Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 20:35
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe
-
Size
844KB
-
MD5
4374ffe3395196ca313993c5b6337d2e
-
SHA1
a52a9c1ac7f67a844a3299fbb170f067ffdd4758
-
SHA256
36bb9292501433a0931ca14fc3e32cf8ced0c83da8a32b6bdc2e39e1fb6de157
-
SHA512
3fbe39cd0819cdc1554908b75e521c8924f3dbb466c9ca262a412618d6a4be2460729d92c55df9d5e6b4cb41ea41f2a9fcb6032fb61da2b75d43012569d5a806
-
SSDEEP
24576:fvX0CqJm7lpD2KXQztsFvKlH0jmr5WisTzjle5U5TIDV+DwLQk9Qd:3X05Jm7sAKF0GELm8IDVGqQV
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" srRTMxaDv9.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sazab.exe -
Modiloader family
-
ModiLoader Second Stage 2 IoCs
resource yara_rule behavioral2/files/0x0007000000023c9d-38.dat modiloader_stage2 behavioral2/memory/4676-50-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation srRTMxaDv9.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe -
Executes dropped EXE 8 IoCs
pid Process 2212 srRTMxaDv9.exe 4676 amhost.exe 4048 sazab.exe 1656 amhost.exe 1788 bmhost.exe 1552 cmhost.exe 4620 X 3648 dmhost.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /C" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /I" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /K" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /m" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /F" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /M" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /A" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /a" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /z" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /r" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /j" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /R" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /x" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /u" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /X" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /Y" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /Z" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /l" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /B" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /y" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /w" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /t" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /q" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /i" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /s" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /E" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /G" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /V" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /J" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /D" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /U" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /O" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /g" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /n" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /o" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /c" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /v" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /b" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /L" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /W" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /H" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /d" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /E" srRTMxaDv9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /N" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /e" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /k" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /T" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /Q" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /f" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /h" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /p" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /P" sazab.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sazab = "C:\\Users\\Admin\\sazab.exe /S" sazab.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 3400 tasklist.exe 1504 tasklist.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4676 set thread context of 1656 4676 amhost.exe 90 PID 1788 set thread context of 3528 1788 bmhost.exe 94 PID 1552 set thread context of 1976 1552 cmhost.exe 104 -
resource yara_rule behavioral2/memory/1656-45-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1656-46-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1656-53-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1656-52-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1656-51-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language amhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bmhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dmhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srRTMxaDv9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sazab.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2212 srRTMxaDv9.exe 2212 srRTMxaDv9.exe 2212 srRTMxaDv9.exe 2212 srRTMxaDv9.exe 1656 amhost.exe 1656 amhost.exe 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 1656 amhost.exe 1656 amhost.exe 4048 sazab.exe 4048 sazab.exe 4620 X 4620 X 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 1656 amhost.exe 1656 amhost.exe 4048 sazab.exe 4048 sazab.exe 1656 amhost.exe 1656 amhost.exe 1656 amhost.exe 1656 amhost.exe 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 1656 amhost.exe 1656 amhost.exe 4048 sazab.exe 4048 sazab.exe 1656 amhost.exe 1656 amhost.exe 1656 amhost.exe 1656 amhost.exe 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 4048 sazab.exe 1656 amhost.exe 1656 amhost.exe 1656 amhost.exe 1656 amhost.exe 4048 sazab.exe 4048 sazab.exe 1656 amhost.exe 1656 amhost.exe 4048 sazab.exe 4048 sazab.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3400 tasklist.exe Token: SeDebugPrivilege 1788 bmhost.exe Token: SeDebugPrivilege 1552 cmhost.exe Token: SeDebugPrivilege 1504 tasklist.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 2212 srRTMxaDv9.exe 4048 sazab.exe 3648 dmhost.