Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 00:38
Behavioral task
behavioral1
Sample
9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe
-
Size
6.9MB
-
MD5
9327d8a117e01b69e61a7690fed88818
-
SHA1
394ab8c6728e2ffa1381e6afe3e52d15d44c6965
-
SHA256
b7691c583984fe210bbc5ce7291dd2a80dd969d7b33e25863c99311303febbc3
-
SHA512
b58962e98750064aa16e738b81ac76c39206ae6bb65c9ddf01a6cdd5bd2d979522bbb7a61544efe87ec0d6475965206d57459961214848d020acab25f113c47d
-
SSDEEP
98304:aQ8/Py9frbxvXKKkGxTVhG2+9Mpq6vQt/Ibt1YcyDgs:L8nylrZtjG9MpqINns
Malware Config
Signatures
-
Glupteba payload 1 IoCs
Processes:
resource yara_rule C:\Windows\rss\csrss.exe family_glupteba -
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 3976 netsh.exe 2964 netsh.exe -
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 3728 csrss.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NamelessRain = "\"C:\\Windows\\rss\\csrss.exe\"" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe -
Drops file in System32 directory 6 IoCs
Processes:
csrss.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 csrss.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content csrss.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 csrss.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft csrss.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache csrss.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData csrss.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
Processes:
9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\rss 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe File created C:\Windows\rss\csrss.exe 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
9327d8a117e01b69e61a7690fed88818_JaffaCakes118.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe9327d8a117e01b69e61a7690fed88818_JaffaCakes118.execsrss.exepid process 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 3728 csrss.exe 3728 csrss.exe 3728 csrss.exe 3728 csrss.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Token: SeImpersonatePrivilege 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
9327d8a117e01b69e61a7690fed88818_JaffaCakes118.execmd.execmd.exedescription pid process target process PID 4548 wrote to memory of 1928 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe cmd.exe PID 4548 wrote to memory of 1928 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe cmd.exe PID 1928 wrote to memory of 2964 1928 cmd.exe netsh.exe PID 1928 wrote to memory of 2964 1928 cmd.exe netsh.exe PID 4548 wrote to memory of 1860 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe cmd.exe PID 4548 wrote to memory of 1860 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe cmd.exe PID 1860 wrote to memory of 3976 1860 cmd.exe netsh.exe PID 1860 wrote to memory of 3976 1860 cmd.exe netsh.exe PID 4548 wrote to memory of 3728 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe csrss.exe PID 4548 wrote to memory of 3728 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe csrss.exe PID 4548 wrote to memory of 3728 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe csrss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\rss\csrss.exeFilesize
6.9MB
MD59327d8a117e01b69e61a7690fed88818
SHA1394ab8c6728e2ffa1381e6afe3e52d15d44c6965
SHA256b7691c583984fe210bbc5ce7291dd2a80dd969d7b33e25863c99311303febbc3
SHA512b58962e98750064aa16e738b81ac76c39206ae6bb65c9ddf01a6cdd5bd2d979522bbb7a61544efe87ec0d6475965206d57459961214848d020acab25f113c47d