Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 15:04
Behavioral task
behavioral1
Sample
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe
-
Size
8.4MB
-
MD5
05760fef1fd627d46931611dc620baa3
-
SHA1
44273abea6bc3e1a4c87baca2a46b8ee64186286
-
SHA256
14486854fd515f665f197df5240aea98b2fdce9a3240c4b81c464d69c6b511fb
-
SHA512
dfd641553d405e69a337ccdf2ca55f97ea2a470e4d715657eacf158ed44b7110899962ad90068d01461bd6e047451d9a3cd9ec9a1aace6561084ce98d9e9c27a
-
SSDEEP
196608:Ta9+6Y7SOEibgRVghMa9+6Y7SOEibgRVgh:TFgREMFgRE
Malware Config
Signatures
-
Detect Blackmoon payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4424-0-0x0000000000400000-0x0000000000619000-memory.dmp family_blackmoon C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe family_blackmoon behavioral2/memory/4424-394-0x0000000000400000-0x0000000000619000-memory.dmp family_blackmoon behavioral2/memory/4424-537-0x0000000000400000-0x0000000000619000-memory.dmp family_blackmoon -
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
XMRig Miner payload 19 IoCs
Processes:
resource yara_rule behavioral2/memory/4424-0-0x0000000000400000-0x0000000000619000-memory.dmp xmrig C:\Windows\svchost.exe xmrig C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe xmrig behavioral2/memory/2264-391-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2264-393-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4424-394-0x0000000000400000-0x0000000000619000-memory.dmp xmrig behavioral2/memory/2264-396-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2264-415-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2264-424-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2264-426-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2264-461-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4424-537-0x0000000000400000-0x0000000000619000-memory.dmp xmrig behavioral2/memory/2264-538-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2264-539-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2264-540-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2264-541-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2264-542-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2264-543-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2264-544-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2264 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/4424-0-0x0000000000400000-0x0000000000619000-memory.dmp upx C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe upx behavioral2/memory/4424-394-0x0000000000400000-0x0000000000619000-memory.dmp upx behavioral2/memory/4424-537-0x0000000000400000-0x0000000000619000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\perfhost.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\choice.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\net.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\colorcpl.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\comp.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\raserver.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\wevtutil.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\cipher.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\PING.EXE 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\wlanext.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\wowreg32.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\scrnsave.scr 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\autofmt.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\findstr.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\openfiles.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\dpapimig.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\efsui.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\mshta.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\proquota.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\ReAgentc.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\WerFault.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\bootcfg.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\xwizard.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\ROUTE.EXE 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\ttdinject.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\diskperf.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\msfeedssync.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\msiexec.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\stordiag.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\makecab.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasautou.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\autochk.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\control.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\ktmutil.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\rrinstaller.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\AtBroker.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\isoburn.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\msdt.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\svchost.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\lodctr.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\mstsc.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\taskkill.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\xcopy.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmstp.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\ddodiag.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\setupugc.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SysWOW64\TpmTool.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateOnDemand.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\Windows Mail\wab.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\ThirdPartyNotices\ThirdPartyNotices.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.844_none_64d33f8fb364398c\net1.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.19041.746_none_0119299746221375\r\XBox.TCUI.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.19041.662_none_746c3bfaa509091f\r\dtdump.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.19041.1_none_61ef8d34a0953a91\WMIC.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_20a89186aedb6af7\f\msinfo32.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_a40a1f93665b43eb\f\SndVol.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_d8ed4acdd3960fad\f\wecutil.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_72c6a00123f43c47\r\quickassist.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.1_none_b3f4f49ac9993d28\SensorDataService.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\r\MoUsoCoreWorker.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_d19001beed7624dc\r\CertEnrollCtrl.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.19041.1_none_0cfdc32c8765ead4\LinqWebConfig.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\413-1.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\VisualProfiler.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.264_none_b435e08254cda322\f\printui.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_8a7b0186743e499b\runonce.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.19041.746_none_77bd4cfbe87238a7\r\SnippingTool.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_windows-defender-management-v1_31bf3856ad364e35_10.0.19041.746_none_f89edd426718e367\ConfigSecurityPolicy.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.19041.1_none_48cfaff3d4e720e6\ktmutil.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\404-11.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.1202_none_c0150a0a443c0ffc\wbadmin.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\http_403.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\replace.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\r\InputApp\TextInputHost.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1081_none_8b145c40e6c6207f\winrs.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx35linq-edmgen_31bf3856ad364e35_10.0.19041.1_none_646d0595db3c1ad4\EdmGen.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.1_none_96907e39a64a62d0\mmgaserver.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\f\WpcUapApp.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\r\ApplySettingsTemplateCatalog.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.985_none_c3639a9e3ab1a351\f\WindowsSandboxClient.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.153_none_6ef8a222ac00dbc2\f\TrustedInstaller.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\f\iisreset.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\404-11.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.19041.1_none_ca50a32caa12ab10\aspnet_regbrowsers.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveSspr\view\ssprerror-main.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\404-5.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.1_none_544850fb795d0a4f\phoneactivate.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.423_none_c3eac275ecdf7e0a\r\NgcIso.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_28f87d0444103fde\r\fontdrvhost.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\401.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.19041.153_none_4e0da8ffdd43ed0d\NetCfgNotifyObjectHost.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.844_none_6f27e9e1e7c4fb87\r\net1.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx4-web_config_b03f5f7f11d50a3a_4.0.15805.0_none_cc8c87368388e29a\web.config.comments 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\401-5.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\404-2.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\413-1.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\SecHealthUI.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_5940d1a4fc4ad8f3\r\backgroundTaskHost.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\r\BitLockerWizard.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1266_none_e40ca34e5de298c9\rasdial.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\r\vds.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_ef39acce2648e404\f\WerFault.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_af1474f55f209109\raserver.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\http_404.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\winload.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.19041.1_none_0c1f19c50b5e5f6e\tar.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.19041.1_none_77d767642c0e040b\chkdsk.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobe-button-template.html 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\acr_error.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\404-4.htm 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.1266_none_bfb5312df2d5c960\WpcMon.exe 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exesvchost.exedescription pid process Token: SeDebugPrivilege 4424 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Token: 33 4424 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4424 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2264 svchost.exe Token: SeLockMemoryPrivilege 2264 svchost.exe Token: SeLockMemoryPrivilege 2264 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exepid process 4424 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription pid process target process PID 4424 wrote to memory of 2264 4424 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe svchost.exe PID 4424 wrote to memory of 2264 4424 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
05760fef1fd627d46931611dc620baa3_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05760fef1fd627d46931611dc620baa3_JaffaCakes118.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeFilesize
10.5MB
MD542bd70318864f6f08f0cd6f9b93b0d8c
SHA122517110c4e8afafc50374f11eaa64bfdaf2ec45
SHA2562a613c9c10d049b56293137da58f831ef33ff413a868032eb8cbf97717acd96b
SHA512ecb7cc6e613fa27e49aaccf344a1a9a94146732b12342de0a0ef169118b761d6473c7226585497c0f1555fbeab56c7162faea639f9eff2fc56d9fdf8522d1225
-
C:\Windows\config.jsonFilesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
C:\vcredist2010_x86.log.htmlFilesize
81KB
MD5342cfad86fdd10458e0993392073ff57
SHA162c363c788750f80417f1efa961618297153de01
SHA256a5a7ef8783bdcf90ba15fecddb545a3a72c48efd4ded5ec62c6d207a734fa798
SHA512c7c3bb29eeb871e1c4a0838a1b403d09324ac312a4de7344544cf9368d3b52871d69ed20b0629f80934aa1881f47184d4bb35b050afa55d82c2f3aa0815738d5
-
memory/2264-426-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2264-541-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2264-544-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2264-396-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2264-415-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2264-424-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2264-543-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2264-461-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2264-391-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2264-542-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2264-538-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2264-539-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2264-540-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2264-393-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/4424-537-0x0000000000400000-0x0000000000619000-memory.dmpFilesize
2.1MB
-
memory/4424-0-0x0000000000400000-0x0000000000619000-memory.dmpFilesize
2.1MB
-
memory/4424-394-0x0000000000400000-0x0000000000619000-memory.dmpFilesize
2.1MB