Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 20:35
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe
-
Size
844KB
-
MD5
4374ffe3395196ca313993c5b6337d2e
-
SHA1
a52a9c1ac7f67a844a3299fbb170f067ffdd4758
-
SHA256
36bb9292501433a0931ca14fc3e32cf8ced0c83da8a32b6bdc2e39e1fb6de157
-
SHA512
3fbe39cd0819cdc1554908b75e521c8924f3dbb466c9ca262a412618d6a4be2460729d92c55df9d5e6b4cb41ea41f2a9fcb6032fb61da2b75d43012569d5a806
-
SSDEEP
24576:fvX0CqJm7lpD2KXQztsFvKlH0jmr5WisTzjle5U5TIDV+DwLQk9Qd:3X05Jm7sAKF0GELm8IDVGqQV
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\1be398f8\\X" Explorer.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" srRTMxaDv9.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" woauy.exe -
Modiloader family
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral1/files/0x0008000000016c4e-30.dat modiloader_stage2 behavioral1/memory/2640-46-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
pid Process 344 cmd.exe -
Executes dropped EXE 10 IoCs
pid Process 2084 srRTMxaDv9.exe 2056 woauy.exe 2640 amhost.exe 2780 amhost.exe 2412 bmhost.exe 336 csrss.exe 1188 cmhost.exe 2884 X 1124 Explorer.EXE 2588 dmhost.exe -
Loads dropped DLL 16 IoCs
pid Process 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 2084 srRTMxaDv9.exe 2084 srRTMxaDv9.exe 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 1188 cmhost.exe 1188 cmhost.exe 1188 cmhost.exe 2884 X 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /x" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /Q" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /F" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /Y" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /Z" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /K" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /c" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /C" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /u" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /p" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /f" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /i" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /L" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /a" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /j" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /y" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /V" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /n" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /v" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /H" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /U" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /B" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /h" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /W" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /q" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /A" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /T" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /m" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /w" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /R" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /g" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /e" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /l" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /S" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /M" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /P" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /D" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /z" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /o" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /s" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /M" srRTMxaDv9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /d" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /t" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /r" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /X" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /k" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /E" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /N" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /b" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /O" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /J" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /I" woauy.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\woauy = "C:\\Users\\Admin\\woauy.exe /G" woauy.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2760 tasklist.exe 2244 tasklist.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2640 set thread context of 2780 2640 amhost.exe 38 PID 2412 set thread context of 1180 2412 bmhost.exe 40 PID 1188 set thread context of 1544 1188 cmhost.exe 44 -
resource yara_rule behavioral1/memory/2780-40-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2780-47-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2780-38-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2780-50-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2780-52-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2780-51-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dmhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srRTMxaDv9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language woauy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bmhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language amhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2084 srRTMxaDv9.exe 2084 srRTMxaDv9.exe 2780 amhost.exe 2412 bmhost.exe 2412 bmhost.exe 2412 bmhost.exe 2412 bmhost.exe 2056 woauy.exe 2056 woauy.exe 2056 woauy.exe 2884 X 2056 woauy.exe 2780 amhost.exe 2056 woauy.exe 2056 woauy.exe 2056 woauy.exe 2780 amhost.exe 2056 woauy.exe 2780 amhost.exe 2780 amhost.exe 2056 woauy.exe 2056 woauy.exe 2056 woauy.exe 2780 amhost.exe 2056 woauy.exe 2780 amhost.exe 2780 amhost.exe 2056 woauy.exe 2056 woauy.exe 2056 woauy.exe 2780 amhost.exe 2780 amhost.exe 2056 woauy.exe 2780 amhost.exe 2056 woauy.exe 2780 amhost.exe 2780 amhost.exe 2056 woauy.exe 2780 amhost.exe 2056 woauy.exe 2780 amhost.exe 2056 woauy.exe 2780 amhost.exe 2056 woauy.exe 2780 amhost.exe 2056 woauy.exe 2780 amhost.exe 2780 amhost.exe 2056 woauy.exe 2780 amhost.exe 2056 woauy.exe 2780 amhost.exe 2056 woauy.exe 2056 woauy.exe 2780 amhost.exe 2780 amhost.exe 2780 amhost.exe 2056 woauy.exe 2780 amhost.exe 2780 amhost.exe 2780 amhost.exe 2056 woauy.exe 2056 woauy.exe 2056 woauy.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2760 tasklist.exe Token: SeDebugPrivilege 2412 bmhost.exe Token: SeDebugPrivilege 2412 bmhost.exe Token: SeDebugPrivilege 2244 tasklist.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 2084 srRTMxaDv9.exe 2056 woauy.exe 2588 dmhost.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 336 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2084 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 31 PID 2516 wrote to memory of 2084 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 31 PID 2516 wrote to memory of 2084 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 31 PID 2516 wrote to memory of 2084 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 31 PID 2084 wrote to memory of 2056 2084 srRTMxaDv9.exe 32 PID 2084 wrote to memory of 2056 2084 srRTMxaDv9.exe 32 PID 2084 wrote to memory of 2056 2084 srRTMxaDv9.exe 32 PID 2084 wrote to memory of 2056 2084 srRTMxaDv9.exe 32 PID 2084 wrote to memory of 2912 2084 srRTMxaDv9.exe 33 PID 2084 wrote to memory of 2912 2084 srRTMxaDv9.exe 33 PID 2084 wrote to memory of 2912 2084 srRTMxaDv9.exe 33 PID 2084 wrote to memory of 2912 2084 srRTMxaDv9.exe 33 PID 2912 wrote to memory of 2760 2912 cmd.exe 35 PID 2912 wrote to memory of 2760 2912 cmd.exe 35 PID 2912 wrote to memory of 2760 2912 cmd.exe 35 PID 2912 wrote to memory of 2760 2912 cmd.exe 35 PID 2516 wrote to memory of 2640 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 37 PID 2516 wrote to memory of 2640 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 37 PID 2516 wrote to memory of 2640 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 37 PID 2516 wrote to memory of 2640 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 37 PID 2640 wrote to memory of 2780 2640 amhost.exe 38 PID 2640 wrote to memory of 2780 2640 amhost.exe 38 PID 2640 wrote to memory of 2780 2640 amhost.exe 38 PID 2640 wrote to memory of 2780 2640 amhost.exe 38 PID 2640 wrote to memory of 2780 2640 amhost.exe 38 PID 2640 wrote to memory of 2780 2640 amhost.exe 38 PID 2640 wrote to memory of 2780 2640 amhost.exe 38 PID 2640 wrote to memory of 2780 2640 amhost.exe 38 PID 2516 wrote to memory of 2412 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 39 PID 2516 wrote to memory of 2412 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 39 PID 2516 wrote to memory of 2412 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 39 PID 2516 wrote to memory of 2412 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 39 PID 2412 wrote to memory of 1124 2412 bmhost.exe 20 PID 2412 wrote to memory of 336 2412 bmhost.exe 2 PID 2412 wrote to memory of 1180 2412 bmhost.exe 40 PID 2412 wrote to memory of 1180 2412 bmhost.exe 40 PID 2412 wrote to memory of 1180 2412 bmhost.exe 40 PID 2412 wrote to memory of 1180 2412 bmhost.exe 40 PID 2412 wrote to memory of 1180 2412 bmhost.exe 40 PID 2516 wrote to memory of 1188 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 42 PID 2516 wrote to memory of 1188 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 42 PID 2516 wrote to memory of 1188 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 42 PID 2516 wrote to memory of 1188 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 42 PID 1188 wrote to memory of 2884 1188 cmhost.exe 43 PID 1188 wrote to memory of 2884 1188 cmhost.exe 43 PID 1188 wrote to memory of 2884 1188 cmhost.exe 43 PID 1188 wrote to memory of 2884 1188 cmhost.exe 43 PID 2884 wrote to memory of 1124 2884 X 20 PID 1188 wrote to memory of 1544 1188 cmhost.exe 44 PID 1188 wrote to memory of 1544 1188 cmhost.exe 44 PID 1188 wrote to memory of 1544 1188 cmhost.exe 44 PID 1188 wrote to memory of 1544 1188 cmhost.exe 44 PID 1188 wrote to memory of 1544 1188 cmhost.exe 44 PID 2516 wrote to memory of 2588 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 46 PID 2516 wrote to memory of 2588 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 46 PID 2516 wrote to memory of 2588 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 46 PID 2516 wrote to memory of 2588 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 46 PID 2516 wrote to memory of 344 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 47 PID 2516 wrote to memory of 344 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 47 PID 2516 wrote to memory of 344 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 47 PID 2516 wrote to memory of 344 2516 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 47 PID 344 wrote to memory of 2244 344 cmd.exe 49 PID 344 wrote to memory of 2244 344 cmd.exe 49 PID 344 wrote to memory of 2244 344 cmd.exe 49
