0674a9370b11490624738f77781ed6acec5485f5d5e4d5e76209ca99d369b325

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 05:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe
Size

889KB
MD5

8a5f051b4f28f1c1e11625ef65416e8f
SHA1

4ba7a2254ae00713d6f68c93c6018401b0341df7
SHA256

0674a9370b11490624738f77781ed6acec5485f5d5e4d5e76209ca99d369b325
SHA512

1e1c19a551be9c8702b232ed21c1999e025240407ab0eefef6cb94498f699557d9d78958a54619e1c6122513614633a5c7690ce9cea1f8f439120af13413b0ee
SSDEEP

12288:KDMZ2UOv2HCCVIiG6bmp6wyNBUJmHDrRfk9qKv6a+cN8Lf1VMNc:zZm+LG6bmp6hNBUJmHD1gvBNKNVMW

Score

8^/10

bootkit discovery persistence upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\drivers\sysvservice.sys	TTSetup.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	gins.exe

Executes dropped EXE 4 IoCs

pid	Process
5856	SeMiniSetup_3170_1202.exe
5592	drInstall.exe
2112	TTSetup.exe
4212	gins.exe

Loads dropped DLL 1 IoCs

pid	Process
5520	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	SeMiniSetup_3170_1202.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HookPool.sys	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe
File created	C:\Windows\SysWOW64\drInstall.exe	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe
File created	C:\Windows\SysWOW64\gins.exe	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002426f-20.dat	upx
behavioral2/memory/5592-23-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/files/0x0007000000024270-29.dat	upx
behavioral2/memory/5592-41-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/2112-38-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/4212-54-0x0000000010000000-0x000000001003A000-memory.dmp	upx
behavioral2/memory/4212-58-0x0000000010000000-0x000000001003A000-memory.dmp	upx
behavioral2/memory/4212-57-0x0000000010000000-0x000000001003A000-memory.dmp	upx
behavioral2/memory/4212-56-0x0000000010000000-0x000000001003A000-memory.dmp	upx
behavioral2/memory/4212-68-0x0000000010000000-0x000000001003A000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\msclientlogo.jpg	TTSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SeMiniSetup_3170_1202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TTSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gins.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dc8be0b564d67345b0cfc025d45f55ed000000000200000000001066000000010000200000007d462f5c252c044f2708d40afc7fb406ed2a1b04ee1b590b8ddb0bc194e0f7d5000000000e8000000002000020000000b3de6750d6e8d2ac1168b6cdbd1f89baafeb4ff4716fc62fa4f62ebdc77bbd47200000005b466b24761140e914a0e5353340c893453850dda3a33a29610bf4b343cba285400000000e477fbd5973544093bccd59f260da3db207294d45230d22fd93d058fe2373a3e611e01b6d828cd175976dc0dec26c61a6567e6da77e2b53978db3208c319abf	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 700f527ba49fdb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dc8be0b564d67345b0cfc025d45f55ed00000000020000000000106600000001000020000000aabcfee9802630e110c58c506097091fc62540b9f6a1a412ff118d3570d924f7000000000e80000000020000200000000767cfeb8c1286aa4841fc009c1a199eb4e326f46dc3b631c3c8a0cc58ff49542000000012ffa8e5d1b677b923ca924e2a54e0c6dc3d97ee43726615658d1343ef5d3e6c400000008d08252bc157f54909791efe4f61c3b190fd0aae068524a3423e5ab59c67281537330b1d3d16d1f8bfe154a0d110a5f69d1270907c71e29b3e8d5423d599606a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dc8be0b564d67345b0cfc025d45f55ed00000000020000000000106600000001000020000000d853bc98c4855c87b148bc131c984aafe02415d1397340cdd7974695a6a87462000000000e800000000200002000000095a9422b7228153e42e3c39ad63a3c58aef5b72dd402594fa6a91d10aa87b1bc2000000060cfc65776c4e586a59c45f2f2b794056a39b51a76bc955cbc49e38e991f11dc400000004c8b7b7b7ed268596a2c28e4340dca93934e8cd527f32040bd3fc5848551f8150f1765671e8ed692e7a63df4bc303f4d7da8129a0fb8db959fa43b33f55a923c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e069c4b6a49fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9099487ba49fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A6336B95-0B97-11F0-86E9-E628F4A4DBAC} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "449905615"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 507d0890a49fdb01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dc8be0b564d67345b0cfc025d45f55ed00000000020000000000106600000001000020000000b1d5597fbe61a82af32075e6dab2c2efbc340b7e0d3c9177757fd964b6026520000000000e80000000020000200000003d4539d253fa4187ba1cf03589999e1da4e44b0039466cd9a45272e6791815e420000000ce7d699826c296c6375a9230cc55ab0d4c1fb794ce8d656f4b35be7f8ef7d1744000000050b043682503e4944fa8c6e511073decc08ef2f8c9679063b46c64747969e12772ef88069d3850ac63e28d9cf436f6671e7ba2794d5093a6763c5104fd5466b5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
4536	iexplore.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
5856	SeMiniSetup_3170_1202.exe
5856	SeMiniSetup_3170_1202.exe
4536	iexplore.exe
4536	iexplore.exe
4596	IEXPLORE.EXE
4596	IEXPLORE.EXE
4596	IEXPLORE.EXE
4596	IEXPLORE.EXE
4536	iexplore.exe
4536	iexplore.exe
5600	IEXPLORE.EXE
5600	IEXPLORE.EXE
5600	IEXPLORE.EXE
5600	IEXPLORE.EXE
4536	iexplore.exe
4536	iexplore.exe
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5520 wrote to memory of 5856	5520	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe	86
PID 5520 wrote to memory of 5856	5520	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe	86
PID 5520 wrote to memory of 5856	5520	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe	86
PID 5520 wrote to memory of 5592	5520	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe	87
PID 5520 wrote to memory of 5592	5520	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe	87
PID 5520 wrote to memory of 5592	5520	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe	87
PID 5520 wrote to memory of 2112	5520	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe	90
PID 5520 wrote to memory of 2112	5520	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe	90
PID 5520 wrote to memory of 2112	5520	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe	90
PID 5520 wrote to memory of 4212	5520	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe	92
PID 5520 wrote to memory of 4212	5520	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe	92
PID 5520 wrote to memory of 4212	5520	JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe	92
PID 4212 wrote to memory of 4536	4212	gins.exe	93
PID 4212 wrote to memory of 4536	4212	gins.exe	93
PID 4536 wrote to memory of 4596	4536	iexplore.exe	95
PID 4536 wrote to memory of 4596	4536	iexplore.exe	95
PID 4536 wrote to memory of 4596	4536	iexplore.exe	95
PID 4212 wrote to memory of 5540	4212	gins.exe	112
PID 4212 wrote to memory of 5540	4212	gins.exe	112
PID 4536 wrote to memory of 5600	4536	iexplore.exe	113
PID 4536 wrote to memory of 5600	4536	iexplore.exe	113
PID 4536 wrote to memory of 5600	4536	iexplore.exe	113
PID 4212 wrote to memory of 3704	4212	gins.exe	115
PID 4212 wrote to memory of 3704	4212	gins.exe	115
PID 4536 wrote to memory of 2068	4536	iexplore.exe	116
PID 4536 wrote to memory of 2068	4536	iexplore.exe	116
PID 4536 wrote to memory of 2068	4536	iexplore.exe	116

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a5f051b4f28f1c1e11625ef65416e8f.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5520
- C:\Users\Admin\AppData\Local\Temp\SeMiniSetup_3170_1202.exe
  "C:\Users\Admin\AppData\Local\Temp\SeMiniSetup_3170_1202.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5856
- C:\Windows\SysWOW64\drInstall.exe
  "C:\Windows\system32\drInstall.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5592
- C:\Users\Admin\AppData\Local\Temp\TTSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\TTSetup.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2112
- C:\Windows\SysWOW64\gins.exe
  "C:\Windows\system32\gins.exe" /p-10611/-s4972/leoaedo
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.so456.cn/cjtest/conf.jsp?v=4&pk=10611&uid=xZlkRnktkreEU4eJMy3LHb91lI7FSYnF
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4536 CREDAT:17410 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:4596
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4536 CREDAT:17418 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:5600
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4536 CREDAT:17426 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2068
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.so456.cn/cjtest/conf.jsp?v=4&pk=10611&uid=xZlkRnktkreEU4eJMy3LHb91lI7FSYnF
    3⤵
    - Modifies Internet Explorer settings
    PID:5540
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.so456.cn/cjtest/conf.jsp?v=4&pk=10611&uid=xZlkRnktkreEU4eJMy3LHb91lI7FSYnF
    3⤵
    - Modifies Internet Explorer settings
    PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
471B

MD5
4a326b4601ab30dfcfec12796d4473af

SHA1
fcc8ab255f002787a2f4756a6e7aaebc4ca0b5ff

SHA256
58c3470bcc9b953996e86f7741d7a6b1afe327c1c65788c2ef262c1beb6df10c

SHA512
2462008010263772ed24dbf2e6b9c002e29334c7529ddbc5f8272dbb41d5eb54dcc9556ade4dab79f32a10cdff67520882a5505f80dd23a752ea69407afd654e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
b889858a4ae4cc3420748cc86836d725

SHA1
983e956b96fef29e2967340d75a6bb0d3a79907f

SHA256
7112754a442c3d0dbf7dfa8d0d44963a3845dd9e5aea1e712ec2c25e67b6a118

SHA512
92802a417381f57af417ac3033d58d8860dd605584d746c5d672c88246eac854fc792e8fbdef445bb73eaa2bff72b7ffb6f949e4e2cc886ac74ef9f0095b0563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MSRA1ROA\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\SeMiniSetup_3170_1202.exe

Filesize
173KB

MD5
f7c61469c6f620345969e1654f3d8ce5

SHA1
25ef4a62e384bf53505b04b77078a7348e8849eb

SHA256
9f2aad3392eba89353494d3136e65435a37740a8143503b23e6fe55c27a3c84e

SHA512
5a0e127e78a29fb3f0d0c8935b590c0c702c5e4e1907e0dac969f79ff6a242deb1b2ef66144371a37bce8a99f611d8a3a88978f47e8f097feb3303434bc1c889

Download Submit
C:\Users\Admin\AppData\Local\Temp\TTSetup.exe

Filesize
87KB

MD5
9a19004a1ac13005b17a1a28732100a5

SHA1
0e6a8a911a1397154c4da68547432f2929d69718

SHA256
7a49567834a7868336b02fe25abd08bc4a47c29c466137d4e4b37db36006593e

SHA512
a7ef22d35efebb75b896a56e226c15343ead69576d805198add47cdf031dc548cc5116a4824015248bec9c9fe5db9fda18ace656a987acf409cc8fb30ca69423

Download Submit
C:\Users\Admin\AppData\Local\Temp\pyd.dll

Filesize
82KB

MD5
2a23408ebe5285f0a76850366ecf25f5

SHA1
d38ca629f27f150869d725663842c1af680a1ea5

SHA256
ccbc1ede8afc097b0ddc0b9fcd2d160856c35de77102c1cf5b5f37635d1ba9dd

SHA512
54a946897300ffa3588abd30bb3d850f5ec55283a2dbae4ad8f19e1269361bac23228a1a0d881c4ff9c3df02ebe0b4048730b155a7e2d60c53ed6f66ef953991

Download Submit
C:\Windows\SysWOW64\drInstall.exe

Filesize
25KB

MD5
635d1f8c9c39a393840df7f352c10c9d

SHA1
8514f914961d04b8429c36182e8dc28e2909e135

SHA256
d1a204e0aa9dd4feb37ae32eac96dc89cd03be642c1b4a14fd5c95da463e4f32

SHA512
1acb5f84d0ba5f459963f2582acfffbb8335b83fc4bc7cb288412dbf3deb969990b733b71996908247713c3f10ad0e18906f3a7818c292d1eb37fb449c528576

Download Submit
C:\Windows\SysWOW64\gins.exe

Filesize
355KB

MD5
b9895803749177aa81d77008c3be67a8

SHA1
a222ae972db82897a071dd868ba059e2f59fce3a

SHA256
b3c94776c381d09d8ad0fd57e0c6332d2fb61081915e0f245608fdddca98a014

SHA512
cd69645e9a16a4344c40e02bda17bcb3c01909249925acf8fb33b43e6c0fb47a047074c41938cd6ca86142cd5411b59ac0d6a57c55c14431bcd5db95c7b4c0b8

Download Submit
memory/2112-38-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2112-33-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4212-54-0x0000000010000000-0x000000001003A000-memory.dmp

Filesize
232KB

Download
memory/4212-58-0x0000000010000000-0x000000001003A000-memory.dmp

Filesize
232KB

Download
memory/4212-57-0x0000000010000000-0x000000001003A000-memory.dmp

Filesize
232KB

Download
memory/4212-56-0x0000000010000000-0x000000001003A000-memory.dmp

Filesize
232KB

Download
memory/4212-68-0x0000000010000000-0x000000001003A000-memory.dmp

Filesize
232KB

Download
memory/5592-41-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5592-23-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads