 548 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe C:\Windows\SYSTEM32\cmd.exe
PID 548 wrote to memory of 620 N/A C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe C:\Windows\SYSTEM32\cmd.exe
PID 620 wrote to memory of 4024 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\attrib.exe
PID 620 wrote to memory of 4024 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\attrib.exe
PID 548 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe C:\ProgramData\Microsoft\$77-SystemProcessor.exe
PID 548 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe C:\ProgramData\Microsoft\$77-SystemProcessor.exe
PID 4104 wrote to memory of 1704 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 4104 wrote to memory of 1704 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 1704 wrote to memory of 644 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1704 wrote to memory of 644 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 3000 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 4104 wrote to memory of 3000 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 3000 wrote to memory of 760 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3000 wrote to memory of 760 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 1272 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 4104 wrote to memory of 1272 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 1272 wrote to memory of 4220 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1272 wrote to memory of 4220 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 3256 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 4104 wrote to memory of 3256 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\System32\cmd.exe
PID 3256 wrote to memory of 2824 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3256 wrote to memory of 2824 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 4852 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\SYSTEM32\netsh.exe
PID 4104 wrote to memory of 4852 N/A C:\ProgramData\Microsoft\$77-SystemProcessor.exe C:\Windows\SYSTEM32\netsh.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\9b9da065249e8fe54710e673923b7cd5_JaffaCakes118.exe"

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c attrib -h -r -s "C:\ProgramData\Microsoft\$77-SystemProcessor.exe"

C:\Windows\system32\attrib.exe

attrib -h -r -s "C:\ProgramData\Microsoft\$77-SystemProcessor.exe"

C:\ProgramData\Microsoft\$77-SystemProcessor.exe

"C:\ProgramData\Microsoft\$77-SystemProcessor.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-SystemProcessor.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-SystemProcessor.exe'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\r77-x64.dll'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\r77-x64.dll'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\r77-x86.dll'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\r77-x86.dll'

C:\Windows\SYSTEM32\netsh.exe

netsh firewall delete allowedprogram "C:\ProgramData\Microsoft\$77-SystemProcessor.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 todaytor.duckdns.org udp
NG 102.22.220.167:4040 todaytor.duckdns.org tcp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
NG 102.22.220.167:4040 todaytor.duckdns.org tcp
NG 102.22.220.167:4040 todaytor.duckdns.org tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 todaytor.duckdns.org udp
NG 102.22.220.167:4040 todaytor.duckdns.org tcp
NG 102.22.220.167:4040 todaytor.duckdns.org tcp

Files

memory/548-0-0x00007FFCBC1F3000-0x00007FFCBC1F5000-memory.dmp

memory/548-1-0x0000000000520000-0x0000000000530000-memory.dmp

memory/548-10-0x00007FFCBC1F0000-0x00007FFCBCCB1000-memory.dmp

C:\ProgramData\Microsoft\$77-SystemProcessor.exe

MD5 9b9da065249e8fe54710e673923b7cd5
SHA1 855744b965629510b6929fa1d2e19cd6c796f030
SHA256 56290c2104affa1cf206123446540929c031486b6c3b3519b2de9a96963c9710
SHA512 4a38a4bc84911ece6042746aa631e5077373197b2cec269c3b89b7bbb4bf0b0fd992b080f69d7c1daab608b9653be9f48cbce0c9bb9ac6a89a3ca2ffc566d1f3

memory/548-15-0x00007FFCBC1F0000-0x00007FFCBCCB1000-memory.dmp

memory/4104-16-0x00007FFCBC1F0000-0x00007FFCBCCB1000-memory.dmp

memory/4104-27-0x00007FFCBC1F0000-0x00007FFCBCCB1000-memory.dmp

C:\ProgramData\Microsoft\r77-x64.dll

MD5 1b8bd653321cf3cbc786e563555fbc75
SHA1 5638efe0476c8c1b74c6604db419be814d1d90a0
SHA256 919a332e85d7c32a6f0a1bdd15b211b8b273b73fe05a553ea0f230a0958586c7
SHA512 bafdbc8413828c5427983fa0e9403a2d9a88d0ad2f27f92842310852d273f2d2c9a0c6f9f64e1aac03fadf49f9a3bcf58c6b7c8b06debcce46536114cde0175b

memory/644-55-0x0000011F69430000-0x0000011F69452000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ovrqwjsc.abo.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7