vobfus | 4b851113292f65082ba1d64244c0384cfaa39301adb582e394af13fe5bececa6

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/01/2025, 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe
Size

524KB
MD5

e18ab1e385fcc3f1b44bf51c070c7f95
SHA1

abe55c2ceed151682ef9c27a457ec29791b7c01e
SHA256

4b851113292f65082ba1d64244c0384cfaa39301adb582e394af13fe5bececa6
SHA512

614ea4b4ceaf8fad69a8600e6dd03db4fbe28d212a649c9a363146e5c5b71c55cb79255fce69d783536d21ecf23f6f37aba6daa1017b5c047d80f9c6d8b7a437
SSDEEP

12288:l6N+HfWXmO2AyBZ1BYoheKmBXwc2zR85SAHtO:3OXQ3BZbYownJuQSAHtO

Score

10^/10

vobfus bootkit defense_evasion discovery persistence upx worm

Malware Config

Signatures

Vobfus
A widespread worm which spreads via network drives and removable media.
worm vobfus
Vobfus family
vobfus

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run	shop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\update = "C:\\Users\\Admin\\AppData\\Roaming\\update.exe"	shop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	new.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Google Update = "C:\\Users\\Admin\\AppData\\Roaming\\new.exe"	new.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	shop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\update = "C:\\Users\\Admin\\AppData\\Roaming\\update.exe"	shop.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6FC5627A-98DF-BBEB-BBDA-79DBC6AEBDE4}	new.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6FC5627A-98DF-BBEB-BBDA-79DBC6AEBDE4}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\new.exe"	new.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{6FC5627A-98DF-BBEB-BBDA-79DBC6AEBDE4}	new.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{6FC5627A-98DF-BBEB-BBDA-79DBC6AEBDE4}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\new.exe"	new.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ntsvc32\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rootkit-uncrypted.exe"	rootkit-uncrypted.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe

Executes dropped EXE 4 IoCs

pid	Process
1812	shop.exe
4432	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
3464	new.exe

Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Safeboot\Minimal\ntsvc32	rootkit-uncrypted.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Update = "C:\\Users\\Admin\\AppData\\Roaming\\new.exe"	new.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Roaming\\update.exe"	shop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Roaming\\update.exe"	shop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Google Update = "C:\\Users\\Admin\\AppData\\Roaming\\new.exe"	new.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2692 set thread context of 4940	2692	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	87

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023c9e-13.dat	upx
behavioral2/memory/1812-23-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/files/0x0007000000023ca0-35.dat	upx
behavioral2/memory/3464-42-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1812-71-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/3464-94-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/1812-97-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/3464-98-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3464-104-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3464-128-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3464-149-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3464-191-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3464-216-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral2/memory/3464-236-0x0000000000400000-0x0000000000473000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rootkit-uncrypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rootkit-uncrypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	new.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	23	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	42	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	50	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe
4960	rootkit-uncrypted.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	rootkit-uncrypted.exe
Token: SeDebugPrivilege	4960	rootkit-uncrypted.exe
Token: 1	3464	new.exe
Token: SeCreateTokenPrivilege	3464	new.exe
Token: SeAssignPrimaryTokenPrivilege	3464	new.exe
Token: SeLockMemoryPrivilege	3464	new.exe
Token: SeIncreaseQuotaPrivilege	3464	new.exe
Token: SeMachineAccountPrivilege	3464	new.exe
Token: SeTcbPrivilege	3464	new.exe
Token: SeSecurityPrivilege	3464	new.exe
Token: SeTakeOwnershipPrivilege	3464	new.exe
Token: SeLoadDriverPrivilege	3464	new.exe
Token: SeSystemProfilePrivilege	3464	new.exe
Token: SeSystemtimePrivilege	3464	new.exe
Token: SeProfSingleProcessPrivilege	3464	new.exe
Token: SeIncBasePriorityPrivilege	3464	new.exe
Token: SeCreatePagefilePrivilege	3464	new.exe
Token: SeCreatePermanentPrivilege	3464	new.exe
Token: SeBackupPrivilege	3464	new.exe
Token: SeRestorePrivilege	3464	new.exe
Token: SeShutdownPrivilege	3464	new.exe
Token: SeDebugPrivilege	3464	new.exe
Token: SeAuditPrivilege	3464	new.exe
Token: SeSystemEnvironmentPrivilege	3464	new.exe
Token: SeChangeNotifyPrivilege	3464	new.exe
Token: SeRemoteShutdownPrivilege	3464	new.exe
Token: SeUndockPrivilege	3464	new.exe
Token: SeSyncAgentPrivilege	3464	new.exe
Token: SeEnableDelegationPrivilege	3464	new.exe
Token: SeManageVolumePrivilege	3464	new.exe
Token: SeImpersonatePrivilege	3464	new.exe
Token: SeCreateGlobalPrivilege	3464	new.exe
Token: 31	3464	new.exe
Token: 32	3464	new.exe
Token: 33	3464	new.exe
Token: 34	3464	new.exe
Token: 35	3464	new.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2692	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe
4940	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe
1812	shop.exe
3464	new.exe
3464	new.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 4940	2692	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	87
PID 2692 wrote to memory of 4940	2692	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	87
PID 2692 wrote to memory of 4940	2692	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	87
PID 2692 wrote to memory of 4940	2692	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	87
PID 2692 wrote to memory of 4940	2692	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	87
PID 2692 wrote to memory of 4940	2692	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	87
PID 2692 wrote to memory of 4940	2692	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	87
PID 2692 wrote to memory of 4940	2692	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	87
PID 4940 wrote to memory of 1812	4940	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	88
PID 4940 wrote to memory of 1812	4940	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	88
PID 4940 wrote to memory of 1812	4940	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	88
PID 4940 wrote to memory of 4432	4940	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	89
PID 4940 wrote to memory of 4432	4940	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	89
PID 4940 wrote to memory of 4432	4940	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	89
PID 4940 wrote to memory of 3464	4940	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	90
PID 4940 wrote to memory of 3464	4940	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	90
PID 4940 wrote to memory of 3464	4940	JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe	90
PID 4960 wrote to memory of 620	4960	rootkit-uncrypted.exe	5
PID 4960 wrote to memory of 676	4960	rootkit-uncrypted.exe	7
PID 4960 wrote to memory of 796	4960	rootkit-uncrypted.exe	8
PID 4960 wrote to memory of 804	4960	rootkit-uncrypted.exe	9
PID 4960 wrote to memory of 812	4960	rootkit-uncrypted.exe	10
PID 4960 wrote to memory of 916	4960	rootkit-uncrypted.exe	11
PID 4960 wrote to memory of 968	4960	rootkit-uncrypted.exe	12
PID 4960 wrote to memory of 376	4960	rootkit-uncrypted.exe	13
PID 4960 wrote to memory of 392	4960	rootkit-uncrypted.exe	14
PID 4960 wrote to memory of 1028	4960	rootkit-uncrypted.exe	15
PID 4960 wrote to memory of 1084	4960	rootkit-uncrypted.exe	16
PID 4960 wrote to memory of 1108	4960	rootkit-uncrypted.exe	17
PID 4960 wrote to memory of 1132	4960	rootkit-uncrypted.exe	18
PID 4960 wrote to memory of 1152	4960	rootkit-uncrypted.exe	19
PID 4960 wrote to memory of 1200	4960	rootkit-uncrypted.exe	20
PID 4960 wrote to memory of 1268	4960	rootkit-uncrypted.exe	21
PID 4960 wrote to memory of 1336	4960	rootkit-uncrypted.exe	22
PID 4960 wrote to memory of 1376	4960	rootkit-uncrypted.exe	23
PID 4960 wrote to memory of 1412	4960	rootkit-uncrypted.exe	24
PID 4960 wrote to memory of 1420	4960	rootkit-uncrypted.exe	25
PID 4960 wrote to memory of 1540	4960	rootkit-uncrypted.exe	26
PID 4960 wrote to memory of 1556	4960	rootkit-uncrypted.exe	27
PID 4960 wrote to memory of 1616	4960	rootkit-uncrypted.exe	28
PID 4960 wrote to memory of 1764	4960	rootkit-uncrypted.exe	29
PID 4960 wrote to memory of 1792	4960	rootkit-uncrypted.exe	30
PID 4960 wrote to memory of 1800	4960	rootkit-uncrypted.exe	31
PID 4960 wrote to memory of 1888	4960	rootkit-uncrypted.exe	32
PID 4960 wrote to memory of 2024	4960	rootkit-uncrypted.exe	33
PID 4960 wrote to memory of 2032	4960	rootkit-uncrypted.exe	34
PID 4960 wrote to memory of 316	4960	rootkit-uncrypted.exe	35
PID 4960 wrote to memory of 1828	4960	rootkit-uncrypted.exe	36
PID 4960 wrote to memory of 2084	4960	rootkit-uncrypted.exe	37
PID 4960 wrote to memory of 2096	4960	rootkit-uncrypted.exe	38
PID 4960 wrote to memory of 2200	4960	rootkit-uncrypted.exe	39
PID 4960 wrote to memory of 2264	4960	rootkit-uncrypted.exe	40
PID 4960 wrote to memory of 2332	4960	rootkit-uncrypted.exe	41
PID 4960 wrote to memory of 2552	4960	rootkit-uncrypted.exe	42
PID 4960 wrote to memory of 2580	4960	rootkit-uncrypted.exe	43
PID 4960 wrote to memory of 2652	4960	rootkit-uncrypted.exe	44
PID 4960 wrote to memory of 2660	4960	rootkit-uncrypted.exe	45
PID 4960 wrote to memory of 2760	4960	rootkit-uncrypted.exe	46
PID 4960 wrote to memory of 2780	4960	rootkit-uncrypted.exe	47
PID 4960 wrote to memory of 2796	4960	rootkit-uncrypted.exe	48
PID 4960 wrote to memory of 2848	4960	rootkit-uncrypted.exe	49
PID 4960 wrote to memory of 2872	4960	rootkit-uncrypted.exe	50
PID 4960 wrote to memory of 2912	4960	rootkit-uncrypted.exe	51
PID 4960 wrote to memory of 2924	4960	rootkit-uncrypted.exe	52

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:804
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:376

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:812
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:3140
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3836
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3928
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3992
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:4088
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3676
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3912
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4880
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:1744
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:212
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1152
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1420
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2552

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1792

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2084

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2848

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3280

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3452
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e18ab1e385fcc3f1b44bf51c070c7f95.exe"
    3⤵
    - Checks computer location settings
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\shop.exe
      "C:\Users\Admin\AppData\Local\Temp\shop.exe"
      4⤵
      Adds policy Run key to start application
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\rootkit-uncrypted.exe
      "C:\Users\Admin\AppData\Local\Temp\rootkit-uncrypted.exe"
      4⤵
      Sets service image path in registry
      Executes dropped EXE
      Impair Defenses: Safe Mode Boot
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\new.exe
      "C:\Users\Admin\AppData\Local\Temp\new.exe"
      4⤵
      Adds policy Run key to start application
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3308

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:668

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe d0af439191bf25cdc3f5e35cef04f885 PjaEOlRK3UeBPkLH7JaGjw.0.1.0.0.0
1⤵
PID:1872
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:3432

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:436

C:\Users\Admin\AppData\Local\Temp\rootkit-uncrypted.exe
C:\Users\Admin\AppData\Local\Temp\rootkit-uncrypted.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\new.exe

Filesize
162KB

MD5
509afdca541092555e6a07b42549fdf2

SHA1
eed6f0db04fc21c7dc1e6efba85c64265ef8c837

SHA256
c1a4274d740018703e69dc45202fd811c425df531ce41276486e538a7ac210ed

SHA512
c0355e7b2295fee5784a378bab502fb4eafffffd42a3d258a836ae43fa42d5e49166025173cf311672c81bbf32b10572beebbae4df5604ca3f4884429928a16e

Download Submit
C:\Users\Admin\AppData\Local\Temp\rootkit-uncrypted.exe

Filesize
66KB

MD5
da8b7ef46030c3ff3253924e669cce2b

SHA1
094407e3b46b429cca656322580aed93850deb9d

SHA256
3e32e3b51345bef4ded1803099101cf2234180791658f0da242b3a18f9d73aba

SHA512
c74c6e08cfa83cbeb0cdc5b87ccb334050ca975b9e3d50349fa43347099b8301beb1cc528d6d1498d3ea19e4579735ae147233b464026e9583e02d5145a0394e

Download Submit
C:\Users\Admin\AppData\Local\Temp\shop.exe

Filesize
63KB

MD5
1f83f55d3a5c4a301004a795e56cf34f

SHA1
79e3a31ffe727999c005cf9913c16a6497a20440

SHA256
93f017d1c22d38951513b0dd456529e2d11bfc00d3c5df151ad052a617b0835e

SHA512
62ad5aecdd32a102bfcd6dd467558d0055c5bb1e01baed8ff5399b7ee695b7491d02e65cb3165cd96d40ca901eeb8b4de4e809487fc47d12f6bdefb52d718301

Download Submit
memory/1812-65-0x000000007FD60000-0x000000007FD61000-memory.dmp

Filesize
4KB

Download
memory/1812-62-0x000000007FD90000-0x000000007FD91000-memory.dmp

Filesize
4KB

Download
memory/1812-97-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1812-71-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1812-70-0x000000007FD10000-0x000000007FD11000-memory.dmp

Filesize
4KB

Download
memory/1812-60-0x000000007FDB0000-0x000000007FDB1000-memory.dmp

Filesize
4KB

Download
memory/1812-56-0x000000007FDF0000-0x000000007FDF1000-memory.dmp

Filesize
4KB

Download
memory/1812-55-0x000000007FE00000-0x000000007FE01000-memory.dmp

Filesize
4KB

Download
memory/1812-54-0x000000007FE10000-0x000000007FE11000-memory.dmp

Filesize
4KB

Download
memory/1812-58-0x000000007FDD0000-0x000000007FDD1000-memory.dmp

Filesize
4KB

Download
memory/1812-57-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

Filesize
4KB

Download
memory/1812-69-0x000000007FD20000-0x000000007FD21000-memory.dmp

Filesize
4KB

Download
memory/1812-68-0x000000007FD30000-0x000000007FD31000-memory.dmp

Filesize
4KB

Download
memory/1812-64-0x000000007FD70000-0x000000007FD71000-memory.dmp

Filesize
4KB

Download
memory/1812-63-0x000000007FD80000-0x000000007FD81000-memory.dmp

Filesize
4KB

Download
memory/1812-61-0x000000007FDA0000-0x000000007FDA1000-memory.dmp

Filesize
4KB

Download
memory/1812-59-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

Filesize
4KB

Download
memory/1812-67-0x000000007FD40000-0x000000007FD41000-memory.dmp

Filesize
4KB

Download
memory/1812-23-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1812-66-0x000000007FD50000-0x000000007FD51000-memory.dmp

Filesize
4KB

Download
memory/3464-104-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3464-236-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3464-216-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3464-191-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3464-93-0x000000007FCF0000-0x000000007FCF1000-memory.dmp

Filesize
4KB

Download
memory/3464-42-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3464-92-0x000000007FD00000-0x000000007FD01000-memory.dmp

Filesize
4KB

Download
memory/3464-149-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3464-128-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3464-94-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/3464-98-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4940-44-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4940-6-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4940-49-0x000000007FE30000-0x000000007FE31000-memory.dmp

Filesize
4KB

Download
memory/4940-50-0x000000007FE20000-0x000000007FE21000-memory.dmp

Filesize
4KB

Download
memory/4940-48-0x000000007FE40000-0x000000007FE41000-memory.dmp

Filesize
4KB

Download
memory/4940-3-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download