5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2024 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
Size

165KB
MD5

dfdec291a53f62834e81d192af2fb64e
SHA1

959f8ffa233dd320b100258724adfe69b71144a5
SHA256

5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc
SHA512

e7560f6a230f37f18faf4876aae015e3e0050f0ea6f09a637e53cb559abbd020ec48e8e971f055641ecf8057e928493e1469ef56b1bfeede533bad48c95e23d9
SSDEEP

3072:vVpwQ/8KbV8nKet98UL0ZCN4CEgEamqlZbb25BF1ilZ:dpvOsZ6+tq3bi3FG

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Client.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Client.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	Client.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe

Executes dropped EXE 3 IoCs

pid	Process
1308	Client.exe
4500	Client.exe
2620	Client.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Client.exe\" .."	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Client.exe\" .."	Client.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
32	4.tcp.eu.ngrok.io
45	4.tcp.eu.ngrok.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Kills process with taskkill 8 IoCs

evasion

pid	Process
3088	TASKKILL.exe
1556	TASKKILL.exe
1644	TASKKILL.exe
4408	TASKKILL.exe
4144	TASKKILL.exe
812	TASKKILL.exe
976	TASKKILL.exe
1416	TASKKILL.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
960	schtasks.exe
3400	schtasks.exe
4648	schtasks.exe
1388	schtasks.exe
1740	schtasks.exe
2920	schtasks.exe
5096	schtasks.exe
5116	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
Token: SeDebugPrivilege	4408	TASKKILL.exe
Token: SeDebugPrivilege	1644	TASKKILL.exe
Token: SeDebugPrivilege	1308	Client.exe
Token: SeDebugPrivilege	812	TASKKILL.exe
Token: SeDebugPrivilege	4144	TASKKILL.exe
Token: 33	1308	Client.exe
Token: SeIncBasePriorityPrivilege	1308	Client.exe
Token: 33	1308	Client.exe
Token: SeIncBasePriorityPrivilege	1308	Client.exe
Token: 33	1308	Client.exe
Token: SeIncBasePriorityPrivilege	1308	Client.exe
Token: 33	1308	Client.exe
Token: SeIncBasePriorityPrivilege	1308	Client.exe
Token: SeDebugPrivilege	976	TASKKILL.exe
Token: SeDebugPrivilege	1416	TASKKILL.exe
Token: SeDebugPrivilege	4500	Client.exe
Token: 33	1308	Client.exe
Token: SeIncBasePriorityPrivilege	1308	Client.exe
Token: 33	1308	Client.exe
Token: SeIncBasePriorityPrivilege	1308	Client.exe
Token: 33	1308	Client.exe
Token: SeIncBasePriorityPrivilege	1308	Client.exe
Token: 33	1308	Client.exe
Token: SeIncBasePriorityPrivilege	1308	Client.exe
Token: 33	1308	Client.exe
Token: SeIncBasePriorityPrivilege	1308	Client.exe
Token: 33	1308	Client.exe
Token: SeIncBasePriorityPrivilege	1308	Client.exe
Token: 33	1308	Client.exe
Token: SeIncBasePriorityPrivilege	1308	Client.exe
Token: SeDebugPrivilege	3088	TASKKILL.exe
Token: 33	1308	Client.exe
Token: SeIncBasePriorityPrivilege	1308	Client.exe
Token: SeDebugPrivilege	1556	TASKKILL.exe
Token: SeDebugPrivilege	2620	Client.exe
Token: 33	1308	Client.exe
Token: SeIncBasePriorityPrivilege	1308	Client.exe
Token: 33	1308	Client.exe
Token: SeIncBasePriorityPrivilege	1308	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 5060	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	82
PID 3116 wrote to memory of 5060	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	82
PID 3116 wrote to memory of 5060	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	82
PID 3116 wrote to memory of 5116	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	84
PID 3116 wrote to memory of 5116	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	84
PID 3116 wrote to memory of 5116	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	84
PID 3116 wrote to memory of 1644	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	86
PID 3116 wrote to memory of 1644	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	86
PID 3116 wrote to memory of 1644	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	86
PID 3116 wrote to memory of 4408	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	87
PID 3116 wrote to memory of 4408	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	87
PID 3116 wrote to memory of 4408	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	87
PID 3116 wrote to memory of 4400	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	97
PID 3116 wrote to memory of 4400	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	97
PID 3116 wrote to memory of 4400	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	97
PID 3116 wrote to memory of 960	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	99
PID 3116 wrote to memory of 960	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	99
PID 3116 wrote to memory of 960	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	99
PID 3116 wrote to memory of 1308	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	101
PID 3116 wrote to memory of 1308	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	101
PID 3116 wrote to memory of 1308	3116	JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe	101
PID 1308 wrote to memory of 1896	1308	Client.exe	102
PID 1308 wrote to memory of 1896	1308	Client.exe	102
PID 1308 wrote to memory of 1896	1308	Client.exe	102
PID 1308 wrote to memory of 3400	1308	Client.exe	104
PID 1308 wrote to memory of 3400	1308	Client.exe	104
PID 1308 wrote to memory of 3400	1308	Client.exe	104
PID 1308 wrote to memory of 812	1308	Client.exe	105
PID 1308 wrote to memory of 812	1308	Client.exe	105
PID 1308 wrote to memory of 812	1308	Client.exe	105
PID 1308 wrote to memory of 4144	1308	Client.exe	106
PID 1308 wrote to memory of 4144	1308	Client.exe	106
PID 1308 wrote to memory of 4144	1308	Client.exe	106
PID 1308 wrote to memory of 1716	1308	Client.exe	111
PID 1308 wrote to memory of 1716	1308	Client.exe	111
PID 1308 wrote to memory of 1716	1308	Client.exe	111
PID 1308 wrote to memory of 4648	1308	Client.exe	113
PID 1308 wrote to memory of 4648	1308	Client.exe	113
PID 1308 wrote to memory of 4648	1308	Client.exe	113
PID 4500 wrote to memory of 4024	4500	Client.exe	117
PID 4500 wrote to memory of 4024	4500	Client.exe	117
PID 4500 wrote to memory of 4024	4500	Client.exe	117
PID 4500 wrote to memory of 1388	4500	Client.exe	119
PID 4500 wrote to memory of 1388	4500	Client.exe	119
PID 4500 wrote to memory of 1388	4500	Client.exe	119
PID 4500 wrote to memory of 976	4500	Client.exe	120
PID 4500 wrote to memory of 976	4500	Client.exe	120
PID 4500 wrote to memory of 976	4500	Client.exe	120
PID 4500 wrote to memory of 1416	4500	Client.exe	121
PID 4500 wrote to memory of 1416	4500	Client.exe	121
PID 4500 wrote to memory of 1416	4500	Client.exe	121
PID 4500 wrote to memory of 4228	4500	Client.exe	125
PID 4500 wrote to memory of 4228	4500	Client.exe	125
PID 4500 wrote to memory of 4228	4500	Client.exe	125
PID 4500 wrote to memory of 1740	4500	Client.exe	127
PID 4500 wrote to memory of 1740	4500	Client.exe	127
PID 4500 wrote to memory of 1740	4500	Client.exe	127
PID 2620 wrote to memory of 3204	2620	Client.exe	130
PID 2620 wrote to memory of 3204	2620	Client.exe	130
PID 2620 wrote to memory of 3204	2620	Client.exe	130
PID 2620 wrote to memory of 2920	2620	Client.exe	132
PID 2620 wrote to memory of 2920	2620	Client.exe	132
PID 2620 wrote to memory of 2920	2620	Client.exe	132
PID 2620 wrote to memory of 3088	2620	Client.exe	134

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe"
1⤵
- Checks computer location settings
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYANP /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5060
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe" /sc minute /mo 5
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5116
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM wscript.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1644
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4408
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4400
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:960
- C:\Users\Admin\AppData\Roaming\Client.exe
  "C:\Users\Admin\AppData\Roaming\Client.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYANP /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Roaming\Client.exe" /sc minute /mo 5
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3400
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM wscript.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:812
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /tn NYAN /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Client.exe" /sc minute /mo 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4648

C:\Users\Admin\AppData\Roaming\Client.exe
C:\Users\Admin\AppData\Roaming\Client.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYANP /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4024
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Roaming\Client.exe" /sc minute /mo 5
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1388
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM wscript.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:976
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1416
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4228
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Client.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1740

C:\Users\Admin\AppData\Roaming\Client.exe
C:\Users\Admin\AppData\Roaming\Client.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYANP /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3204
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Roaming\Client.exe" /sc minute /mo 5
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2920
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM wscript.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3088
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1556
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Delete /tn NYAN /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3332
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Roaming\Client.exe" /sc minute /mo 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Client.exe.log

Filesize
408B

MD5
40b0c3caa1b14a4c83e8475c46bf2016

SHA1
af9575cda4d842f028d18b17063796a894ecd9d0

SHA256
70e88a428d92b6ab5905dac9f324824c4c6f120bc3f385c82b2d12f707a4a867

SHA512
916437df737de4b6063b7116b4d148229d4a975eb4046122d47434b81fba06e88e09e5f273ec496c81ef3feecb843ccad20a7a04074224416c1fa9951acbdac7

Download Submit
C:\Users\Admin\AppData\Roaming\Client.exe

Filesize
165KB

MD5
dfdec291a53f62834e81d192af2fb64e

SHA1
959f8ffa233dd320b100258724adfe69b71144a5

SHA256
5b1f6877dab9979d9dfff733cb357d06d6c7010bc8cc662b6ba416fa6b086abc

SHA512
e7560f6a230f37f18faf4876aae015e3e0050f0ea6f09a637e53cb559abbd020ec48e8e971f055641ecf8057e928493e1469ef56b1bfeede533bad48c95e23d9

Download Submit
memory/3116-6-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/3116-3-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/3116-4-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/3116-5-0x0000000074EA2000-0x0000000074EA3000-memory.dmp

Filesize
4KB

Download
memory/3116-0-0x0000000074EA2000-0x0000000074EA3000-memory.dmp

Filesize
4KB

Download
memory/3116-7-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/3116-8-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/3116-9-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/3116-2-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/3116-19-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download
memory/3116-1-0x0000000074EA0000-0x0000000075451000-memory.dmp

Filesize
5.7MB

Download