vjw0rm | c7f975e39d71c09f26329414e6e790b2df26808e88529845996c889726af65ff

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/01/2025, 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe
Size

1.4MB
MD5

0b8890e56e80bbdd1502cf079ce7583a
SHA1

dd2898e0e29e621e61f94b09b208daa77d3a916a
SHA256

c7f975e39d71c09f26329414e6e790b2df26808e88529845996c889726af65ff
SHA512

bd35e0ecddfc7f132f7eccd33d5abe40ff92ab129723110a1c5d11decc291af30857d05786beb16cf03401ae824ca6f5b4be6820fa1291b42cc956e6ef21b793
SSDEEP

24576:x2G/nvxW3WQN2mfFT+LCT7c7gapLtf5UjGgBLEA2NGAQ04tgYXltpcCK5sjmRSPu:xbA39/YL87cZ9tf5UjGgBAA2NTcDlD56

Score

10^/10

vjw0rm discovery evasion execution persistence trojan upx worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm
Vjw0rm family
vjw0rm

Blocklisted process makes network request 6 IoCs

flow	pid	Process
6	2468	WScript.exe
12	2468	WScript.exe
25	2468	WScript.exe
28	2468	WScript.exe
31	2468	WScript.exe
34	2468	WScript.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\info.js	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
2464	setup.exe

Loads dropped DLL 4 IoCs

pid	Process
2612	JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe
2612	JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe
2612	JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe
2612	JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\WEHHRB8F7I = "\"C:\\Users\\Admin\\AppData\\Roaming\\info.js\""	WScript.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	setup.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000d0000000122e4-7.dat	upx
behavioral1/memory/2464-23-0x0000000001080000-0x00000000013D2000-memory.dmp	upx
behavioral1/memory/2612-18-0x0000000004330000-0x0000000004682000-memory.dmp	upx
behavioral1/memory/2464-65-0x0000000001080000-0x00000000013D2000-memory.dmp	upx
behavioral1/memory/2464-68-0x0000000001080000-0x00000000013D2000-memory.dmp	upx
behavioral1/memory/2464-69-0x0000000001080000-0x00000000013D2000-memory.dmp	upx
behavioral1/memory/2464-84-0x0000000001080000-0x00000000013D2000-memory.dmp	upx
behavioral1/memory/2464-86-0x0000000001080000-0x00000000013D2000-memory.dmp	upx
behavioral1/memory/2464-87-0x0000000001080000-0x00000000013D2000-memory.dmp	upx
behavioral1/memory/2464-90-0x0000000001080000-0x00000000013D2000-memory.dmp	upx
behavioral1/memory/2464-91-0x0000000001080000-0x00000000013D2000-memory.dmp	upx
behavioral1/memory/2464-93-0x0000000001080000-0x00000000013D2000-memory.dmp	upx
behavioral1/memory/2464-94-0x0000000001080000-0x00000000013D2000-memory.dmp	upx
behavioral1/memory/2464-96-0x0000000001080000-0x00000000013D2000-memory.dmp	upx
behavioral1/memory/2464-97-0x0000000001080000-0x00000000013D2000-memory.dmp	upx
behavioral1/memory/2464-99-0x0000000001080000-0x00000000013D2000-memory.dmp	upx
behavioral1/memory/2464-100-0x0000000001080000-0x00000000013D2000-memory.dmp	upx

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c004346534616003100000000002359ac29122041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe2359ac292359ac292a000000ed0100000000020000000000000000000000000000004100700070004400610074006100000042000000	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000002359e72a10204c6f63616c00380008000400efbe2359ac292359e72a2a000000000200000000020000000000000000000000000000004c006f00630061006c00000014000000	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a00310000000000265a121b102054656d700000360008000400efbe2359ac29265a121b2a00000001020000000002000000000000000000000000000000540065006d007000000014000000	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	setup.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	setup.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2540	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2464	setup.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	setup.exe
Token: SeLoadDriverPrivilege	2464	setup.exe
Token: SeLoadDriverPrivilege	2464	setup.exe
Token: SeLoadDriverPrivilege	2464	setup.exe
Token: SeLoadDriverPrivilege	2464	setup.exe
Token: SeLoadDriverPrivilege	2464	setup.exe
Token: SeLoadDriverPrivilege	2464	setup.exe
Token: SeLoadDriverPrivilege	2464	setup.exe
Token: SeLoadDriverPrivilege	2464	setup.exe
Token: SeLoadDriverPrivilege	2464	setup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2464	setup.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2464	setup.exe
2464	setup.exe
2464	setup.exe
2464	setup.exe
2464	setup.exe
2464	setup.exe
2464	setup.exe
2464	setup.exe
2464	setup.exe
2464	setup.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2468	2612	JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe	31
PID 2612 wrote to memory of 2468	2612	JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe	31
PID 2612 wrote to memory of 2468	2612	JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe	31
PID 2612 wrote to memory of 2468	2612	JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe	31
PID 2612 wrote to memory of 2464	2612	JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe	32
PID 2612 wrote to memory of 2464	2612	JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe	32
PID 2612 wrote to memory of 2464	2612	JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe	32
PID 2612 wrote to memory of 2464	2612	JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe	32
PID 2612 wrote to memory of 2464	2612	JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe	32
PID 2612 wrote to memory of 2464	2612	JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe	32
PID 2612 wrote to memory of 2464	2612	JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe	32
PID 2468 wrote to memory of 2540	2468	WScript.exe	34
PID 2468 wrote to memory of 2540	2468	WScript.exe	34
PID 2468 wrote to memory of 2540	2468	WScript.exe	34
PID 2468 wrote to memory of 2540	2468	WScript.exe	34

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b8890e56e80bbdd1502cf079ce7583a.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\info.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn anydesk /tr "C:\Users\Admin\AppData\Roaming\info.js
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2540
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\info.js

Filesize
36KB

MD5
9fabf10537549747efbbb6281dce1a91

SHA1
4590a323576f86471b3d6b8b841762fc33c6e4b2

SHA256
a8e7fa03686c4354002c14b61047318fc4e7b654ffab72cf2bb814d13c2d2205

SHA512
01d41222e055e98841415d4aaa55ef16323e2c443273e9ca8b3e5f02ecdf2b3fd583b0b4e8fa7760404a1a154ca2b55f22441d667e41783a131786d22d995e6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\rufus.ini

Filesize
41B

MD5
6a31c51caaf3cee2f2311da6e28a5243

SHA1
194327e34003e8403860eb7fdee88230597a97b3

SHA256
cccc06458b80740283818ca27a5f225795c85adbf0cae3b4fcfd200da64a0952

SHA512
fd5b54f0f8be68abfdec00a02e717d89bf13ab0c31a075e1a839a49ac25e522362b741a5ee453c96b18f11aa6c2ed8589ca4b20d3e29424c78610e4fba7c9faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\rufus.ini

Filesize
70B

MD5
76e0c538f286b0ec44e6142894181b12

SHA1
e299a701eea23fcba9d2271ef10085b1c1fc2725

SHA256
87d182b4d879521625c5ea2fedf23cb1970b0d9c26e954b25f3b325958cef45a

SHA512
31fa2dc5e5cb03d4f509b18017327b053dfdb5adb379375438a610696f03975e71c2a5409b8236224e479a339e2980351bd7a8c6fcb84c9c651e28e1af9505b4

Download Submit
\Users\Admin\AppData\Local\Temp\setup.exe

Filesize
1.1MB

MD5
c1df434cf15aeb31783e1144b8a30059

SHA1
1c385ec41d5f20ab411bd20e792ad8e7da7feaf9

SHA256
c0ccf4f480545b50169cc1f5bf92b357ce588520cb8534128200ca48fc6ae588

SHA512
7dcdd37b831c3e6d54ea5cb74e5308ead0ac3a344a94f40d70b1ad72746a830d0109ed3ddebd4fa6dc8a3cd8352545dd81164a1cff6fdbbcc9ed3312ecbe76f4

Download Submit
memory/2464-90-0x0000000001080000-0x00000000013D2000-memory.dmp

Filesize
3.3MB

Download
memory/2464-86-0x0000000001080000-0x00000000013D2000-memory.dmp

Filesize
3.3MB

Download
memory/2464-100-0x0000000001080000-0x00000000013D2000-memory.dmp

Filesize
3.3MB

Download
memory/2464-99-0x0000000001080000-0x00000000013D2000-memory.dmp

Filesize
3.3MB

Download
memory/2464-65-0x0000000001080000-0x00000000013D2000-memory.dmp

Filesize
3.3MB

Download
memory/2464-66-0x0000000005DF0000-0x0000000005DF2000-memory.dmp

Filesize
8KB

Download
memory/2464-68-0x0000000001080000-0x00000000013D2000-memory.dmp

Filesize
3.3MB

Download
memory/2464-69-0x0000000001080000-0x00000000013D2000-memory.dmp

Filesize
3.3MB

Download
memory/2464-84-0x0000000001080000-0x00000000013D2000-memory.dmp

Filesize
3.3MB

Download
memory/2464-97-0x0000000001080000-0x00000000013D2000-memory.dmp

Filesize
3.3MB

Download
memory/2464-87-0x0000000001080000-0x00000000013D2000-memory.dmp

Filesize
3.3MB

Download
memory/2464-23-0x0000000001080000-0x00000000013D2000-memory.dmp

Filesize
3.3MB

Download
memory/2464-91-0x0000000001080000-0x00000000013D2000-memory.dmp

Filesize
3.3MB

Download
memory/2464-93-0x0000000001080000-0x00000000013D2000-memory.dmp

Filesize
3.3MB

Download
memory/2464-94-0x0000000001080000-0x00000000013D2000-memory.dmp

Filesize
3.3MB

Download
memory/2464-96-0x0000000001080000-0x00000000013D2000-memory.dmp

Filesize
3.3MB

Download
memory/2612-18-0x0000000004330000-0x0000000004682000-memory.dmp

Filesize
3.3MB

Download
memory/2612-20-0x0000000004330000-0x0000000004682000-memory.dmp

Filesize
3.3MB

Download
memory/2612-19-0x0000000004330000-0x0000000004682000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads