Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 09:49
Behavioral task
behavioral1
Sample
04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe
-
Size
22.1MB
-
MD5
04eb4cc714e3c7efc57625896899cacf
-
SHA1
f9266bc71cdb14d7407006a28c2ec7c2e4f4c13e
-
SHA256
52a20ada632fa6e2a4b9d044a32eba735dc4ae0c31d574d488f1dad393619824
-
SHA512
8e905080d5144dada04e933ca3044b8985c1c5e257bc2274cbf88df238b3733ab63e085750bace5513e3f58bef7fd625354e5162e40728d4bc91afcdf78ced9f
-
SSDEEP
393216:dFgRrgjWT16Irf13GXFgRrgjWT16Irf13GP:Kg32g3h
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1160-0-0x0000000000400000-0x0000000000613000-memory.dmp family_blackmoon C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe family_blackmoon -
Processes:
04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe -
XMRig Miner payload 17 IoCs
Processes:
resource yara_rule behavioral2/memory/1160-0-0x0000000000400000-0x0000000000613000-memory.dmp xmrig C:\Windows\svchost.exe xmrig C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe xmrig behavioral2/memory/4244-277-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4244-392-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4244-393-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4244-395-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4244-397-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4244-399-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4244-401-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4244-419-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4244-420-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4244-429-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4244-430-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4244-538-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4244-539-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4244-540-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
Processes:
04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe" 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe" 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe" 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe" 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe" 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe" 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 4244 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe" 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe -
Processes:
04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\mstsc.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\autofmt.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\credwiz.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\forfiles.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\unlodctr.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrshost.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\dxdiag.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\quickassist.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\efsui.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\tasklist.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\tree.com 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\ftp.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\LaunchTM.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\raserver.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\rundll32.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\Taskmgr.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\cttunesvr.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\explorer.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\finger.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\instnm.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\scrnsave.scr 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\dialer.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\dpapimig.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\fsutil.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\wlanext.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\wusa.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\diskperf.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\OposHost.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\sxstrace.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\Fondue.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\powercfg.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\help.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\mtstocom.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\chcp.com 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\charmap.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\curl.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\setupugc.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmd.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmmon32.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\systray.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\TRACERT.EXE 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\ARP.EXE 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\bthudtask.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\PkgMgr.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\ROUTE.EXE 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\secinit.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\winver.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\attrib.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SysWOW64\DWWIN.EXE 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\chrmstp.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\WebviewOffline.html 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseHostPage.html 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99062\javaws.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.html 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exedescription ioc process File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\f\NarratorQuickStart.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.423_none_df344b9fe5390f25\AppResolverUX.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.19041.1_none_3e7b05a1a0865eeb\ktmutil.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\403-5.htm 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\500.htm 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\DisableAboutFlag.htm 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_ac2441dbb712f006\f\msra.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.1202_none_05856bbd8f935e6b\DataStoreCacheDumpTool.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.264_none_6ea6dfb6393e5f06\DataStoreCacheDumpTool.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.19041.1_none_e768b85cf7ad062e\TSWbPrxy.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\f\ScreenClipping\ScreenClippingHost.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_10.0.19041.1_none_23f80ea3f041fc17\SystemPropertiesProtection.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\hololensDiagnostics.html 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\404-7.htm 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.1_none_1f721a9c9befed5e\SyncHost.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobelocalngc-main.html 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\pdferrorunknownerror.html 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\es-ES\assets\ErrorPages\http_gen.htm 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\403-8.htm 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\config.json 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.19041.985_none_4a26c2c5164ad5c7\r\CIDiag.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.19041.1052_none_648fbf276da33ed4\f\NcsiUwpApp.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobeenterpriseprovisioning-main.html 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\startfresh.html 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\500-18.htm 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_45a6c0aa2ed16c7c\http_404.htm 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.423_none_2cade1bc915dca0d\f\Microsoft.AsyncTextService.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.19041.1_none_682105a41c3c7a6b\IMJPSET.EXE 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.264_none_dc8146375466099a\f\DWWIN.EXE 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\diskperf.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_f0e6f722ec2403d4\f\rrinstaller.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\forbidframingedge.htm 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.19041.1_none_97ed4bc868404e31\tcmsetup.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\r\PeopleExperienceHost.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_8c45e6e8b672ffff\r\sxstrace.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\systemreset.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_vmconnect6.3_31bf3856ad364e35_10.0.19041.1_none_5c4ad75abbc47892\vmconnect6.3.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.84_none_9d98e005fb7852ca\r\SecurityHealthService.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.1_none_255cf058436a8b63\gpscript.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.19041.746_none_e72c4ffca9db7315\f\lpkinstall.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\retailDemoAdvanced.html 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.1081_none_bdf809eb2dd695f9\r\AppVClient.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\r\wslconfig.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\f\wscript.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_9e3e509d4c4881e1\f\MuiUnattend.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.264_none_2649f3f85f3b49b1\wscript.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.572_none_b322aa88d0148356\f\ReAgentc.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\8e36994536e5d701189b00001815341f.iisreset.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobewelcome-main.html 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\DisableAboutFlag.htm 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\ScriptRunner.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\r\CredentialEnrollmentManager.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.19041.84_none_dc38e61c21c1b710\NetEvtFwdr.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.1_none_544850fb795d0a4f\changepk.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.662_none_0070027dab4e4ffe\r\UtcDecoderHost.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\pdferrorrenewrentallicense.html 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.1_none_e73c658ee671e530\ChtIME.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\f\WFS.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.746_none_03030718c597d891\f\sdclt.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_fefa067e67e7af8b\f\UserAccountBroker.exe 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.19041.207_none_504b6becabbef9fe\oobeprovisioningprogress-main.html 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\404-14.htm 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exesvchost.exedescription pid process Token: SeDebugPrivilege 1160 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe Token: 33 1160 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1160 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4244 svchost.exe Token: SeLockMemoryPrivilege 4244 svchost.exe Token: SeLockMemoryPrivilege 4244 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exepid process 1160 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exedescription pid process target process PID 1160 wrote to memory of 4244 1160 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe svchost.exe PID 1160 wrote to memory of 4244 1160 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04eb4cc714e3c7efc57625896899cacf_JaffaCakes118.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeFilesize
24.2MB
MD5ca428a454b92e5217e1b31c160f0d115
SHA12808f4a7eba5732f6c61c0bb3fc6722753f8eaa2
SHA25690cb9057c9940e5678e8b4c464ec21a3c45f69af4d9724833f5408bf4c7cd93f
SHA512ab070f4a2b937f2819e628445e8f36179ad31bad3a8f26474514b0fa76071d2b73b0739d3e68f7a7535e34b7051301cfcc8252ad8f2b817ae6336ad2c6fd8a27
-
C:\Windows\config.jsonFilesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
C:\vcredist2010_x64.log.htmlMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1160-0-0x0000000000400000-0x0000000000613000-memory.dmpFilesize
2.1MB
-
memory/4244-397-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/4244-420-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/4244-395-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/4244-392-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/4244-399-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/4244-401-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/4244-419-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/4244-393-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/4244-429-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/4244-430-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/4244-277-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/4244-538-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/4244-539-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/4244-540-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB