neshta | b684b68ac65daaaa5f521c814e9d5dcb96e77f4f5f8fb0c32fc08fd1668431b8

Analysis

max time kernel
121s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
Size

335KB
MD5

550dfa6e3f38e3963ae5e578f371d8f0
SHA1

6e1c15c1320f46f5e40e678df1eaf8bfd1d6c2b7
SHA256

b684b68ac65daaaa5f521c814e9d5dcb96e77f4f5f8fb0c32fc08fd1668431b8
SHA512

dc304bcffe5451597bfe97a545757029f6687de3e334d9fcbc73f65d4896ae9fc00bcae33e18d314bca3c37925b4c344baa2651709a110bdb52f2cf50c8d0bae
SSDEEP

6144:k9X7bNIFlJYe5hhbouaeIDFsEt5qs7IJqp6FaRAhhJx:71pbjnIhsESs0JVYs

Score

10^/10

neshta discovery persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0001000000010314-14.dat	family_neshta
behavioral1/memory/2116-104-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9CC5ACBD-8B9A-11D5-EBA1-F78EEEEEE983}	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9CC5ACBD-8B9A-11D5-EBA1-F78EEEEEE983}\StubPath = "msrbx32.exe"	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9CC5ACBD-8B9A-11D5-EBA1-F78EEEEEE983}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9CC5ACBD-8B9A-11D5-EBA1-F78EEEEEE983}\StubPath = "msrbx32.exe"	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
2268	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
2652	svchost.exe

Loads dropped DLL 3 IoCs

pid	Process
2116	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
2116	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
2116	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe

Modifies system executable filetype association 2 TTPs 3 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*"	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*"	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe"	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe"	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe"	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\concp32.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\Windows\SysWOW64\concp32.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File created	C:\Windows\SysWOW64\vcl32.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\Windows\SysWOW64\vcl32.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File created	C:\Windows\SysWOW64\msrbx32.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\Windows\SysWOW64\msrbx32.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File created	C:\Windows\svchost.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
File opened for modification	C:\Windows\svchost.exe	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies registry class 13 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9CC5ACBD-8B9A-11D5-EBA1-F78EEEEEE983}\u2 = a54a6b702f92fdf2acd57599e2ae1608015dff41aa020117fc9bd8e2dcf4340f3fa61eb55d6f28597df90602703809d4	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9CC5ACBD-8B9A-11D5-EBA1-F78EEEEEE983}\InprocServer32	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9CC5ACBD-8B9A-11D5-EBA1-F78EEEEEE983}\ax = 2f19ba78a37ed77acd229b16e447487d	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9CC5ACBD-8B9A-11D5-EBA1-F78EEEEEE983}	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9CC5ACBD-8B9A-11D5-EBA1-F78EEEEEE983}\u0 = 658663d26f8bad325217a06063847056939f558d910ed252e05dd0113550f7fc0f4da82ff73a0681ba604c2d4f23269f	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9CC5ACBD-8B9A-11D5-EBA1-F78EEEEEE983}\u1 = 551d2e0658054ba756fd3798fea5ffca42865cb762a31639dabd7f2cca44e226	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9CC5ACBD-8B9A-11D5-EBA1-F78EEEEEE983}\v = "165"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9CC5ACBD-8B9A-11D5-EBA1-F78EEEEEE983}	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9CC5ACBD-8B9A-11D5-EBA1-F78EEEEEE983}\sm = ebb5525fa3bcf9422c8ff945977d6af9	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*"	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9CC5ACBD-8B9A-11D5-EBA1-F78EEEEEE983}\InprocServer32	svchost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2268	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2268	2116	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe	30
PID 2116 wrote to memory of 2268	2116	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe	30
PID 2116 wrote to memory of 2268	2116	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe	30
PID 2116 wrote to memory of 2268	2116	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe	30
PID 2268 wrote to memory of 2652	2268	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe	31
PID 2268 wrote to memory of 2652	2268	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe	31
PID 2268 wrote to memory of 2652	2268	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe	31
PID 2268 wrote to memory of 2652	2268	JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\svchost.exe
    C:\Windows\svchost.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Modifies system executable filetype association
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\Windows\svchost.exe

Filesize
297KB

MD5
02ba190e06ccdcd6e5007e6335d66ca7

SHA1
014a165aee85f9e3e76cbf8c944b8daaa824f900

SHA256
ec0ab57fee65ef7278b26d357b268286aa59cf1d831f406dcb9e6e33917e80c4

SHA512
2f36353fad0a001c34d0e62f47595cecfbaf5f0afbf61c9ad4a2e9d1471fba0aebade265cd100b46583f8a16f9f34959d5bf6f7746d44bb4c4fa9a4978421226

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_550dfa6e3f38e3963ae5e578f371d8f0.exe

Filesize
294KB

MD5
0bb7b37dd577878d59f45c8e4091c020

SHA1
32c243aed2d72d135a8a77b04904284166620508

SHA256
bef2cacce7ea3b39e63484ea9ae7399bf0e8cd01e7166093a69cb5dd90a57e59

SHA512
68b6a053e33b72505dad2db77214b1b0ff2a9ce85693fe7445a06418cefb03963f410193a52c4796070ffde6947ceb8b68fb40bf29422ab8f459b7dab2662ffd

Download Submit
memory/2116-4-0x0000000002D40000-0x0000000002D75000-memory.dmp

Filesize
212KB

Download
memory/2116-104-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2268-101-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2652-102-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2652-105-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download