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
PID:336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Suspicious use of AdjustPrivilegeToken
PID:848
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\srRTMxaDv9.exeC:\Users\Admin\srRTMxaDv9.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\woauy.exe"C:\Users\Admin\woauy.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2056
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del srRTMxaDv9.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
-
-
C:\Users\Admin\amhost.exeC:\Users\Admin\amhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\amhost.exeamhost.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2780
-
-
-
C:\Users\Admin\bmhost.exeC:\Users\Admin\bmhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1180
-
-
-
C:\Users\Admin\cmhost.exeC:\Users\Admin\cmhost.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\1be398f8\X176.53.17.24:804⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2884
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1544
-
-
-
C:\Users\Admin\dmhost.exeC:\Users\Admin\dmhost.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2588
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2244
-
-
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:708
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5f5e66a93bc297ba83db0e7b5564ced3f
SHA1863c519546cfba7531b8ecbf10ae5bede6d2193d
SHA25694257ae4c040d8487cb44bc23030193944c72c12678dcd8b80684a3721b21231
SHA512b7ee82bdc3057df90eed61a9d0d6d52420fb8baf6cc8f12f30144ecdd1f298f13d89e14bfa474ea939bd734440f185d7bba72d1140080a3ef975253191adaea3
-
Filesize
53KB
MD54d7cde615a0f534bd5e359951829554b
SHA1c885d00d9000f2a5dbc78f6193a052b36f4fe968
SHA256414fdf9bdcae5136c1295d6d24740c50a484acd81f1f7d0fb5d5c138607cb80a
SHA51233d632f9fbb694440a1ca568c90518784278efd1dc9ee2b57028149d56ebe1f7346d5b59dcfafee2eeaa10091dda05f48958e909d6bfc891e037ae1cfbd048d4
-
Filesize
2KB
MD5c9c375e4592e4f72fc80d8673aa484e3
SHA1565b0a395671b12a77d006b7b17a54d20932f28a
SHA256f6b79b69ca9f5047bed4631c79b6ea737fb03125e185b2114f4986a366f8b9c2
SHA512e412db5ec4003861a02e04b564e3f6ae6f93f2d052615fab96b4560ca74989891a610fd6062b14cef96785c9866b34c72470f158918af161870942fe5153ee65
-
Filesize
41KB
MD5be40a2578e862f1cecc9b9194f524201
SHA10c379f375f9bcfab2e8d86161cec07fe4a7dbc12
SHA2562c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6
SHA51225fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8
-
Filesize
80KB
MD58ccbe4f27f9710f3e7f75e1d1de57e49
SHA1272e95e476477cd4a1715ee0bcf32318e0351718
SHA2563d36ee15c25b2308f8552e121d885c26b46b4e7fc6dbb41a684bec53e0ae3b5d
SHA512334f56b5158839f521513aff9de334536c86da633bf1a3b78592529275457973ed67fd55a54bef8f88ce918c2863c365cababfbd0ef888a27272906e281105d0
-
Filesize
258KB
MD52da0070a7c50f3a078b73b4fb7ee7c02
SHA1999b4860a80b908622fadfc8fae27db66b200932
SHA256f8a0f1b5b3f320f01173f151305dc780eac51bf78e7405fd2c0b9b3ba58945bf
SHA5122d488508e785d92c5cf9f0abee8153d984d8dd8f1d59880643764f499e151fccc9572a9ad1fe0a82412b8ed230d25bd849a0beeded12325dc21839ed53512630
-
Filesize
358KB
MD503102e4338eb16e0c4dfe106830557e3
SHA14fdb5baf0900e44e95acdeee1c947be3b0518b39
SHA2567dd28bddc46daddc8f7e14906f50ef991d3d7f1ffb785388fb5c42be9e162139
SHA512c7d4b4b3766c0b4cdc3d16f56effe1b36cacd4a48f728cf1a33360eb6c48362587186dc0be45f098cd3117bc10c7113d51262939bfe018c6f963b36d59cd97c9
-
Filesize
32KB
MD5e5a8cc5176a71d1fb82d8790db0c20f0
SHA16d0c76a9e94151d84241bdf99033524daf4346ed
SHA2563b324891d70636e38cfc4c080a91fc83b387013af03ef9d2d6aa36376e1d6c8c
SHA512ccbd5e3f98ff202c8a7753208d588bfef183eb37a6da3fbcf733dab0112408b1a05836ebbc24d6a17e9b72260ba9682e53628d20f130b10d8ec76cf9f1a51f9c
-
Filesize
344KB
MD557a5743f47b3a874773041195600909c
SHA174f5c16a6ca03baea7c684e40d351f1ec484a70d
SHA256eecfb7541cf571d34882ebeb19c3c396ed53243e23060d45e1f1b033e061da90
SHA51266c4621663db921b7a18b843197ea6611e9473abca6b2a653d1f228146129434a7f643f598e0fdfbe300f2ea91168135de59a69f02f52245c71f12e4364e2954
-
Filesize
344KB
MD507fde06b6fa5b5aac1b1f829f239c149
SHA1493ea55103ec11486e424ce65b18b0b1627cc704
SHA2563f3810d49d52695fb564da70161034b5c433804288ca6dd1fe2220fd60722e10
SHA512b7c2f8aef0cdac030c4c7f8f1f80ffdf777472e70f885ba3709076703095fabd7fd3a9c2d9121ad31922d402cb418f6d95a0933c53b7f0638750c75e354a6368
-
Filesize
4KB
MD5878f9b6da85cb98fcbdf6abd1730a32f
SHA1343007e658ea541f4680b4edf4513e69e1cc18a6
SHA25675b5a460ed6f47fca8ec1bcd8a11b22f24fb33de4d5f307b851ad20c7f831b7d
SHA5125425844e34ad5e717b08830020526f5c9465f654f3e9e29967b2983d5cb8dc225be2b89cd29a8e4cc99fcfc99e05556f66eefa0539283ab4569e603413a37293
-
Filesize
5KB
MD59d7ec1e355ac35cbe6991721ef5ae3b8
SHA1c35a00bd35c6e4a7516b93947be08ead966347e8
SHA25668a3cec42215323100398a8eb2cbb37da7d58fe0fa9c6312e954e0f50a95ca98
SHA512b7c4be28d8e179974672205a50e72fa1ec9e2e8170b3b8ee763e1751a3397c35afec7a72c88f0a79a8566749b2af1ff054660a96c3a6d6508c545d316a035dc0