Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/03/2025, 22:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe
Resource
win7-20240903-en
windows7-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
24 signatures
150 seconds
General
-
Target
JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe
-
Size
512KB
-
MD5
895a38bc3fc7a0b21cadbf5b306faff7
-
SHA1
30c3c92c4e9fbd61db6dcff4ad1a42a6d5312e09
-
SHA256
7a093c88448db7ce4e48155a1a14a15ee3f9f850ddd5853c2597869bcdd004ee
-
SHA512
01bbcd194671e08cbeab90592756cf8c7f8f03248cf99d195986d45006dfc7b2d1e31808887dfcafa9261b1e92b4bf5ecf0afcda3fd279ab8e2173c3e1834d4e
-
SSDEEP
6144:bXj6/wndfF/gl0LQIk8DR3dEuAI7pEfxsZozAm9TMdGQLUg1nYmefPImdrionXz:bT6onxOp8FySpE5zvIdtU+YmefH
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" uvtgxqufefd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" uvtgxqufefd.exe -
Pykspa family
-
UAC bypass 3 TTPs 13 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" dhkot.exe -
Detect Pykspa worm 2 IoCs
resource yara_rule behavioral1/files/0x000c0000000122e7-2.dat family_pykspa behavioral1/files/0x000500000001a0a9-61.dat family_pykspa -
Adds policy Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhmszlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxmctpdskdkohedne.exe" dhkot.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run uvtgxqufefd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajrakzgozl = "apdsidqevntwokir.exe" uvtgxqufefd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajrakzgozl = "qhxogdsibvdicaaldk.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhmszlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apdsidqevntwokir.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajrakzgozl = "hxmctpdskdkohedne.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhmszlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxqkffxqmjuczadrmwqjd.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajrakzgozl = "qhxogdsibvdicaaldk.exe" uvtgxqufefd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajrakzgozl = "ohzsmlcuplvcyyanhqjb.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhmszlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohzsmlcuplvcyyanhqjb.exe" uvtgxqufefd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhmszlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohzsmlcuplvcyyanhqjb.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhmszlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btkcvtjaupyezyzleme.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhmszlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohzsmlcuplvcyyanhqjb.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajrakzgozl = "ohzsmlcuplvcyyanhqjb.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajrakzgozl = "qhxogdsibvdicaaldk.exe" dhkot.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajrakzgozl = "apdsidqevntwokir.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhmszlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhxogdsibvdicaaldk.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhmszlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apdsidqevntwokir.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhmszlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btkcvtjaupyezyzleme.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhmszlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btkcvtjaupyezyzleme.exe" uvtgxqufefd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run uvtgxqufefd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajrakzgozl = "apdsidqevntwokir.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajrakzgozl = "dxqkffxqmjuczadrmwqjd.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhmszlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxqkffxqmjuczadrmwqjd.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhmszlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxmctpdskdkohedne.exe" dhkot.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dhkot.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uvtgxqufefd.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dhkot.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dhkot.exe -
Executes dropped EXE 4 IoCs
pid Process 1552 uvtgxqufefd.exe 2808 dhkot.exe 2840 dhkot.exe 2136 uvtgxqufefd.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power dhkot.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend dhkot.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc dhkot.exe -
Loads dropped DLL 8 IoCs
pid Process 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 1552 uvtgxqufefd.exe 1552 uvtgxqufefd.exe 1552 uvtgxqufefd.exe 1552 uvtgxqufefd.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxqkffxqmjuczadrmwqjd.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "dxqkffxqmjuczadrmwqjd.exe" dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sdnykbkuhvxw = "hxmctpdskdkohedne.exe ." dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sfreslwixnrsic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhxogdsibvdicaaldk.exe" dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\vfoyjzhqcpq = "hxmctpdskdkohedne.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hpwenbhoy = "hxmctpdskdkohedne.exe ." uvtgxqufefd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sdnykbkuhvxw = "btkcvtjaupyezyzleme.exe ." dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hpwenbhoy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxqkffxqmjuczadrmwqjd.exe ." dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdoanfpaodggv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohzsmlcuplvcyyanhqjb.exe ." dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "qhxogdsibvdicaaldk.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdoanfpaodggv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhxogdsibvdicaaldk.exe ." dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btkcvtjaupyezyzleme.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sfreslwixnrsic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxmctpdskdkohedne.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdoanfpaodggv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohzsmlcuplvcyyanhqjb.exe ." uvtgxqufefd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hpwenbhoy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxmctpdskdkohedne.exe ." dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "qhxogdsibvdicaaldk.exe" dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\vfoyjzhqcpq = "btkcvtjaupyezyzleme.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sfreslwixnrsic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apdsidqevntwokir.exe" uvtgxqufefd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sfreslwixnrsic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apdsidqevntwokir.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdoanfpaodggv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhxogdsibvdicaaldk.exe ." dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sfreslwixnrsic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxqkffxqmjuczadrmwqjd.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hpwenbhoy = "ohzsmlcuplvcyyanhqjb.exe ." dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdoanfpaodggv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxqkffxqmjuczadrmwqjd.exe ." dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohzsmlcuplvcyyanhqjb.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hpwenbhoy = "qhxogdsibvdicaaldk.exe ." dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\vfoyjzhqcpq = "ohzsmlcuplvcyyanhqjb.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hpwenbhoy = "hxmctpdskdkohedne.exe ." uvtgxqufefd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdoanfpaodggv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apdsidqevntwokir.exe ." uvtgxqufefd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\vfoyjzhqcpq = "dxqkffxqmjuczadrmwqjd.exe" uvtgxqufefd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "apdsidqevntwokir.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "btkcvtjaupyezyzleme.exe" dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btkcvtjaupyezyzleme.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hpwenbhoy = "apdsidqevntwokir.exe ." dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\vfoyjzhqcpq = "ohzsmlcuplvcyyanhqjb.exe" dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hpwenbhoy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxqkffxqmjuczadrmwqjd.exe ." dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhxogdsibvdicaaldk.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sfreslwixnrsic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohzsmlcuplvcyyanhqjb.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hpwenbhoy = "ohzsmlcuplvcyyanhqjb.exe ." dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "ohzsmlcuplvcyyanhqjb.exe" uvtgxqufefd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btkcvtjaupyezyzleme.exe" uvtgxqufefd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sfreslwixnrsic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxqkffxqmjuczadrmwqjd.exe" dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sdnykbkuhvxw = "btkcvtjaupyezyzleme.exe ." dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhxogdsibvdicaaldk.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sfreslwixnrsic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohzsmlcuplvcyyanhqjb.exe" dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sdnykbkuhvxw = "dxqkffxqmjuczadrmwqjd.exe ." dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdoanfpaodggv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apdsidqevntwokir.exe ." dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sdnykbkuhvxw = "qhxogdsibvdicaaldk.exe ." dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apdsidqevntwokir.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sfreslwixnrsic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhxogdsibvdicaaldk.exe" dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\vfoyjzhqcpq = "apdsidqevntwokir.exe" dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sdnykbkuhvxw = "ohzsmlcuplvcyyanhqjb.exe ." dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "hxmctpdskdkohedne.exe" dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxmctpdskdkohedne.exe" dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sdnykbkuhvxw = "btkcvtjaupyezyzleme.exe ." uvtgxqufefd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\vfoyjzhqcpq = "dxqkffxqmjuczadrmwqjd.exe" dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\vfoyjzhqcpq = "apdsidqevntwokir.exe" dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sdnykbkuhvxw = "dxqkffxqmjuczadrmwqjd.exe ." dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sdnykbkuhvxw = "qhxogdsibvdicaaldk.exe ." dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "apdsidqevntwokir.exe" dhkot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hpwenbhoy = "qhxogdsibvdicaaldk.exe ." dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hpwenbhoy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apdsidqevntwokir.exe ." dhkot.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\hpwenbhoy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btkcvtjaupyezyzleme.exe ." uvtgxqufefd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qxdksfkq = "hxmctpdskdkohedne.exe" uvtgxqufefd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\vfoyjzhqcpq = "qhxogdsibvdicaaldk.exe" dhkot.exe -
Checks whether UAC is enabled 1 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dhkot.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dhkot.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uvtgxqufefd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dhkot.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dhkot.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" uvtgxqufefd.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 whatismyip.everdot.org 7 www.whatismyip.ca 11 www.showmyipaddress.com 2 whatismyipaddress.com -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf dhkot.exe File opened for modification F:\autorun.inf dhkot.exe File created F:\autorun.inf dhkot.exe File opened for modification C:\autorun.inf dhkot.exe -
Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\btkcvtjaupyezyzleme.exe dhkot.exe File opened for modification C:\Windows\SysWOW64\dxqkffxqmjuczadrmwqjd.exe dhkot.exe File opened for modification C:\Windows\SysWOW64\apdsidqevntwokir.exe dhkot.exe File opened for modification C:\Windows\SysWOW64\qhxogdsibvdicaaldk.exe uvtgxqufefd.exe File opened for modification C:\Windows\SysWOW64\apdsidqevntwokir.exe dhkot.exe File opened for modification C:\Windows\SysWOW64\hxmctpdskdkohedne.exe dhkot.exe File opened for modification C:\Windows\SysWOW64\dxqkffxqmjuczadrmwqjd.exe dhkot.exe File opened for modification C:\Windows\SysWOW64\qhxogdsibvdicaaldk.exe uvtgxqufefd.exe File opened for modification C:\Windows\SysWOW64\dxqkffxqmjuczadrmwqjd.exe uvtgxqufefd.exe File opened for modification C:\Windows\SysWOW64\qhxogdsibvdicaaldk.exe dhkot.exe File opened for modification C:\Windows\SysWOW64\btkcvtjaupyezyzleme.exe dhkot.exe File opened for modification C:\Windows\SysWOW64\upjeabuoljveceixteztok.exe dhkot.exe File opened for modification C:\Windows\SysWOW64\apdsidqevntwokir.exe uvtgxqufefd.exe File opened for modification C:\Windows\SysWOW64\btkcvtjaupyezyzleme.exe uvtgxqufefd.exe File opened for modification C:\Windows\SysWOW64\hxmctpdskdkohedne.exe dhkot.exe File created C:\Windows\SysWOW64\edbaafcabdtgiowppedbaa.cab dhkot.exe File opened for modification C:\Windows\SysWOW64\vfoyjzhqcpqobslpaaktdoemvhuvtgxqu.fpy dhkot.exe File opened for modification C:\Windows\SysWOW64\dxqkffxqmjuczadrmwqjd.exe uvtgxqufefd.exe File opened for modification C:\Windows\SysWOW64\edbaafcabdtgiowppedbaa.cab dhkot.exe File opened for modification C:\Windows\SysWOW64\btkcvtjaupyezyzleme.exe uvtgxqufefd.exe File opened for modification C:\Windows\SysWOW64\ohzsmlcuplvcyyanhqjb.exe dhkot.exe File opened for modification C:\Windows\SysWOW64\upjeabuoljveceixteztok.exe dhkot.exe File opened for modification C:\Windows\SysWOW64\qhxogdsibvdicaaldk.exe dhkot.exe File opened for modification C:\Windows\SysWOW64\apdsidqevntwokir.exe uvtgxqufefd.exe File opened for modification C:\Windows\SysWOW64\hxmctpdskdkohedne.exe uvtgxqufefd.exe File opened for modification C:\Windows\SysWOW64\hxmctpdskdkohedne.exe uvtgxqufefd.exe File opened for modification C:\Windows\SysWOW64\ohzsmlcuplvcyyanhqjb.exe uvtgxqufefd.exe File opened for modification C:\Windows\SysWOW64\ohzsmlcuplvcyyanhqjb.exe dhkot.exe File created C:\Windows\SysWOW64\vfoyjzhqcpqobslpaaktdoemvhuvtgxqu.fpy dhkot.exe File opened for modification C:\Windows\SysWOW64\ohzsmlcuplvcyyanhqjb.exe uvtgxqufefd.exe File opened for modification C:\Windows\SysWOW64\upjeabuoljveceixteztok.exe uvtgxqufefd.exe File opened for modification C:\Windows\SysWOW64\upjeabuoljveceixteztok.exe uvtgxqufefd.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\edbaafcabdtgiowppedbaa.cab dhkot.exe File created C:\Program Files (x86)\edbaafcabdtgiowppedbaa.cab dhkot.exe File opened for modification C:\Program Files (x86)\vfoyjzhqcpqobslpaaktdoemvhuvtgxqu.fpy dhkot.exe File created C:\Program Files (x86)\vfoyjzhqcpqobslpaaktdoemvhuvtgxqu.fpy dhkot.exe -
Drops file in Windows directory 32 IoCs
description ioc Process File opened for modification C:\Windows\apdsidqevntwokir.exe uvtgxqufefd.exe File opened for modification C:\Windows\dxqkffxqmjuczadrmwqjd.exe uvtgxqufefd.exe File opened for modification C:\Windows\btkcvtjaupyezyzleme.exe dhkot.exe File opened for modification C:\Windows\qhxogdsibvdicaaldk.exe dhkot.exe File opened for modification C:\Windows\btkcvtjaupyezyzleme.exe dhkot.exe File opened for modification C:\Windows\dxqkffxqmjuczadrmwqjd.exe dhkot.exe File opened for modification C:\Windows\ohzsmlcuplvcyyanhqjb.exe uvtgxqufefd.exe File opened for modification C:\Windows\hxmctpdskdkohedne.exe uvtgxqufefd.exe File opened for modification C:\Windows\upjeabuoljveceixteztok.exe uvtgxqufefd.exe File opened for modification C:\Windows\dxqkffxqmjuczadrmwqjd.exe dhkot.exe File opened for modification C:\Windows\hxmctpdskdkohedne.exe dhkot.exe File opened for modification C:\Windows\dxqkffxqmjuczadrmwqjd.exe uvtgxqufefd.exe File opened for modification C:\Windows\upjeabuoljveceixteztok.exe uvtgxqufefd.exe File opened for modification C:\Windows\upjeabuoljveceixteztok.exe dhkot.exe File opened for modification C:\Windows\qhxogdsibvdicaaldk.exe uvtgxqufefd.exe File opened for modification C:\Windows\qhxogdsibvdicaaldk.exe uvtgxqufefd.exe File opened for modification C:\Windows\ohzsmlcuplvcyyanhqjb.exe uvtgxqufefd.exe File created C:\Windows\edbaafcabdtgiowppedbaa.cab dhkot.exe File opened for modification C:\Windows\vfoyjzhqcpqobslpaaktdoemvhuvtgxqu.fpy