46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107

Analysis

max time kernel
147s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-01-2025 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
Size

99KB
MD5

68bb2bc04c3e1e1c2d88aa6f73285bb0
SHA1

dc00c4fb8e14e11395935b215c86c88e3e72e0eb
SHA256

46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107
SHA512

f610028ac9d39912d62e8dc8e26f9bbe13f061066561999cb40e0b61362bfc249f35829dacb8d4cb12b1622ed729a4afbc7f73f2595d76da65f4e65807c5a276
SSDEEP

3072:elwT11JOsyobBuL7OdhR5rgGuXMQ8oWfz16xK:EwxdbBuLSdlwWoWh6xK

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1656	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
2056	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe

Loads dropped DLL 1 IoCs

pid	Process
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe

Adds Run key to start application 2 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelCore = "C:\\ProgramData\\IntelCore\\IntelCore.exe"	REG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2704	ping.exe
2736	ping.exe
2436	ping.exe
3012	ping.exe
2424	ping.exe
2680	ping.exe
2776	ping.exe
2396	ping.exe
1056	ping.exe
1768	ping.exe
2760	ping.exe
3068	ping.exe
1824	ping.exe
2744	ping.exe
1672	ping.exe
2240	ping.exe
2572	ping.exe
2144	ping.exe
2036	ping.exe
592	ping.exe

Runs ping.exe 1 TTPs 20 IoCs

Remote System Discovery

T1018

pid	Process
2680	ping.exe
2776	ping.exe
2744	ping.exe
2144	ping.exe
2036	ping.exe
2760	ping.exe
2572	ping.exe
2436	ping.exe
1056	ping.exe
1768	ping.exe
1672	ping.exe
2704	ping.exe
1824	ping.exe
2396	ping.exe
2424	ping.exe
2240	ping.exe
592	ping.exe
3068	ping.exe
2736	ping.exe
3012	ping.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 2704	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	30
PID 1268 wrote to memory of 2704	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	30
PID 1268 wrote to memory of 2704	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	30
PID 1268 wrote to memory of 2704	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	30
PID 1268 wrote to memory of 2680	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	32
PID 1268 wrote to memory of 2680	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	32
PID 1268 wrote to memory of 2680	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	32
PID 1268 wrote to memory of 2680	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	32
PID 1268 wrote to memory of 2776	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	34
PID 1268 wrote to memory of 2776	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	34
PID 1268 wrote to memory of 2776	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	34
PID 1268 wrote to memory of 2776	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	34
PID 1268 wrote to memory of 2760	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	36
PID 1268 wrote to memory of 2760	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	36
PID 1268 wrote to memory of 2760	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	36
PID 1268 wrote to memory of 2760	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	36
PID 1268 wrote to memory of 2572	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	38
PID 1268 wrote to memory of 2572	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	38
PID 1268 wrote to memory of 2572	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	38
PID 1268 wrote to memory of 2572	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	38
PID 1268 wrote to memory of 3068	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	40
PID 1268 wrote to memory of 3068	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	40
PID 1268 wrote to memory of 3068	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	40
PID 1268 wrote to memory of 3068	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	40
PID 1268 wrote to memory of 1824	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	42
PID 1268 wrote to memory of 1824	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	42
PID 1268 wrote to memory of 1824	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	42
PID 1268 wrote to memory of 1824	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	42
PID 1268 wrote to memory of 2396	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	44
PID 1268 wrote to memory of 2396	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	44
PID 1268 wrote to memory of 2396	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	44
PID 1268 wrote to memory of 2396	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	44
PID 1268 wrote to memory of 1056	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	46
PID 1268 wrote to memory of 1056	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	46
PID 1268 wrote to memory of 1056	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	46
PID 1268 wrote to memory of 1056	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	46
PID 1268 wrote to memory of 2736	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	48
PID 1268 wrote to memory of 2736	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	48
PID 1268 wrote to memory of 2736	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	48
PID 1268 wrote to memory of 2736	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	48
PID 1268 wrote to memory of 1656	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	50
PID 1268 wrote to memory of 1656	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	50
PID 1268 wrote to memory of 1656	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	50
PID 1268 wrote to memory of 1656	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	50
PID 1268 wrote to memory of 1752	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	52
PID 1268 wrote to memory of 1752	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	52
PID 1268 wrote to memory of 1752	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	52
PID 1268 wrote to memory of 1752	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	52
PID 1268 wrote to memory of 2744	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	53
PID 1268 wrote to memory of 2744	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	53
PID 1268 wrote to memory of 2744	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	53
PID 1268 wrote to memory of 2744	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	53
PID 1268 wrote to memory of 2436	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	56
PID 1268 wrote to memory of 2436	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	56
PID 1268 wrote to memory of 2436	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	56
PID 1268 wrote to memory of 2436	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	56
PID 1268 wrote to memory of 1768	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	58
PID 1268 wrote to memory of 1768	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	58
PID 1268 wrote to memory of 1768	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	58
PID 1268 wrote to memory of 1768	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	58
PID 1268 wrote to memory of 3012	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	60
PID 1268 wrote to memory of 3012	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	60
PID 1268 wrote to memory of 3012	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	60
PID 1268 wrote to memory of 3012	1268	JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe	60

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1656	attrib.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2704
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2680
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2776
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2760
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2572
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3068
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1824
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2396
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1056
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2736
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
  2⤵
  - Sets file to hidden
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1656
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1752
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2744
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2436
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1768
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3012
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2144
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2424
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2036
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1672
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2240
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:592
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe"
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1728
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1792
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1192
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2024
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1608
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2804
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2672
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2012
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2616
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2180
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2128
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2612
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2868
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2912
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2932
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1264
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2408
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IntelCore" /t REG_SZ /F /D "C:\ProgramData\IntelCore\IntelCore.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\IntelCore\IntelCore.exe

Filesize
99KB

MD5
7ea97e8c5b138bc6ea553479f3ab88a6

SHA1
9ae0d5cbffebba6cd627948c8d747ff21d60e4d2

SHA256
6dbe48e6843b9d69c5889205c463255c3689dda704bac2bd4cb4f1b045147e7c

SHA512
5cd301a7ef0e647c1782aba9817fa2f23f4b163bc88e7c0d6d8f9ee679149e623556405a3708bd258d16b576eb2fd4e7a0b2d1bf525db6770aa0a592d8c6fb00

Download Submit
\Users\Admin\AppData\Local\Temp\JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0.exe

Filesize
99KB

MD5
68bb2bc04c3e1e1c2d88aa6f73285bb0

SHA1
dc00c4fb8e14e11395935b215c86c88e3e72e0eb

SHA256
46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107

SHA512
f610028ac9d39912d62e8dc8e26f9bbe13f061066561999cb40e0b61362bfc249f35829dacb8d4cb12b1622ed729a4afbc7f73f2595d76da65f4e65807c5a276

Download Submit
memory/1268-2-0x0000000074D20000-0x00000000752CB000-memory.dmp

Filesize
5.7MB

Download
memory/1268-1-0x0000000074D20000-0x00000000752CB000-memory.dmp

Filesize
5.7MB

Download
memory/1268-0-0x0000000074D21000-0x0000000074D22000-memory.dmp

Filesize
4KB

Download
memory/1268-3-0x0000000074D20000-0x00000000752CB000-memory.dmp

Filesize
5.7MB

Download