bb8e47ca1da2f0535bfb152c3a7f28337697258718257344ba85d2058b449b8a

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2024, 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Size

725KB
MD5

be6ae6d916b23fb9429615fe1539e0a4
SHA1

c532d6a82064d4ef21c54bdb1ead01e335f9339b
SHA256

bb8e47ca1da2f0535bfb152c3a7f28337697258718257344ba85d2058b449b8a
SHA512

9ffee3ca661d3ac6ddf1969bd9b6cbc72eb5fc310b00ade2ac0a5376228a42af8bb6babdb92d245a7ff65add3c657483d5076165cab31a1973723cd79981b75a
SSDEEP

12288:RKldoJpVPni2GLbHk4WEERX42SN/YBMKMcrbV1:AldoJpV/abEqU

Score

10^/10

defense_evasion discovery evasion persistence

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\RVUGK9J76I.exe = "C:\\Users\\Admin\\AppData\\Roaming\\RVUGK9J76I.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Credentials\\adfadfagad.exe"	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmpnetk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Credentials\\\\wmpnetk.exe"	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1140 set thread context of 456	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	84

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Credentials\adfadfagad.exe:ZONE.identifier	cmd.exe
File created	C:\Users\Admin\AppData\Local\Temp\Credentials\wmpnetk.exe:ZONE.identifier	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4476	reg.exe
2428	reg.exe
640	reg.exe
2608	reg.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Credentials\adfadfagad.exe:ZONE.identifier	cmd.exe
File created	C:\Users\Admin\AppData\Local\Temp\Credentials\wmpnetk.exe:ZONE.identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: 1	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeCreateTokenPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeAssignPrimaryTokenPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeMachineAccountPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeTcbPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeSecurityPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeSystemtimePrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeCreatePermanentPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeBackupPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeRestorePrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeShutdownPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeDebugPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeAuditPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeUndockPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeSyncAgentPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeEnableDelegationPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeManageVolumePrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeImpersonatePrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: 31	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: 32	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: 33	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: 34	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
Token: 35	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 1628	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	83
PID 1140 wrote to memory of 1628	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	83
PID 1140 wrote to memory of 1628	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	83
PID 1140 wrote to memory of 456	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	84
PID 1140 wrote to memory of 456	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	84
PID 1140 wrote to memory of 456	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	84
PID 1140 wrote to memory of 456	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	84
PID 1140 wrote to memory of 456	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	84
PID 1140 wrote to memory of 456	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	84
PID 1140 wrote to memory of 456	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	84
PID 1140 wrote to memory of 456	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	84
PID 456 wrote to memory of 3836	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	85
PID 456 wrote to memory of 3836	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	85
PID 456 wrote to memory of 3836	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	85
PID 456 wrote to memory of 4788	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	86
PID 456 wrote to memory of 4788	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	86
PID 456 wrote to memory of 4788	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	86
PID 456 wrote to memory of 3052	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	87
PID 456 wrote to memory of 3052	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	87
PID 456 wrote to memory of 3052	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	87
PID 456 wrote to memory of 4856	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	88
PID 456 wrote to memory of 4856	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	88
PID 456 wrote to memory of 4856	456	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	88
PID 1140 wrote to memory of 4340	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	93
PID 1140 wrote to memory of 4340	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	93
PID 1140 wrote to memory of 4340	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	93
PID 4788 wrote to memory of 4476	4788	cmd.exe	95
PID 4788 wrote to memory of 4476	4788	cmd.exe	95
PID 4788 wrote to memory of 4476	4788	cmd.exe	95
PID 3836 wrote to memory of 640	3836	cmd.exe	96
PID 3836 wrote to memory of 640	3836	cmd.exe	96
PID 3836 wrote to memory of 640	3836	cmd.exe	96
PID 3052 wrote to memory of 2428	3052	cmd.exe	97
PID 3052 wrote to memory of 2428	3052	cmd.exe	97
PID 3052 wrote to memory of 2428	3052	cmd.exe	97
PID 4856 wrote to memory of 2608	4856	cmd.exe	98
PID 4856 wrote to memory of 2608	4856	cmd.exe	98
PID 4856 wrote to memory of 2608	4856	cmd.exe	98
PID 4340 wrote to memory of 4488	4340	vbc.exe	99
PID 4340 wrote to memory of 4488	4340	vbc.exe	99
PID 4340 wrote to memory of 4488	4340	vbc.exe	99
PID 1140 wrote to memory of 2276	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	100
PID 1140 wrote to memory of 2276	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	100
PID 1140 wrote to memory of 2276	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	100
PID 1140 wrote to memory of 1472	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	102
PID 1140 wrote to memory of 1472	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	102
PID 1140 wrote to memory of 1472	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	102
PID 1140 wrote to memory of 4248	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	104
PID 1140 wrote to memory of 4248	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	104
PID 1140 wrote to memory of 4248	1140	be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe	104