dhkot.exe File opened for modification C:\Windows\hxmctpdskdkohedne.exe dhkot.exe File opened for modification C:\Windows\ohzsmlcuplvcyyanhqjb.exe dhkot.exe File opened for modification C:\Windows\btkcvtjaupyezyzleme.exe uvtgxqufefd.exe File opened for modification C:\Windows\btkcvtjaupyezyzleme.exe uvtgxqufefd.exe File opened for modification C:\Windows\apdsidqevntwokir.exe dhkot.exe File opened for modification C:\Windows\qhxogdsibvdicaaldk.exe dhkot.exe File opened for modification C:\Windows\edbaafcabdtgiowppedbaa.cab dhkot.exe File opened for modification C:\Windows\apdsidqevntwokir.exe dhkot.exe File opened for modification C:\Windows\upjeabuoljveceixteztok.exe dhkot.exe File opened for modification C:\Windows\hxmctpdskdkohedne.exe uvtgxqufefd.exe File opened for modification C:\Windows\ohzsmlcuplvcyyanhqjb.exe dhkot.exe File opened for modification C:\Windows\apdsidqevntwokir.exe uvtgxqufefd.exe File created C:\Windows\vfoyjzhqcpqobslpaaktdoemvhuvtgxqu.fpy dhkot.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uvtgxqufefd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhkot.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2808 dhkot.exe 2808 dhkot.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2808 dhkot.exe 2808 dhkot.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2808 dhkot.exe 2808 dhkot.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2808 dhkot.exe 2808 dhkot.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2808 dhkot.exe 2808 dhkot.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2808 dhkot.exe 2808 dhkot.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2808 dhkot.exe 2808 dhkot.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2808 dhkot.exe 2808 dhkot.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2808 dhkot.exe 2808 dhkot.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2808 dhkot.exe 2808 dhkot.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2808 dhkot.exe 2808 dhkot.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 2808 dhkot.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2808 dhkot.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2344 wrote to memory of 1552 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 31 PID 2344 wrote to memory of 1552 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 31 PID 2344 wrote to memory of 1552 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 31 PID 2344 wrote to memory of 1552 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 31 PID 1552 wrote to memory of 2808 1552 uvtgxqufefd.exe 32 PID 1552 wrote to memory of 2808 1552 uvtgxqufefd.exe 32 PID 1552 wrote to memory of 2808 1552 uvtgxqufefd.exe 32 PID 1552 wrote to memory of 2808 1552 uvtgxqufefd.exe 32 PID 1552 wrote to memory of 2840 1552 uvtgxqufefd.exe 33 PID 1552 wrote to memory of 2840 1552 uvtgxqufefd.exe 33 PID 1552 wrote to memory of 2840 1552 uvtgxqufefd.exe 33 PID 1552 wrote to memory of 2840 1552 uvtgxqufefd.exe 33 PID 2344 wrote to memory of 2136 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 35 PID 2344 wrote to memory of 2136 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 35 PID 2344 wrote to memory of 2136 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 35 PID 2344 wrote to memory of 2136 2344 JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe 35 -
System policy modification 1 TTPs 38 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" uvtgxqufefd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" dhkot.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dhkot.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" dhkot.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" dhkot.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" uvtgxqufefd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" dhkot.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" uvtgxqufefd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" uvtgxqufefd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\uvtgxqufefd.exe"C:\Users\Admin\AppData\Local\Temp\uvtgxqufefd.exe" "c:\users\admin\appdata\local\temp\jaffacakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\dhkot.exe"C:\Users\Admin\AppData\Local\Temp\dhkot.exe" "-C:\Users\Admin\AppData\Local\Temp\apdsidqevntwokir.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2808
-
-
C:\Users\Admin\AppData\Local\Temp\dhkot.exe"C:\Users\Admin\AppData\Local\Temp\dhkot.exe" "-C:\Users\Admin\AppData\Local\Temp\apdsidqevntwokir.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2840
-
-
-
C:\Users\Admin\AppData\Local\Temp\uvtgxqufefd.exe"C:\Users\Admin\AppData\Local\Temp\uvtgxqufefd.exe" "c:\users\admin\appdata\local\temp\jaffacakes118_895a38bc3fc7a0b21cadbf5b306faff7.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2136
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272B
MD5b5be74beb539d08ab2177129b2e5768d
SHA10a022204aa3698b76a2b8dbb5dad2d2688dcab5f
SHA2561a9b9f7254dccbb10ce498a734099e75cb717377ce8e9f305e5904b270bdce78
SHA512fb3de5de9ef0904227a1b8ddedc2079c21df0e5c22f86e06d09c88e14a452b867bb72259423820a89f6085d858742ae9a86682969a78e6a3d18e05e206c37d3c
-
Filesize
272B
MD55b437b4fab90b458656bb1511f829c87
SHA1cea34b2ed1964585e5b52086c513d9e61a12cd31
SHA2566fc1554c03e31e72fc272e9d11161f0a856bdeac28367bbf6281d38440d638f3
SHA512d8987b7be83e1a39bab229d74edcec010f81cd02ac3f450632a937899d5e22f944eb03229a01a461286a42d12270f15702f0c2a2f935d5237df8835bf7bc1cd7
-
Filesize
272B
MD54916e36b7536334ba32a685e5a55958b
SHA178d4a451bfe318c7b3cda4142f127dd416e4c16d
SHA2568e70f3ef403d4bf25538539feac345632d9ce3731fdd5147817d5047a043f22f
SHA5128640e8dfc746ea39f844ef8449ab588dbaf7f898a6ffc3158313ae828c8ccaec60ef2280208492f1b040c66dada94d40ad4101a041db8d297c6fd66a06984778
-
Filesize
272B
MD504e4e52c6588b73499d219a6b73dc1e6
SHA17f242fce5fc8545e5b792db3cdd4fe6ea14709b0
SHA256529f354ff09ebee0349268fe22b4188e7c2c4ede004b02874f4c352f91b18c99
SHA512335006af20bef908ec5f8fa43873bdd511f7bbdd458ef0f21459c3a90c23cd4fe9d67544fec4e6f739df10a6b6fb8606d4f907f8e88414c3cca8883853b22a15
-
Filesize
272B
MD5d9ac74c945a88bbdf83c3d8e10f3b22d
SHA106f5b9cd8a557051611ae559315eaaf762b23154
SHA25687d2ac58f1d97e97ac1bd3a7abb5673402acc804d68a59db402ddc232d4320ae
SHA512d1e35d384dd1b6b71b7acbe4f548f2838fde8c5c1ec62c6824c1b636882abf573857db2d7be7664d3064031494281f41dada5df28bc012dcb4a085a677362045
-
Filesize
272B
MD58d9851a6a9c560c57bb887ffdea2b718
SHA1d5edfb4a78deb8faf96de2b1127370e690b314d8
SHA2561497c74aff0288c056ad2d5dc523aa293651c12ae0b1914e3ffbe04b1dc93a09
SHA512ae83772ac964c5acfa6fd5595c72ebbb612e3fbe70ae3cdbb649d5e1b93cf4d292661e2ce85412426b93f94ed707c982758a3ceaeba6df6ce81d84d940b4694d
-
Filesize
272B
MD5edc60411a49a690176ca722c4b7f4f42
SHA1d7140e43e3b173c21b83adc7b52ca7a4f83d10c3
SHA256929c8a6fdb3cdd3053b3c432783b82e3a4ac7e8a7133190ac0680ebb45413643
SHA512e9478a7506c202acddeabb116c9fd07fcc68e83914ac9a20c7878a7f1fcaea7abe5500f2a9233e35fac227c82a5be2120043e77873cfa03847fdbe3eb49beb9c
-
Filesize
3KB
MD5eac8c4ff04ab7873915b7bd3f3b3a93f
SHA11ed9d038c47421cebdad2661021e38d2726cc873
SHA256fcd64206123218d85b23f139ed0315451889cec9e09ecb023247b3b10a3a7d2c
SHA5126e0f83edd21883ca403e5435cc6837e5de8e15e1a3a7c51b664cef20cba7e0217ccaa1255a270e88b92389026f3df7096c9dc2e68f0c23d1b5a155c8f448397c
-
Filesize
512KB
MD5895a38bc3fc7a0b21cadbf5b306faff7
SHA130c3c92c4e9fbd61db6dcff4ad1a42a6d5312e09
SHA2567a093c88448db7ce4e48155a1a14a15ee3f9f850ddd5853c2597869bcdd004ee
SHA51201bbcd194671e08cbeab90592756cf8c7f8f03248cf99d195986d45006dfc7b2d1e31808887dfcafa9261b1e92b4bf5ecf0afcda3fd279ab8e2173c3e1834d4e
-
Filesize
656KB
MD53a5105ff03e7b827b68b650bae59f7ce
SHA1b7dd7f343228e875eaaea019f0751ba5751be9f0
SHA256b5a39772351cbe7f8a5efd9eef8454d86535dbba0d4a600dd9645b7976b88a6c
SHA51299d64f0cc8f94ec3485aec5ca4e2116cfb6a94155a09ce04816d7275b8b91fe056ff3fd17e260a4ff722f3e18b8ccf7a09b6bbdde3609474bda6d2372c0207fc
-
Filesize
716KB
MD55dfaf279da48526e9e186dfec598f431
SHA100c23acfab8a62a06d15656f67fc4d2ebaf90cf7
SHA256cb9b17194b0287b9d1ade901466bf1b0657c28bf23f9ae8d3bc20d109c1e3100
SHA51260e07079f978c0af89435777709777bb641eaae39eb38b0451a7288377b906eea48726b80ac80a78d6d33d1f188841af058c48cc6e4442355c2bf9dd9aab78d2
-
Filesize
320KB
MD55203b6ea0901877fbf2d8d6f6d8d338e
SHA1c803e92561921b38abe13239c1fd85605b570936
SHA2560cc02d34d5fd4cf892fed282f98c1ad3e7dd6159a8877ae5c46d3f834ed36060
SHA512d48a41b4fc4c38a6473f789c02918fb7353a4b4199768a3624f3b685d91d38519887a1ccd3616e0d2b079a346afaec5a0f2ef2c46d72d3097ef561cedb476471