2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
Size

166KB
MD5

4f0a15b2f8d3bc8dd261b28b71685bc3
SHA1

7cef8b2f229d2319145f3728682f581935d1d2ca
SHA256

2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3
SHA512

9d9ccfc2335c88d0973a0ce0389612f8febee9213963196ba5b670faeae74dc6c334f9a1f842ccacc6a575ba9085eba64620e36f4c4227c8278b21f302660f51
SSDEEP

3072:nQBqZ/B+v0JqlfqkNTdQqm7J2E+vYCgbrJCVQhMdT:nQB0idqHogbWaMd

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Client.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Client.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Client.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe

Executes dropped EXE 3 IoCs

pid	Process
2860	Client.exe
1700	Client.exe
4980	Client.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Client.exe\" .."	Client.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Client.exe\" .."	Client.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
35	4.tcp.eu.ngrok.io
62	4.tcp.eu.ngrok.io
77	4.tcp.eu.ngrok.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
2208	TASKKILL.exe
4756	TASKKILL.exe
4732	TASKKILL.exe
808	TASKKILL.exe
1448	TASKKILL.exe
4060	TASKKILL.exe
3228	TASKKILL.exe
640	TASKKILL.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2904	schtasks.exe
1180	schtasks.exe
2412	schtasks.exe
4544	schtasks.exe
3556	schtasks.exe
2348	schtasks.exe
5004	schtasks.exe
4792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
Token: SeDebugPrivilege	2208	TASKKILL.exe
Token: SeDebugPrivilege	4756	TASKKILL.exe
Token: SeDebugPrivilege	2860	Client.exe
Token: SeDebugPrivilege	808	TASKKILL.exe
Token: SeDebugPrivilege	4732	TASKKILL.exe
Token: SeDebugPrivilege	1448	TASKKILL.exe
Token: SeDebugPrivilege	4060	TASKKILL.exe
Token: SeDebugPrivilege	1700	Client.exe
Token: 33	2860	Client.exe
Token: SeIncBasePriorityPrivilege	2860	Client.exe
Token: 33	2860	Client.exe
Token: SeIncBasePriorityPrivilege	2860	Client.exe
Token: 33	2860	Client.exe
Token: SeIncBasePriorityPrivilege	2860	Client.exe
Token: 33	2860	Client.exe
Token: SeIncBasePriorityPrivilege	2860	Client.exe
Token: 33	2860	Client.exe
Token: SeIncBasePriorityPrivilege	2860	Client.exe
Token: 33	2860	Client.exe
Token: SeIncBasePriorityPrivilege	2860	Client.exe
Token: 33	2860	Client.exe
Token: SeIncBasePriorityPrivilege	2860	Client.exe
Token: SeDebugPrivilege	4980	Client.exe
Token: SeDebugPrivilege	3228	TASKKILL.exe
Token: SeDebugPrivilege	640	TASKKILL.exe
Token: 33	2860	Client.exe
Token: SeIncBasePriorityPrivilege	2860	Client.exe
Token: 33	2860	Client.exe
Token: SeIncBasePriorityPrivilege	2860	Client.exe
Token: 33	2860	Client.exe
Token: SeIncBasePriorityPrivilege	2860	Client.exe
Token: 33	2860	Client.exe
Token: SeIncBasePriorityPrivilege	2860	Client.exe
Token: 33	2860	Client.exe
Token: SeIncBasePriorityPrivilege	2860	Client.exe
Token: 33	2860	Client.exe
Token: SeIncBasePriorityPrivilege	2860	Client.exe
Token: 33	2860	Client.exe
Token: SeIncBasePriorityPrivilege	2860	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 4884	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	83
PID 3228 wrote to memory of 4884	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	83
PID 3228 wrote to memory of 4884	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	83
PID 3228 wrote to memory of 2348	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	85
PID 3228 wrote to memory of 2348	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	85
PID 3228 wrote to memory of 2348	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	85
PID 3228 wrote to memory of 2208	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	87
PID 3228 wrote to memory of 2208	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	87
PID 3228 wrote to memory of 2208	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	87
PID 3228 wrote to memory of 4756	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	88
PID 3228 wrote to memory of 4756	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	88
PID 3228 wrote to memory of 4756	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	88
PID 3228 wrote to memory of 2680	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	98
PID 3228 wrote to memory of 2680	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	98
PID 3228 wrote to memory of 2680	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	98
PID 3228 wrote to memory of 5004	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	100
PID 3228 wrote to memory of 5004	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	100
PID 3228 wrote to memory of 5004	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	100
PID 3228 wrote to memory of 2860	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	108
PID 3228 wrote to memory of 2860	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	108
PID 3228 wrote to memory of 2860	3228	JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe	108
PID 2860 wrote to memory of 1564	2860	Client.exe	109
PID 2860 wrote to memory of 1564	2860	Client.exe	109
PID 2860 wrote to memory of 1564	2860	Client.exe	109
PID 2860 wrote to memory of 4792	2860	Client.exe	111
PID 2860 wrote to memory of 4792	2860	Client.exe	111
PID 2860 wrote to memory of 4792	2860	Client.exe	111
PID 2860 wrote to memory of 808	2860	Client.exe	112
PID 2860 wrote to memory of 808	2860	Client.exe	112
PID 2860 wrote to memory of 808	2860	Client.exe	112
PID 2860 wrote to memory of 4732	2860	Client.exe	113
PID 2860 wrote to memory of 4732	2860	Client.exe	113
PID 2860 wrote to memory of 4732	2860	Client.exe	113
PID 2860 wrote to memory of 2408	2860	Client.exe	119
PID 2860 wrote to memory of 2408	2860	Client.exe	119
PID 2860 wrote to memory of 2408	2860	Client.exe	119
PID 2860 wrote to memory of 2904	2860	Client.exe	121
PID 2860 wrote to memory of 2904	2860	Client.exe	121
PID 2860 wrote to memory of 2904	2860	Client.exe	121
PID 1700 wrote to memory of 3160	1700	Client.exe	126
PID 1700 wrote to memory of 3160	1700	Client.exe	126
PID 1700 wrote to memory of 3160	1700	Client.exe	126
PID 1700 wrote to memory of 1180	1700	Client.exe	128
PID 1700 wrote to memory of 1180	1700	Client.exe	128
PID 1700 wrote to memory of 1180	1700	Client.exe	128
PID 1700 wrote to memory of 1448	1700	Client.exe	130
PID 1700 wrote to memory of 1448	1700	Client.exe	130
PID 1700 wrote to memory of 1448	1700	Client.exe	130
PID 1700 wrote to memory of 4060	1700	Client.exe	132
PID 1700 wrote to memory of 4060	1700	Client.exe	132
PID 1700 wrote to memory of 4060	1700	Client.exe	132
PID 1700 wrote to memory of 1592	1700	Client.exe	135
PID 1700 wrote to memory of 1592	1700	Client.exe	135
PID 1700 wrote to memory of 1592	1700	Client.exe	135
PID 1700 wrote to memory of 2412	1700	Client.exe	137
PID 1700 wrote to memory of 2412	1700	Client.exe	137
PID 1700 wrote to memory of 2412	1700	Client.exe	137
PID 4980 wrote to memory of 1000	4980	Client.exe	140
PID 4980 wrote to memory of 1000	4980	Client.exe	140
PID 4980 wrote to memory of 1000	4980	Client.exe	140
PID 4980 wrote to memory of 4544	4980	Client.exe	142
PID 4980 wrote to memory of 4544	4980	Client.exe	142
PID 4980 wrote to memory of 4544	4980	Client.exe	142
PID 4980 wrote to memory of 3228	4980	Client.exe	144

