Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system -
submitted
13/04/2025, 19:05
General
-
Target
JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe
-
Size
274KB
-
MD5
b584f75071cc9d73de7f7db5a7cbcf14
-
SHA1
885b2091c3e13d300b80b04e3c74c6d89fcaeaa0
-
SHA256
83969dcd50dedef4fc7d1493504edbd8e3542fad4353fa455b58f34d591c17ba
-
SHA512
0c4d740a8b35ca0c363053556b0b4e04dd565006ca06585ac60833e4af2bb7fa64a8055e73724af281b52e826dc9df8a78833b9305a8873ebc0af94af8ffdad6
-
SSDEEP
6144:GoIHNqX4XQu0G0ZimEjF1O37l0pUWxoixWr35GWZ8Zd5ErOiyNw:8Nm4XQ6jF4pyx4hGZdqrO9C
Malware Config
Extracted
Family
cybergate
Version
v1.01.0
Botnet
BigMoney
C2
jeebuslmao.no-ip.biz:82
Mutex
CyberGate1
Attributes
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Winlog
-
install_file
Winlogon.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Due to technical difficulties, It is recommended to restart your computer. ERROR_NOT_ALL_ASSIGNED 1300 (0x514)
-
message_box_title
Error
-
password
bitchlol
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Adds policy Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Winlog\\Winlogon.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Key created \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Winlog\\Winlogon.exe" JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Winlog\\Winlogon.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 62 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Windows\\system32\\Winlog\\Winlogon.exe Restart" JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Windows\\system32\\Winlog\\Winlogon.exe" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0} Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3514GK5-0532-8XGM-F1V6-HI1EW14TS5X0}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe Restart" Winlogon.exe -
Executes dropped EXE 29 IoCs
pid Process 5840 Winlogon.exe 4020 Winlogon.exe 5592 Winlogon.exe 2128 Winlogon.exe 5412 Winlogon.exe 5572 Winlogon.exe 2732 Winlogon.exe 3912 Winlogon.exe 3160 Winlogon.exe 4784 Winlogon.exe 3020 Winlogon.exe 1996 Winlogon.exe 1820 Winlogon.exe 2708 Winlogon.exe 2816 Winlogon.exe 4700 Winlogon.exe 3800 Winlogon.exe 4616 Winlogon.exe 2620 Winlogon.exe 5256 Winlogon.exe 2176 Winlogon.exe 2168 Winlogon.exe 5000 Winlogon.exe 3556 Winlogon.exe 2452 Winlogon.exe 3832 Winlogon.exe 3512 Winlogon.exe 2140 Winlogon.exe 5932 Winlogon.exe -
Adds Run key to start application 2 TTPs 62 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\Winlog\\Winlogon.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\Winlog\\Winlogon.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\Winlog\\Winlogon.exe" JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\Winlog\\Winlogon.exe" JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\Winlog\\Winlogon.exe" Winlogon.exe -
Drops file in System32 directory 60 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File opened for modification C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe File created C:\Windows\SysWOW64\Winlog\Winlogon.exe Winlogon.exe -
resource yara_rule behavioral1/memory/3860-0-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/3860-3-0x0000000024010000-0x0000000024070000-memory.dmp upx behavioral1/memory/3860-22-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/3860-65-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral1/memory/316-70-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral1/files/0x000800000002429a-72.dat upx behavioral1/memory/316-77-0x0000000024070000-0x00000000240D0000-memory.dmp upx behavioral1/memory/5840-84-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/4020-91-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/5592-101-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2128-109-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/5412-115-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/5572-125-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2732-134-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/3160-140-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/4784-152-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/3912-151-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/3020-164-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/3160-163-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/4784-176-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1996-177-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1820-190-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/3020-189-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1996-203-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2816-217-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1820-216-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2708-231-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/4700-232-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2816-246-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/4700-261-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/4616-262-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/3800-276-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/4616-283-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2620-298-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/5256-326-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2176-340-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/5000-341-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2168-356-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2452-372-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/5000-371-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/3832-389-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/3556-388-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2452-392-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/3512-406-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/3832-410-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/2140-424-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/3512-441-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/5932-442-0x0000000000400000-0x0000000000456000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winlogon.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 5840 Winlogon.exe 5840 Winlogon.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 5840 Winlogon.exe 5840 Winlogon.exe 5840 Winlogon.exe 5840 Winlogon.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56 PID 3860 wrote to memory of 3452 3860 JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b584f75071cc9d73de7f7db5a7cbcf14.exe"2⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:316 -
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5840
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4020
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:5592
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2128
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:5412
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:5572
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2732
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3912
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3160
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4784
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3020
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1996
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1820
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2708
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2816
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4700
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3800
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:4616
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2620
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:5256
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2176
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2168
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:5000
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3556
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2452
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3832
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3512
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2140
-
-
C:\Windows\SysWOW64\Winlog\Winlogon.exe"C:\Windows\system32\Winlog\Winlogon.exe"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:5932
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
227KB
MD5edf75d54fd1f7aaec17f7cd49e326436
SHA1e474a3e072622c642df1a469f61c4326f196e085
SHA2565bbb7dfcc3253f59497e5cc09f5bf670f72c3efee646c5b576e8199d8bc56d39
SHA512c7c4e89e12c5af0f8ffb99b339b3246cab7b67a1c09f60d3480af6b045dd665d06981d76db2ad0e18027da194dba27c778e71b564ad39870d21b2f54885f824e
-
Filesize
227KB
MD5315ce145589dfb20ec18060519e7c34a
SHA1862a667bca4e8c83837ae84b6ef8f1874f2906f8
SHA256826ccb7480b6c6befc06696bb22dceab4f5fb44def240d2349befc24f29ebb92
SHA512da8d2d3b678e80effc6b617ed2b024828874f37280385f5562b1c10332f19fb005088e39e66e0cb68d2593fc261088c36d04db11b310adcf72cf23f8c5f4842b
-
Filesize
274KB
MD5b584f75071cc9d73de7f7db5a7cbcf14
SHA1885b2091c3e13d300b80b04e3c74c6d89fcaeaa0
SHA25683969dcd50dedef4fc7d1493504edbd8e3542fad4353fa455b58f34d591c17ba
SHA5120c4d740a8b35ca0c363053556b0b4e04dd565006ca06585ac60833e4af2bb7fa64a8055e73724af281b52e826dc9df8a78833b9305a8873ebc0af94af8ffdad6