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2212 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 83 PID 2216 wrote to memory of 2212 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 83 PID 2216 wrote to memory of 2212 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 83 PID 2216 wrote to memory of 4676 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 85 PID 2216 wrote to memory of 4676 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 85 PID 2216 wrote to memory of 4676 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 85 PID 2212 wrote to memory of 4048 2212 srRTMxaDv9.exe 84 PID 2212 wrote to memory of 4048 2212 srRTMxaDv9.exe 84 PID 2212 wrote to memory of 4048 2212 srRTMxaDv9.exe 84 PID 2212 wrote to memory of 1556 2212 srRTMxaDv9.exe 86 PID 2212 wrote to memory of 1556 2212 srRTMxaDv9.exe 86 PID 2212 wrote to memory of 1556 2212 srRTMxaDv9.exe 86 PID 1556 wrote to memory of 3400 1556 cmd.exe 88 PID 1556 wrote to memory of 3400 1556 cmd.exe 88 PID 1556 wrote to memory of 3400 1556 cmd.exe 88 PID 4676 wrote to memory of 1656 4676 amhost.exe 90 PID 4676 wrote to memory of 1656 4676 amhost.exe 90 PID 4676 wrote to memory of 1656 4676 amhost.exe 90 PID 4676 wrote to memory of 1656 4676 amhost.exe 90 PID 4676 wrote to memory of 1656 4676 amhost.exe 90 PID 4676 wrote to memory of 1656 4676 amhost.exe 90 PID 4676 wrote to memory of 1656 4676 amhost.exe 90 PID 4676 wrote to memory of 1656 4676 amhost.exe 90 PID 2216 wrote to memory of 1788 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 91 PID 2216 wrote to memory of 1788 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 91 PID 2216 wrote to memory of 1788 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 91 PID 1788 wrote to memory of 3528 1788 bmhost.exe 94 PID 1788 wrote to memory of 3528 1788 bmhost.exe 94 PID 1788 wrote to memory of 3528 1788 bmhost.exe 94 PID 1788 wrote to memory of 3528 1788 bmhost.exe 94 PID 2216 wrote to memory of 1552 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 96 PID 2216 wrote to memory of 1552 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 96 PID 2216 wrote to memory of 1552 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 96 PID 1552 wrote to memory of 4620 1552 cmhost.exe 97 PID 1552 wrote to memory of 4620 1552 cmhost.exe 97 PID 4620 wrote to memory of 1168 4620 X 98 PID 4620 wrote to memory of 1168 4620 X 98 PID 4620 wrote to memory of 1168 4620 X 98 PID 1552 wrote to memory of 1976 1552 cmhost.exe 104 PID 1552 wrote to memory of 1976 1552 cmhost.exe 104 PID 1552 wrote to memory of 1976 1552 cmhost.exe 104 PID 1552 wrote to memory of 1976 1552 cmhost.exe 104 PID 2216 wrote to memory of 3648 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 106 PID 2216 wrote to memory of 3648 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 106 PID 2216 wrote to memory of 3648 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 106 PID 2216 wrote to memory of 4476 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 109 PID 2216 wrote to memory of 4476 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 109 PID 2216 wrote to memory of 4476 2216 JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe 109 PID 4476 wrote to memory of 1504 4476 cmd.exe 111 PID 4476 wrote to memory of 1504 4476 cmd.exe 111 PID 4476 wrote to memory of 1504 4476 cmd.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\srRTMxaDv9.exeC:\Users\Admin\srRTMxaDv9.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\sazab.exe"C:\Users\Admin\sazab.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4048
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del srRTMxaDv9.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3400
-
-
-
-
C:\Users\Admin\amhost.exeC:\Users\Admin\amhost.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\amhost.exeamhost.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1656
-
-
-
C:\Users\Admin\bmhost.exeC:\Users\Admin\bmhost.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:3528
-
-
-
C:\Users\Admin\cmhost.exeC:\Users\Admin\cmhost.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\9a2c62aa\X176.53.17.24:803⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵
- Modifies registry class
PID:1168
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:1976
-
-
-
C:\Users\Admin\dmhost.exeC:\Users\Admin\dmhost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3648
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_4374ffe3395196ca313993c5b6337d2e.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5be40a2578e862f1cecc9b9194f524201
SHA10c379f375f9bcfab2e8d86161cec07fe4a7dbc12
SHA2562c0f19272baa42d1af85a395fe8cd687c50e91450abc5911f6806c317a25b6a6
SHA51225fbee1dce99c0ca80cd11bbe0d9fceaa07bf8a8b9b3ebc04e55645c0a733dafc83a7922975c31bc9fdff6f413257ac8b9ff72628c78b48a5b7ab669eab369f8
-
Filesize
80KB
MD58ccbe4f27f9710f3e7f75e1d1de57e49
SHA1272e95e476477cd4a1715ee0bcf32318e0351718
SHA2563d36ee15c25b2308f8552e121d885c26b46b4e7fc6dbb41a684bec53e0ae3b5d
SHA512334f56b5158839f521513aff9de334536c86da633bf1a3b78592529275457973ed67fd55a54bef8f88ce918c2863c365cababfbd0ef888a27272906e281105d0
-
Filesize
258KB
MD52da0070a7c50f3a078b73b4fb7ee7c02
SHA1999b4860a80b908622fadfc8fae27db66b200932
SHA256f8a0f1b5b3f320f01173f151305dc780eac51bf78e7405fd2c0b9b3ba58945bf
SHA5122d488508e785d92c5cf9f0abee8153d984d8dd8f1d59880643764f499e151fccc9572a9ad1fe0a82412b8ed230d25bd849a0beeded12325dc21839ed53512630
-
Filesize
358KB
MD503102e4338eb16e0c4dfe106830557e3
SHA14fdb5baf0900e44e95acdeee1c947be3b0518b39
SHA2567dd28bddc46daddc8f7e14906f50ef991d3d7f1ffb785388fb5c42be9e162139
SHA512c7d4b4b3766c0b4cdc3d16f56effe1b36cacd4a48f728cf1a33360eb6c48362587186dc0be45f098cd3117bc10c7113d51262939bfe018c6f963b36d59cd97c9
-
Filesize
32KB
MD5e5a8cc5176a71d1fb82d8790db0c20f0
SHA16d0c76a9e94151d84241bdf99033524daf4346ed
SHA2563b324891d70636e38cfc4c080a91fc83b387013af03ef9d2d6aa36376e1d6c8c
SHA512ccbd5e3f98ff202c8a7753208d588bfef183eb37a6da3fbcf733dab0112408b1a05836ebbc24d6a17e9b72260ba9682e53628d20f130b10d8ec76cf9f1a51f9c
-
Filesize
344KB
MD515328499a2e83b063081d2cfd27faed6
SHA1bf0a0fd4407935258ff9df51de7c1915901b92e2
SHA256d4e38f4c3bd7b294298c4fda059da3035f2c3f9a5f59780d858fe666a2546b7b
SHA51297c7fc7fadf0fa33ccce81bbc0662912bcfa0c75fee4b3f057bef602d7805e68835e13a9bb7c0befcabfbce2b8db7db5db3b2a47536c7559403db51f3fd30c84
-
Filesize
344KB
MD557a5743f47b3a874773041195600909c
SHA174f5c16a6ca03baea7c684e40d351f1ec484a70d
SHA256eecfb7541cf571d34882ebeb19c3c396ed53243e23060d45e1f1b033e061da90
SHA51266c4621663db921b7a18b843197ea6611e9473abca6b2a653d1f228146129434a7f643f598e0fdfbe300f2ea91168135de59a69f02f52245c71f12e4364e2954