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe"
1⤵
- Checks computer location settings
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYANP /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4884
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe" /sc minute /mo 5
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2348
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM wscript.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4756
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2680
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5004
- C:\Users\Admin\AppData\Roaming\Client.exe
  "C:\Users\Admin\AppData\Roaming\Client.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYANP /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Roaming\Client.exe" /sc minute /mo 5
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4792
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM wscript.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:808
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Client.exe" /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2904

C:\Users\Admin\AppData\Roaming\Client.exe
C:\Users\Admin\AppData\Roaming\Client.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYANP /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3160
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Roaming\Client.exe" /sc minute /mo 5
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1180
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM wscript.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1448
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4060
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1592
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Client.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2412

C:\Users\Admin\AppData\Roaming\Client.exe
C:\Users\Admin\AppData\Roaming\Client.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYANP /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1000
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Roaming\Client.exe" /sc minute /mo 5
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4544
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM wscript.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3228
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:640
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2432
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Client.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Client.exe.log

Filesize
408B

MD5
40b0c3caa1b14a4c83e8475c46bf2016

SHA1
af9575cda4d842f028d18b17063796a894ecd9d0

SHA256
70e88a428d92b6ab5905dac9f324824c4c6f120bc3f385c82b2d12f707a4a867

SHA512
916437df737de4b6063b7116b4d148229d4a975eb4046122d47434b81fba06e88e09e5f273ec496c81ef3feecb843ccad20a7a04074224416c1fa9951acbdac7

Download Submit
C:\Users\Admin\AppData\Roaming\Client.exe

Filesize
166KB

MD5
4f0a15b2f8d3bc8dd261b28b71685bc3

SHA1
7cef8b2f229d2319145f3728682f581935d1d2ca

SHA256
2515a479e1b5aeebc313b0d337aa8be20a7d185414a5f1a76d98c0d31285f9a3

SHA512
9d9ccfc2335c88d0973a0ce0389612f8febee9213963196ba5b670faeae74dc6c334f9a1f842ccacc6a575ba9085eba64620e36f4c4227c8278b21f302660f51

Download Submit
memory/3228-6-0x0000000075090000-0x0000000075641000-memory.dmp

Filesize
5.7MB

Download
memory/3228-3-0x0000000075090000-0x0000000075641000-memory.dmp

Filesize
5.7MB

Download
memory/3228-4-0x0000000075090000-0x0000000075641000-memory.dmp

Filesize
5.7MB

Download
memory/3228-5-0x0000000075092000-0x0000000075093000-memory.dmp

Filesize
4KB

Download
memory/3228-0-0x0000000075092000-0x0000000075093000-memory.dmp

Filesize
4KB

Download
memory/3228-7-0x0000000075090000-0x0000000075641000-memory.dmp

Filesize
5.7MB

Download
memory/3228-8-0x0000000075090000-0x0000000075641000-memory.dmp

Filesize
5.7MB

Download
memory/3228-9-0x0000000075090000-0x0000000075641000-memory.dmp

Filesize
5.7MB

Download
memory/3228-2-0x0000000075090000-0x0000000075641000-memory.dmp

Filesize
5.7MB

Download
memory/3228-19-0x0000000075090000-0x0000000075641000-memory.dmp

Filesize
5.7MB

Download
memory/3228-1-0x0000000075090000-0x0000000075641000-memory.dmp

Filesize
5.7MB

Download