Analysis
-
max time kernel
20s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12-12-2024 11:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe
Resource
win7-20241010-en
windows7-x64
21 signatures
150 seconds
General
-
Target
e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe
-
Size
703KB
-
MD5
e61acbbe8d56d25353e59ad455fc2d0f
-
SHA1
8a1732f7181c45cec4392dbe6ec8bac518fa8e75
-
SHA256
d2fae7ef9a11f7775d69a40f704e276966680da6f3789a5babfcd18fd943529a
-
SHA512
12027b8eb60c647c2a560980c2c7cca96c65991593563af321a1dae0351b42d733f6fda68cd0fc050e4c06dfbae9480a78d1778dc725b390a58b032d87785969
-
SSDEEP
12288:o1iq/ujdrDqfnDqPoM7yowPeLddpSa/M4bkFzK/igahDyXhGr76:o1A4f4+owyO4AFzbBhuX06
Malware Config
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\syshost.exe,C:\\Windows\\system32\\syshost.exe" syshost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\syshost.exe" e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate syshost.exe -
Executes dropped EXE 4 IoCs
pid Process 2884 syshost.exe 2536 syshost.exe 2196 syshost.exe 2116 syshost.exe -
Loads dropped DLL 6 IoCs
pid Process 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 2800 WerFault.exe 2800 WerFault.exe 2800 WerFault.exe 2800 WerFault.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\syshost = "C:\\Windows\\system32\\syshost.exe" e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\syshost = "C:\\Windows\\system32\\syshost.exe" syshost.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\syshost.exe e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\syshost.exe e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\syshost.exe syshost.exe File created C:\Windows\SysWOW64\syshost.exe syshost.exe File opened for modification C:\Windows\SysWOW64\syshost.exe syshost.exe File opened for modification C:\Windows\SysWOW64\ syshost.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2660 set thread context of 3008 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 29 PID 2660 set thread context of 2296 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 30 PID 3008 set thread context of 2916 3008 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 31 PID 2884 set thread context of 2536 2884 syshost.exe 34 PID 2884 set thread context of 2196 2884 syshost.exe 35 PID 2536 set thread context of 2116 2536 syshost.exe 36 -
resource yara_rule behavioral1/memory/2916-33-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2916-35-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2916-34-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2916-30-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2916-29-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2916-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2916-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2916-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2916-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2916-44-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2916-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2116-101-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2116-115-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2116-119-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2800 2116 WerFault.exe 36 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language syshost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language syshost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language syshost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString syshost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier syshost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier syshost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 syshost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier syshost.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://www.google.com/cse?cx=partner-pub-9588033570232632:rhmyra-cwbb&q={searchTerms}" e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.google.com/cse?cx=partner-pub-9588033570232632:rhmyra-cwbb&q={searchTerms}" e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Google" syshost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.google.com/cse?cx=partner-pub-9588033570232632:rhmyra-cwbb&q={searchTerms}" syshost.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Google" e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main syshost.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} syshost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://www.google.com/cse?cx=partner-pub-9588033570232632:rhmyra-cwbb&q={searchTerms}" syshost.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "file://localhost/C:/www.google.com.htm" syshost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "file://localhost/C:/www.google.com.htm" e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeSecurityPrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeSystemtimePrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeBackupPrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeRestorePrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeShutdownPrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeDebugPrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeUndockPrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeManageVolumePrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeImpersonatePrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: 33 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: 34 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: 35 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2116 syshost.exe Token: SeSecurityPrivilege 2116 syshost.exe Token: SeTakeOwnershipPrivilege 2116 syshost.exe Token: SeLoadDriverPrivilege 2116 syshost.exe Token: SeSystemProfilePrivilege 2116 syshost.exe Token: SeSystemtimePrivilege 2116 syshost.exe Token: SeProfSingleProcessPrivilege 2116 syshost.exe Token: SeIncBasePriorityPrivilege 2116 syshost.exe Token: SeCreatePagefilePrivilege 2116 syshost.exe Token: SeBackupPrivilege 2116 syshost.exe Token: SeRestorePrivilege 2116 syshost.exe Token: SeShutdownPrivilege 2116 syshost.exe Token: SeDebugPrivilege 2116 syshost.exe Token: SeSystemEnvironmentPrivilege 2116 syshost.exe Token: SeChangeNotifyPrivilege 2116 syshost.exe Token: SeRemoteShutdownPrivilege 2116 syshost.exe Token: SeUndockPrivilege 2116 syshost.exe Token: SeManageVolumePrivilege 2116 syshost.exe Token: SeImpersonatePrivilege 2116 syshost.exe Token: SeCreateGlobalPrivilege 2116 syshost.exe Token: 33 2116 syshost.exe Token: 34 2116 syshost.exe Token: 35 2116 syshost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3008 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 2536 syshost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2660 wrote to memory of 3008 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 29 PID 2660 wrote to memory of 3008 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 29 PID 2660 wrote to memory of 3008 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 29 PID 2660 wrote to memory of 3008 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 29 PID 2660 wrote to memory of 3008 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 29 PID 2660 wrote to memory of 3008 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 29 PID 2660 wrote to memory of 3008 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 29 PID 2660 wrote to memory of 2296 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 30 PID 2660 wrote to memory of 2296 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 30 PID 2660 wrote to memory of 2296 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 30 PID 2660 wrote to memory of 2296 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 30 PID 2660 wrote to memory of 2296 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 30 PID 2660 wrote to memory of 2296 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 30 PID 2660 wrote to memory of 2296 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 30 PID 2660 wrote to memory of 2296 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 30 PID 2660 wrote to memory of 2296 2660 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 30 PID 3008 wrote to memory of 2916 3008 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 31 PID 3008 wrote to memory of 2916 3008 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 31 PID 3008 wrote to memory of 2916 3008 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 31 PID 3008 wrote to memory of 2916 3008 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 31 PID 3008 wrote to memory of 2916 3008 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 31 PID 3008 wrote to memory of 2916 3008 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 31 PID 3008 wrote to memory of 2916 3008 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 31 PID 3008 wrote to memory of 2916 3008 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 31 PID 2916 wrote to memory of 2752 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 32 PID 2916 wrote to memory of 2752 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 32 PID 2916 wrote to memory of 2752 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 32 PID 2916 wrote to memory of 2752 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 32 PID 2916 wrote to memory of 2884 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 33 PID 2916 wrote to memory of 2884 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 33 PID 2916 wrote to memory of 2884 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 33 PID 2916 wrote to memory of 2884 2916 e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe 33 PID 2884 wrote to memory of 2536 2884 syshost.exe 34 PID 2884 wrote to memory of 2536 2884 syshost.exe 34 PID 2884 wrote to memory of 2536 2884 syshost.exe 34 PID 2884 wrote to memory of 2536 2884 syshost.exe 34 PID 2884 wrote to memory of 2536 2884 syshost.exe 34 PID 2884 wrote to memory of 2536 2884 syshost.exe 34 PID 2884 wrote to memory of 2536 2884 syshost.exe 34 PID 2884 wrote to memory of 2196 2884 syshost.exe 35 PID 2884 wrote to memory of 2196 2884 syshost.exe 35 PID 2884 wrote to memory of 2196 2884 syshost.exe 35 PID 2884 wrote to memory of 2196 2884 syshost.exe 35 PID 2884 wrote to memory of 2196 2884 syshost.exe 35 PID 2884 wrote to memory of 2196 2884 syshost.exe 35 PID 2884 wrote to memory of 2196 2884 syshost.exe 35 PID 2884 wrote to memory of 2196 2884 syshost.exe 35 PID 2884 wrote to memory of 2196 2884 syshost.exe 35 PID 2536 wrote to memory of 2116 2536 syshost.exe 36 PID 2536 wrote to memory of 2116 2536 syshost.exe 36 PID 2536 wrote to memory of 2116 2536 syshost.exe 36 PID 2536 wrote to memory of 2116 2536 syshost.exe 36 PID 2536 wrote to memory of 2116 2536 syshost.exe 36 PID 2536 wrote to memory of 2116 2536 syshost.exe 36 PID 2536 wrote to memory of 2116 2536 syshost.exe 36 PID 2536 wrote to memory of 2116 2536 syshost.exe 36 PID 2116 wrote to memory of 1020 2116 syshost.exe 37 PID 2116 wrote to memory of 1020 2116 syshost.exe 37 PID 2116 wrote to memory of 1020 2116 syshost.exe 37 PID 2116 wrote to memory of 1020 2116 syshost.exe 37 PID 2116 wrote to memory of 2800 2116 syshost.exe 38 PID 2116 wrote to memory of 2800 2116 syshost.exe 38 PID 2116 wrote to memory of 2800 2116 syshost.exe 38 PID 2116 wrote to memory of 2800 2116 syshost.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe3⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"4⤵PID:2752
-
-
C:\Windows\SysWOW64\syshost.exe"C:\Windows\system32\syshost.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\syshost.exeC:\Windows\SysWOW64\syshost.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\syshost.exeC:\Windows\SysWOW64\syshost.exe6⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"7⤵PID:1020
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 4607⤵
- Loads dropped DLL
- Program crash
PID:2800
-
-
-
-
C:\Windows\SysWOW64\syshost.exeC:\Windows\SysWOW64\syshost.exe5⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:2196
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e61acbbe8d56d25353e59ad455fc2d0f_JaffaCakes118.exe2⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:2296
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
827B
MD5ef3e0b6971207c43b73b95205871c958
SHA17faff4ddec0cade5a7432b5bfd7a5a0283e6a3ce
SHA25614c4de9a9dbd129e1393f27f7cffe0516bc80e18a71f5599e4ff78807cdade89
SHA5129f25b14941083b849995394a695cd52cd3c43cd136e91ccf99bd85d81e0c938e377ad9214bd67027e7d584843ab2d7b976583814eebc35689d647bf644f4a70a
-
Filesize
703KB
MD5e61acbbe8d56d25353e59ad455fc2d0f
SHA18a1732f7181c45cec4392dbe6ec8bac518fa8e75
SHA256d2fae7ef9a11f7775d69a40f704e276966680da6f3789a5babfcd18fd943529a
SHA51212027b8eb60c647c2a560980c2c7cca96c65991593563af321a1dae0351b42d733f6fda68cd0fc050e4c06dfbae9480a78d1778dc725b390a58b032d87785969