Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 09:52
Behavioral task
behavioral1
Sample
19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe
-
Size
856KB
-
MD5
19b1ebe945eba2160bda0e11bea0bdaf
-
SHA1
80793281817a8d2410b09f084f5139a2a584c5ab
-
SHA256
d621a81ba7341a8216044af61f55b0151d3b0f68c2917b6ba46a104c9a087d98
-
SHA512
ec19b2db00cae34e732a11312113b36ae68e8e60a072258b39b9925b1edf8a9ba068f488193f4ae558e8579ff501788d1a087b2e4d43f17ca46fc011762d3289
-
SSDEEP
12288:cJjCWhgzbB+8PtV9m2YkA4UrCuMtfQBSo7n4fUT2a6A2QeTF0XhMdUyGtd:cJmmgPZPikA43xsr4Y2a6A2nChuUr
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\31651cc6\\X" Explorer.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
HM23Yh.execqnap.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" HM23Yh.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cqnap.exe -
ModiLoader Second Stage 10 IoCs
Processes:
resource yara_rule behavioral1/memory/2292-14-0x0000000000400000-0x000000000052D000-memory.dmp modiloader_stage2 behavioral1/memory/2292-13-0x0000000000400000-0x000000000052D000-memory.dmp modiloader_stage2 behavioral1/memory/2844-10-0x0000000000400000-0x0000000000420000-memory.dmp modiloader_stage2 \Users\Admin\awhost.exe modiloader_stage2 behavioral1/memory/3028-70-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 \Users\Admin\bwhost.exe modiloader_stage2 behavioral1/memory/1460-92-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral1/memory/2292-94-0x0000000000400000-0x000000000052D000-memory.dmp modiloader_stage2 behavioral1/memory/2292-106-0x0000000000340000-0x0000000000384000-memory.dmp modiloader_stage2 behavioral1/memory/2292-192-0x0000000000400000-0x000000000052D000-memory.dmp modiloader_stage2 -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1464 cmd.exe -
Executes dropped EXE 12 IoCs
Processes:
HM23Yh.execqnap.exeawhost.exeawhost.exebwhost.exebwhost.execwhost.exedwhost.execsrss.exeXExplorer.EXEewhost.exepid process 2700 HM23Yh.exe 2500 cqnap.exe 3028 awhost.exe 2776 awhost.exe 1460 bwhost.exe 2068 bwhost.exe 1452 cwhost.exe 1264 dwhost.exe 332 csrss.exe 1220 X 1172 Explorer.EXE 1748 ewhost.exe -
Loads dropped DLL 18 IoCs
Processes:
19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exeHM23Yh.exedwhost.exeXpid process 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 2700 HM23Yh.exe 2700 HM23Yh.exe 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 1264 dwhost.exe 1264 dwhost.exe 1264 dwhost.exe 1220 X 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/2292-3-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2292-14-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2292-13-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2292-12-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2292-5-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2292-2-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2068-89-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2068-85-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2068-83-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2068-97-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2068-96-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2292-94-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/2292-105-0x0000000000340000-0x0000000000384000-memory.dmp upx behavioral1/memory/2068-168-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2292-192-0x0000000000400000-0x000000000052D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 51 IoCs
Processes:
cqnap.exeHM23Yh.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /h" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /R" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /J" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /a" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /o" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /Q" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /q" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /w" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /t" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /e" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /W" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /d" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /f" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /K" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /z" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /N" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /U" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /M" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /j" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /r" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /B" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /v" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /S" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /C" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /g" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /i" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /y" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /O" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /I" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /x" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /p" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /X" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /n" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /k" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /m" HM23Yh.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /b" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /D" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /L" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /Y" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /s" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /Z" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /m" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /T" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /A" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /u" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /V" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /P" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /G" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /F" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /l" cqnap.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqnap = "C:\\Users\\Admin\\cqnap.exe /H" cqnap.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
csrss.exedescription ioc process File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
awhost.exebwhost.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum awhost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 awhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum bwhost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 bwhost.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exeawhost.exebwhost.exedwhost.exedescription pid process target process PID 2844 set thread context of 2292 2844 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe PID 3028 set thread context of 2776 3028 awhost.exe awhost.exe PID 1460 set thread context of 2068 1460 bwhost.exe bwhost.exe PID 1264 set thread context of 2512 1264 dwhost.exe cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 2484 tasklist.exe 2924 tasklist.exe -
Modifies registry class 3 IoCs
Processes:
explorer.exedescription ioc process Key created \registry\machine\Software\Classes\Interface\{4b89fadc-d2b0-6551-b01d-9b7a6354fa3a} explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4b89fadc-d2b0-6551-b01d-9b7a6354fa3a}\u = "860049491" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4b89fadc-d2b0-6551-b01d-9b7a6354fa3a}\cid = "7319361323636869658" explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
HM23Yh.execqnap.exeawhost.exebwhost.exeexplorer.exeXpid process 2700 HM23Yh.exe 2700 HM23Yh.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2776 awhost.exe 2776 awhost.exe 2776 awhost.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2068 bwhost.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 1364 explorer.exe 1364 explorer.exe 1364 explorer.exe 1220 X 2500 cqnap.exe 2776 awhost.exe 2776 awhost.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2776 awhost.exe 2776 awhost.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2776 awhost.exe 2776 awhost.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2776 awhost.exe 2776 awhost.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe 2776 awhost.exe 2776 awhost.exe 2500 cqnap.exe 2500 cqnap.exe 2500 cqnap.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tasklist.exeexplorer.exetasklist.exedescription pid process Token: SeDebugPrivilege 2484 tasklist.exe Token: SeDebugPrivilege 1364 explorer.exe Token: SeDebugPrivilege 2924 tasklist.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exeHM23Yh.execqnap.exeewhost.exepid process 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 2700 HM23Yh.exe 2500 cqnap.exe 1748 ewhost.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
