Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-01-2025 12:27
Behavioral task
behavioral1
Sample
JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe
Resource
win7-20240729-en
windows7-x64
27 signatures
150 seconds
General
-
Target
JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe
-
Size
374KB
-
MD5
6c9f7afb7c09c420a413b5f7f2c5cdb0
-
SHA1
bc05b30655eee5f223c9f0d634ba354b8f585486
-
SHA256
87a862ecd148181c318d98a64f0cb24ae19d1ebcabf379f0d8254181ffb2cd0b
-
SHA512
c5cd584abd1c3ce3aea2ac52713d46bfa241ad50f1be32e8ca20aee373b7c163aee7797b4a2b53e5ae06f3647331dc95cbb382ceac1f4c9170cce3008c14113f
-
SSDEEP
6144:HcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37yEAvDNeqQeld94a3ovBa0:HcW7KEZlPzCy37MDN18vV
Malware Config
Extracted
Family
darkcomet
Botnet
kazantip
C2
93.116.48.67:27015
Mutex
DC_MUTEX-9FW9Z8Q
Attributes
-
InstallPath
winlogon\winlogon.exe
-
gencode
gpLuj6pfvQbs
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
winlogon.exe
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\winlogon\\winlogon.exe" JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile winlogon.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" winlogon.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" winlogon.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" winlogon.exe -
Ramnit family
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winlogon.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winlogon.exe -
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe -
Executes dropped EXE 5 IoCs
pid Process 2052 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0Srv.exe 1904 DesktopLayer.exe 3788 winlogon.exe 2208 winlogonSrv.exe 1336 DesktopLayer.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winlogon.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon.exe = "C:\\Windows\\system32\\winlogon\\winlogon.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon.exe = "C:\\Windows\\system32\\winlogon\\winlogon.exe" JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\winlogon\winlogonSrv.exe winlogon.exe File created C:\Windows\SysWOW64\winlogon\winlogon.exe JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe File opened for modification C:\Windows\SysWOW64\winlogon\winlogon.exe JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe File opened for modification C:\Windows\SysWOW64\winlogon\ JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe -
resource yara_rule behavioral2/memory/4608-0-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral2/files/0x000a000000023c09-3.dat upx behavioral2/memory/2052-4-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2052-9-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1904-16-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1904-13-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4608-11-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral2/memory/4608-19-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral2/memory/1904-20-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/files/0x0007000000023cb6-24.dat upx behavioral2/memory/3788-81-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral2/memory/2208-87-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4608-95-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral2/memory/3788-96-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral2/memory/3788-112-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral2/memory/3788-114-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral2/memory/3788-126-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral2/memory/3788-128-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral2/memory/3788-132-0x0000000000400000-0x00000000004E7000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\pxAEED.tmp JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\pxB1EB.tmp winlogonSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe winlogonSrv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogonSrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DesktopLayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0Srv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DesktopLayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4048383018" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31153626" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31153626" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4055101675" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31153626" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1CC9A665-C9CE-11EF-BEF1-EE81E66BE9E9} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31153626" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4049476597" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442672230" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4048383018" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31153626" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4049476597" IEXPLORE.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1904 DesktopLayer.exe 1904 DesktopLayer.exe 1904 DesktopLayer.exe 1904 DesktopLayer.exe 1904 DesktopLayer.exe 1904 DesktopLayer.exe 1904 DesktopLayer.exe 1904 DesktopLayer.exe 1336 DesktopLayer.exe 1336 DesktopLayer.exe 1336 DesktopLayer.exe 1336 DesktopLayer.exe 1336 DesktopLayer.exe 1336 DesktopLayer.exe 1336 DesktopLayer.exe 1336 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3788 winlogon.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeSecurityPrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeTakeOwnershipPrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeLoadDriverPrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeSystemProfilePrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeSystemtimePrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeProfSingleProcessPrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeIncBasePriorityPrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeCreatePagefilePrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeBackupPrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeRestorePrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeShutdownPrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeDebugPrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeSystemEnvironmentPrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeChangeNotifyPrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeRemoteShutdownPrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeUndockPrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeManageVolumePrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeImpersonatePrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeCreateGlobalPrivilege 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: 33 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: 34 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: 35 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: 36 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe Token: SeIncreaseQuotaPrivilege 3788 winlogon.exe Token: SeSecurityPrivilege 3788 winlogon.exe Token: SeTakeOwnershipPrivilege 3788 winlogon.exe Token: SeLoadDriverPrivilege 3788 winlogon.exe Token: SeSystemProfilePrivilege 3788 winlogon.exe Token: SeSystemtimePrivilege 3788 winlogon.exe Token: SeProfSingleProcessPrivilege 3788 winlogon.exe Token: SeIncBasePriorityPrivilege 3788 winlogon.exe Token: SeCreatePagefilePrivilege 3788 winlogon.exe Token: SeBackupPrivilege 3788 winlogon.exe Token: SeRestorePrivilege 3788 winlogon.exe Token: SeShutdownPrivilege 3788 winlogon.exe Token: SeDebugPrivilege 3788 winlogon.exe Token: SeSystemEnvironmentPrivilege 3788 winlogon.exe Token: SeChangeNotifyPrivilege 3788 winlogon.exe Token: SeRemoteShutdownPrivilege 3788 winlogon.exe Token: SeUndockPrivilege 3788 winlogon.exe Token: SeManageVolumePrivilege 3788 winlogon.exe Token: SeImpersonatePrivilege 3788 winlogon.exe Token: SeCreateGlobalPrivilege 3788 winlogon.exe Token: 33 3788 winlogon.exe Token: 34 3788 winlogon.exe Token: 35 3788 winlogon.exe Token: 36 3788 winlogon.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3340 iexplore.exe 3340 iexplore.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 3340 iexplore.exe 3340 iexplore.exe 1084 IEXPLORE.EXE 1084 IEXPLORE.EXE 3788 winlogon.exe 3340 iexplore.exe 3340 iexplore.exe 4732 IEXPLORE.EXE 4732 IEXPLORE.EXE 4732 IEXPLORE.EXE 4732 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4608 wrote to memory of 2052 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe 82 PID 4608 wrote to memory of 2052 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe 82 PID 4608 wrote to memory of 2052 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe 82 PID 2052 wrote to memory of 1904 2052 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0Srv.exe 83 PID 2052 wrote to memory of 1904 2052 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0Srv.exe 83 PID 2052 wrote to memory of 1904 2052 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0Srv.exe 83 PID 1904 wrote to memory of 3340 1904 DesktopLayer.exe 84 PID 1904 wrote to memory of 3340 1904 DesktopLayer.exe 84 PID 3340 wrote to memory of 1084 3340 iexplore.exe 85 PID 3340 wrote to memory of 1084 3340 iexplore.exe 85 PID 3340 wrote to memory of 1084 3340 iexplore.exe 85 PID 4608 wrote to memory of 3788 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe 86 PID 4608 wrote to memory of 3788 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe 86 PID 4608 wrote to memory of 3788 4608 JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe 86 PID 3788 wrote to memory of 2208 3788 winlogon.exe 87 PID 3788 wrote to memory of 2208 3788 winlogon.exe 87 PID 3788 wrote to memory of 2208 3788 winlogon.exe 87 PID 2208 wrote to memory of 1336 2208 winlogonSrv.exe 88 PID 2208 wrote to memory of 1336 2208 winlogonSrv.exe 88 PID 2208 wrote to memory of 1336 2208 winlogonSrv.exe 88 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 3788 wrote to memory of 1924 3788 winlogon.exe 89 PID 1336 wrote to memory of 3488 1336 DesktopLayer.exe 90 PID 1336 wrote to memory of 3488 1336 DesktopLayer.exe 90 PID 3340 wrote to memory of 4732 3340 iexplore.exe 91 PID 3340 wrote to memory of 4732 3340 iexplore.exe 91 PID 3340 wrote to memory of 4732 3340 iexplore.exe 91 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion winlogon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0Srv.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c9f7afb7c09c420a413b5f7f2c5cdb0Srv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3340 CREDAT:17410 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1084
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3340 CREDAT:17414 /prefetch:25⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4732
-
-
-
-
-
C:\Windows\SysWOW64\winlogon\winlogon.exe"C:\Windows\system32\winlogon\winlogon.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3788 -
C:\Windows\SysWOW64\winlogon\winlogonSrv.exeC:\Windows\SysWOW64\winlogon\winlogonSrv.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
PID:3488
-
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:1924
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD58fad2e07a4c7a80a9b50d87e76420c29
SHA17faa7310d52e1b97b5f7597dda3fa439f4ec04d8
SHA256be210b4b624d55d076fdc5b6d9f6b98acb116c646e43c56e52790d910bca942d
SHA512459a02e6817f3ba0a1edc2590a266a772127f39f651c9a5ee1170fbaefedeadff6a6ff948f97ed09670413dabe611c2c34e00e7600b4ff501455c35776da7895
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD52430a24a6d74e4b26526ae77b8936e2c
SHA1de5d06d267b1e737bc6feaa3264424eba165308a
SHA256a88ec6911f1e32d444cbb735d31d2150ca987eb8fb5a6c60e25a6226625a8a39
SHA5129601d57b242189d8ba8208fadf4cb9b78e666c965f56a0de396595794edc41badb933bf8c50210c8cdb4be7c736be3cf2e35a503d92d709468309777bed87a6f
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
Filesize
374KB
MD56c9f7afb7c09c420a413b5f7f2c5cdb0
SHA1bc05b30655eee5f223c9f0d634ba354b8f585486
SHA25687a862ecd148181c318d98a64f0cb24ae19d1ebcabf379f0d8254181ffb2cd0b
SHA512c5cd584abd1c3ce3aea2ac52713d46bfa241ad50f1be32e8ca20aee373b7c163aee7797b4a2b53e5ae06f3647331dc95cbb382ceac1f4c9170cce3008c14113f