C:\Users\Admin\AppData\Local\Temp\be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
  be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
  2⤵
  PID:1628
- C:\Users\Admin\AppData\Local\Temp\be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
  be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3836
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:640
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\be6ae6d916b23fb9429615fe1539e0a4_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4476
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2428
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\RVUGK9J76I.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RVUGK9J76I.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\RVUGK9J76I.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\RVUGK9J76I.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2608
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zx6fn7hg.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA98E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9E1079364E734DF0B74919D291E2361E.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4488
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2276
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:1472
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Credentials\xCocaine.txt

Filesize
725KB

MD5
be6ae6d916b23fb9429615fe1539e0a4

SHA1
c532d6a82064d4ef21c54bdb1ead01e335f9339b

SHA256
bb8e47ca1da2f0535bfb152c3a7f28337697258718257344ba85d2058b449b8a

SHA512
9ffee3ca661d3ac6ddf1969bd9b6cbc72eb5fc310b00ade2ac0a5376228a42af8bb6babdb92d245a7ff65add3c657483d5076165cab31a1973723cd79981b75a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA98E.tmp

Filesize
1KB

MD5
050eacba1ad0a249f35c485f1f39c2be

SHA1
ad09e4d52080008c7bddab92e7dd9ef7a25582bf

SHA256
a7f854927f89595a83b52932e4c5d61c865539a41a81ceddb2afb197e62db908

SHA512
87b3a2bbbb4e17928aa9eae45921fbc30fca769645d4b7475cbec333a2aa885aed81db97ba9b22a3242a2d67a4506e53264101e5e8406cf888db2b777eeb821a

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc9E1079364E734DF0B74919D291E2361E.TMP

Filesize
644B

MD5
4796bc14faa1ac7a9acd0cc506856013

SHA1
1cbb4c10d4db6f3267be1b758930659fab4fc81d

SHA256
cd03d6d46871ea730a68e1054a69fe0677dcc50c24a7dbc8132e612a3505ff83

SHA512
3e287b1c57e753d92801beb5a2138c0d2c9674a26cb8404825cf7ac3a49186d5b277adb5533a4f314c06f7a9893622051a7323ce4b9ce392b2f3c76e2ab33229

Download Submit
C:\Users\Admin\AppData\Local\Temp\zx6fn7hg.0.vb

Filesize
1KB

MD5
9e23590a8219e14051e648b03dece793

SHA1
2186c1185aa1999137e1b26174f35b8e9fa595ed

SHA256
96489920ef2574832be2e8809641b441c1bad2f09a1ac0ae679f58f6648827aa

SHA512
e5117d5389798b2082dbe0ab59bcc08c92e04271a928828d19a65a4b82e1873d2c7e693dd6535ddc79f5716e567ab1646bb5885b47b243fbfe984b23aaa9bf06

Download Submit
C:\Users\Admin\AppData\Local\Temp\zx6fn7hg.cmdline

Filesize
295B

MD5
cd7f0903be8740d16f97c77c0dea4f8c

SHA1
2006193ab5baf4aa085692ade4024696e32dce7f

SHA256
fe266f48d50d684f9d9b7cc46abb454dfaf2036f5d1f679c9b3cd5b1d6ad7fb4

SHA512
eec179f99df14c14aaf57a5682a6fc0f3893a1c59291fa3f1497c749b663c020d51a1c0098da10ec6caac4dfa5dbaf4742e829e06a51c9fbd4079e4e5d81a633

Download Submit
memory/456-5-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/456-3-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1140-0-0x00000000745E2000-0x00000000745E3000-memory.dmp

Filesize
4KB

Download
memory/1140-2-0x00000000745E0000-0x0000000074B91000-memory.dmp

Filesize
5.7MB

Download
memory/1140-1-0x00000000745E0000-0x0000000074B91000-memory.dmp

Filesize
5.7MB

Download
memory/1140-29-0x00000000745E2000-0x00000000745E3000-memory.dmp

Filesize
4KB

Download
memory/1140-30-0x00000000745E0000-0x0000000074B91000-memory.dmp

Filesize
5.7MB

Download
memory/1140-31-0x00000000745E0000-0x0000000074B91000-memory.dmp

Filesize
5.7MB

Download