csrss.exepid process 332 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exeHM23Yh.execmd.exeawhost.exebwhost.execwhost.exedescription pid process target process PID 2844 wrote to memory of 2292 2844 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe PID 2844 wrote to memory of 2292 2844 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe PID 2844 wrote to memory of 2292 2844 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe PID 2844 wrote to memory of 2292 2844 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe PID 2844 wrote to memory of 2292 2844 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe PID 2844 wrote to memory of 2292 2844 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe PID 2844 wrote to memory of 2292 2844 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe PID 2844 wrote to memory of 2292 2844 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe PID 2292 wrote to memory of 2700 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe HM23Yh.exe PID 2292 wrote to memory of 2700 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe HM23Yh.exe PID 2292 wrote to memory of 2700 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe HM23Yh.exe PID 2292 wrote to memory of 2700 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe HM23Yh.exe PID 2700 wrote to memory of 2500 2700 HM23Yh.exe cqnap.exe PID 2700 wrote to memory of 2500 2700 HM23Yh.exe cqnap.exe PID 2700 wrote to memory of 2500 2700 HM23Yh.exe cqnap.exe PID 2700 wrote to memory of 2500 2700 HM23Yh.exe cqnap.exe PID 2700 wrote to memory of 2692 2700 HM23Yh.exe cmd.exe PID 2700 wrote to memory of 2692 2700 HM23Yh.exe cmd.exe PID 2700 wrote to memory of 2692 2700 HM23Yh.exe cmd.exe PID 2700 wrote to memory of 2692 2700 HM23Yh.exe cmd.exe PID 2692 wrote to memory of 2484 2692 cmd.exe tasklist.exe PID 2692 wrote to memory of 2484 2692 cmd.exe tasklist.exe PID 2692 wrote to memory of 2484 2692 cmd.exe tasklist.exe PID 2692 wrote to memory of 2484 2692 cmd.exe tasklist.exe PID 2292 wrote to memory of 3028 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe awhost.exe PID 2292 wrote to memory of 3028 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe awhost.exe PID 2292 wrote to memory of 3028 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe awhost.exe PID 2292 wrote to memory of 3028 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe awhost.exe PID 3028 wrote to memory of 2776 3028 awhost.exe awhost.exe PID 3028 wrote to memory of 2776 3028 awhost.exe awhost.exe PID 3028 wrote to memory of 2776 3028 awhost.exe awhost.exe PID 3028 wrote to memory of 2776 3028 awhost.exe awhost.exe PID 3028 wrote to memory of 2776 3028 awhost.exe awhost.exe PID 3028 wrote to memory of 2776 3028 awhost.exe awhost.exe PID 3028 wrote to memory of 2776 3028 awhost.exe awhost.exe PID 3028 wrote to memory of 2776 3028 awhost.exe awhost.exe PID 3028 wrote to memory of 2776 3028 awhost.exe awhost.exe PID 3028 wrote to memory of 2776 3028 awhost.exe awhost.exe PID 3028 wrote to memory of 2776 3028 awhost.exe awhost.exe PID 2292 wrote to memory of 1460 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe bwhost.exe PID 2292 wrote to memory of 1460 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe bwhost.exe PID 2292 wrote to memory of 1460 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe bwhost.exe PID 2292 wrote to memory of 1460 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe bwhost.exe PID 1460 wrote to memory of 2068 1460 bwhost.exe bwhost.exe PID 1460 wrote to memory of 2068 1460 bwhost.exe bwhost.exe PID 1460 wrote to memory of 2068 1460 bwhost.exe bwhost.exe PID 1460 wrote to memory of 2068 1460 bwhost.exe bwhost.exe PID 1460 wrote to memory of 2068 1460 bwhost.exe bwhost.exe PID 1460 wrote to memory of 2068 1460 bwhost.exe bwhost.exe PID 1460 wrote to memory of 2068 1460 bwhost.exe bwhost.exe PID 1460 wrote to memory of 2068 1460 bwhost.exe bwhost.exe PID 2292 wrote to memory of 1452 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe cwhost.exe PID 2292 wrote to memory of 1452 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe cwhost.exe PID 2292 wrote to memory of 1452 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe cwhost.exe PID 2292 wrote to memory of 1452 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe cwhost.exe PID 1452 wrote to memory of 1364 1452 cwhost.exe explorer.exe PID 1452 wrote to memory of 1364 1452 cwhost.exe explorer.exe PID 1452 wrote to memory of 1364 1452 cwhost.exe explorer.exe PID 1452 wrote to memory of 1364 1452 cwhost.exe explorer.exe PID 1452 wrote to memory of 1364 1452 cwhost.exe explorer.exe PID 1452 wrote to memory of 1364 1452 cwhost.exe explorer.exe PID 2292 wrote to memory of 1264 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe dwhost.exe PID 2292 wrote to memory of 1264 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe dwhost.exe PID 2292 wrote to memory of 1264 2292 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe dwhost.exe
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe3⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\HM23Yh.exeC:\Users\Admin\HM23Yh.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\cqnap.exe"C:\Users\Admin\cqnap.exe"5⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del HM23Yh.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\awhost.exeC:\Users\Admin\awhost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\awhost.exeawhost.exe5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\bwhost.exeC:\Users\Admin\bwhost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\bwhost.exebwhost.exe5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\cwhost.exeC:\Users\Admin\cwhost.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe00000088*5⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\dwhost.exeC:\Users\Admin\dwhost.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\31651cc6\X193.105.154.210:805⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
-
C:\Users\Admin\ewhost.exeC:\Users\Admin\ewhost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 19b1ebe945eba2160bda0e11bea0bdaf_JaffaCakes118.exe4⤵
- Deletes itself
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Modify Registry
3Hide Artifacts
1Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\31651cc6\@Filesize
2KB
MD59f07c4a67dbf752b6e32e815c0ac7728
SHA1faef5b8f91e00af204351136aa884ce790c70c55
SHA2567ead63d0c9b4261f952aeaacd5a61a99998df9a07f3b5d770e8e7c8910b76651
SHA512280cc13e0af907b5779cfda9902dea5618eae5e844e09912f2685c7df52ce9fa15b93eb05f71e52fae30d425a6fa540b29a78210414004f4ba4fc8c87408ce4e
-
C:\Windows\system32\consrv.DLLFilesize
52KB
MD5c7570a7e24b29ee04a48c2c99da2587b
SHA1b6e3635a8de44b1635e8d362ac131e14281feb24
SHA256717cd7661c09701ee39c505d8b604ea3dd6c1151ef18e7ed1cab3832552ac34b
SHA51257479d2f5386ace8cc5e5ed543e6ad2c2b7b58accc849807d804a8cf0d03080f328f7b42442422fa1483a01ad473ca302f9eca97b9eb24e699e22db56641c572
-
\??\globalroot\systemroot\assembly\temp\@Filesize
2KB
MD555b057db16c51dfdc7d018c3fe7a3376
SHA1fae1c676f7b1d7611093aae3546d9eedc4f30e01
SHA256045f52a63cbc33f39c5026883a4e72165561b43940e2ff601bbb51df9c737e57
SHA512ab48cf93c634bf8865a22c9ed771f8f6bed56b1be8570f5d4112eda91c16fccd4a21b05aa6ace3bab080d924a735f6c232e1bb0aad6099b1730b32d3016026c7
-
\Users\Admin\AppData\Local\31651cc6\XFilesize
41KB
MD5686b479b0ee164cf1744a8be359ebb7d
SHA18615e8f967276a85110b198d575982a958581a07
SHA256fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b
SHA5127ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64
-
\Users\Admin\HM23Yh.exeFilesize
224KB
MD5b9204dce58a6e81de3b3306eb6cb03e5
SHA1ceb777de961f82c42b9b71dca67b8e56a31908a3
SHA256438f71f74c972c3ed35a21bbc93cbc8dd1fb3cf17fd789ae730e60e53816b472
SHA512f555f397416efd33bf9591dd08ad27a4dfed1d26cbfb9d73dc4c3ae130da8ce254d4bfc1e70406f3c92565d28e045469b3ba3b172bd5d19c5876708bb1aa37ed
-
\Users\Admin\awhost.exeFilesize
270KB
MD55efdb148d618a6b6d2369fccd60f4212
SHA17e2045b55c33af87848088738215af2bf7ad0b9b
SHA256db7e3eef1813f386579a2dd11587077c6888809ac9c9e33c7584eb301402203b
SHA512e63d8d4caf1cc98bc9beb168302c89885b12175a5802e2e7f507d30bce04eb67ce1f81519f544da297bbb581f59c5baab8ed3fd9b3f7f911a884095603587a21
-
\Users\Admin\bwhost.exeFilesize
157KB
MD52dd258fd2e5a7fccd81b8af93c08780b
SHA1a5373acdb7f4684b032954e9e754593ddcc827b2
SHA25600d8a5382bc4f61a6836bc2b22c05b57485bdf2550188c456f1a854d8a885ca9
SHA51220048701859ed645bc678a3a45a3ef45cee1d31edfba2ab6cc8edbb03bad6174b541694ac09f4dc58c58241a93d592deb049c33d22ef3cc9f0a6eaac925111df
-
\Users\Admin\cqnap.exeFilesize
224KB
MD5b70e0608d336439c3d7dd29d41c9313b
SHA161a5cede6c2437249deb18d2d5bb0237b5513f28
SHA2564a07f134dbc1886399758e36f24604c9fa4974bd37b85f051c822572effcc2db
SHA512b4fa809cceb1cd0d4c784de6c25738c0b0c86fc6d22de94f7ddd18db5db1b09a56e799a2a646d1ef5f0660dcb3d2f7970b019b0b915539564448268765f4850c
-
\Users\Admin\cwhost.exeFilesize
150KB
MD5d91ada984db5e7adbf2b80c2284c12f6
SHA131e9b27095ac041687b016006f41ea6e5222202d
SHA2568cbabd93630154a79f8f0c52964f330b44b427631403c3eef4b6c6fc87649948
SHA5128a0eea5b8ffc4c8d4bdf1e551e6c11e8d188f2209666e2f4b6a74bed99105264510a612a7a1e72f7142584386891ab4aa95946110b8fe623d5b2035494da0748
-
\Users\Admin\dwhost.exeFilesize
333KB
MD51aceb282a6d05fcc08f3f74f5483bf0a
SHA1778e34df0c35fee3ab8b7f1af14b2b4ce948ea7b
SHA256d62b7050a4ada5513bb9f24c79cf782a8675122ef7833bc8c91cb107fe71fc6d
SHA5125f2c02faa69f1f3f32affc898773d92738a9944a59ad2a28cebe192b0ad1089363c8e3bbc1d202097b160c1b2dada71fc0f03a1a0744dbc2c72cc3273a4629f8
-
\Users\Admin\ewhost.exeFilesize
36KB
MD54bcd12fdaa17197a658a5113af9120ec
SHA13ac79b0b793e390cf1dea82c1754ec34aab1ea46
SHA256e781bf0233fb732b4b6935255af5cf33b7f0a58bad54b70408c347d2e83dbf96
SHA512dab61b32fc43b2f55a197ebdf1b8c5709ed97e99530fb31a33ec077c25812f075733ff5e97cc5eebe01d8b83cd29ba104caba02b7a8cdf7e13f43e18432ccbdd
-
\Windows\assembly\GAC_32\Desktop.iniFilesize
4KB
MD580dbc7d15fdf94f16bb4a739cd9c3f98
SHA1c0f3f20b360ce78cc153fa514e5f62c06f68feb7
SHA25620b2d1e1b5348ed92f7e2eaedba4348e446970c13c6226f34a816503aa956c91
SHA512cf8d820104ee3db4a103fb19d38267fe2f5095a29777bf3bcde95d4299360681cedd421251af92038da3f8709e68f101f7326ad9abdd087a59ca83adec87bc48
-
\Windows\assembly\GAC_64\Desktop.iniFilesize
5KB
MD578ab98fd9228277f2638fd93cd703016
SHA11640ee7f500074c155a5af431e9d125a4ec2cea5
SHA256e0517a9584af6cfd4f1e6d280e086b20fd576b90b32f9ddac916de03a53b766c
SHA512d98ed49a83d5b50737a674e4421cea4cbe353f80234d2d5a8df82995a0d81e9524f23919ca600afb98bc676a8f93e7c0df73c22cae9b3fc624027800ba9dcc76
-
memory/332-135-0x0000000002550000-0x0000000002562000-memory.dmpFilesize
72KB
-
memory/1172-149-0x0000000002DC0000-0x0000000002DCB000-memory.dmpFilesize
44KB
-
memory/1364-112-0x00000000001F0000-0x0000000000209000-memory.dmpFilesize
100KB
-
memory/1364-117-0x00000000001F0000-0x0000000000209000-memory.dmpFilesize
100KB
-
memory/1364-122-0x00000000001F0000-0x0000000000209000-memory.dmpFilesize
100KB
-
memory/1452-111-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1452-107-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1460-92-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2068-89-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2068-96-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2068-168-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2068-81-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2068-85-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2068-83-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2068-97-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2292-5-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2292-0-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2292-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2292-192-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2292-106-0x0000000000340000-0x0000000000384000-memory.dmpFilesize
272KB
-
memory/2292-105-0x0000000000340000-0x0000000000384000-memory.dmpFilesize
272KB
-
memory/2292-94-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2292-14-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2292-13-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2292-12-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2292-3-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2292-2-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/2776-61-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2776-52-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2776-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2776-71-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2776-53-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2776-66-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2776-58-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2776-55-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2844-10-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3028-70-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB