Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2024, 06:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe
-
Size
826KB
-
MD5
1ade129e97da2044851cf86ef9c2f805
-
SHA1
b6adac509a4816df548cb63efff8550783d55819
-
SHA256
aa2256999cc65afcba5d973b00acb1764275d2b797488387d5af52b972889f81
-
SHA512
d5d7a7ac9c6ac740ccbee1030feb45cee2611671a94139e978246fe81e786c67b2990fc803e48de12f65e0fbb421326d01039c22bf2941a88ffdc433d893e0fa
-
SSDEEP
12288:UIAOTs58AIAOTs58P2SpSYnEv2GvmxndZM:UIjs8AIjs8PXpFnEvSV/M
Score
8/10
Malware Config
Signatures
-
Contacts a large (1237) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ati display driver = "ÔN@" 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\compact.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\wermgr.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\appidtel.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\mobsync.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\dccw.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\isoburn.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\charmap.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\msra.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\dtdump.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\cscript.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\eventvwr.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\finger.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\notepad.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\w32tm.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\where.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmstp.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\ntprint.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\openfiles.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\PING.EXE- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\rundll32.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmmon32.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\mstsc.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\replace.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\shrpubw.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\unregmp2.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\regedit.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\pcaui.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\shrpubw.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\icsunattend.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\esentutl.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\fc.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\fltMC.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\ndadmin.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\proquota.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\rekeywiz.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\convert.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\RdpSa.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\sort.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\Utilman.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\auditpol.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\mspaint.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\TpmInit.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\dpapimig.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\ntprint.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\chkntfs.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\SysWOW64\systray.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Windows Mail\wabmig.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\dotnet\dotnet.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeComRegisterShellARM64.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79656\javaws.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\7-Zip\Uninstall.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79656\javaw.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeUpdate.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\7-Zip\7zFM.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3fb851095cc978d4\wmprph.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.19041.1_none_53029e0f94a11c6d\WUDFHost.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_b3df5aa8d99e9b89\f\TSTheme.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.19041.1_none_729f314325319478\mountvol.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.1_none_4247919c34819e8e\pcaui.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_93b4a0a1641d085c\svchost.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.19041.1_none_76b501b13155d66b\WmsSvc.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.19041.1_none_bf2412b3ea69b4cb\lpkinstall.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.207_none_00b5dbdfab19326f\UtcDecoderHost.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.153_none_42505a6de732f7ca\MusNotification.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\f\notepad.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.19041.746_none_49c7c9a4b745444e\r\PhotoScreensaver.scr_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_f786fa028426f858\r\fltMC.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\f\notepad.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.84_none_7c1f17a9e1beaf63\f\recdisc.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_e867a49a6e97813d\LaunchWinApp.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_7dd23580df04442f\f\DWWIN.EXE_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1266_none_9a152e76298cd801\f\wmlaunch.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2b8b5a41940eac9f\prevhost.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\CallingShellApp.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.928_none_85ac1b118ff2a924\dxgiadaptercache.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\NETSTAT.EXE_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15805.0_none_9d9ad2580504a573\aspnet_compiler.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.19041.1_none_c10c5c59091a9a90\fc.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dlna-mdeserver_31bf3856ad364e35_10.0.19041.746_none_b4017de081b11e02\MDEServer.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1266_none_e40ca34e5de298c9\r\rasdial.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\r\SearchIndexer.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.19041.1_none_77d767642c0e040b\chkdsk.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.19041.1_none_3038e0b9fa4d9cdf\DpiScaling.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.19041.1_none_52a02071fdffb47d\PrintIsolationHost.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.746_none_dfcf5b6f69f16f7a\rdpclip.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\SgrmLpac.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\shrpubw.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-utilityvm-setupagent_31bf3856ad364e35_10.0.19041.1_none_cf994a1a65720fd5\wcsetupagent.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.928_none_0f531ea0d233243b\DiagnosticsHub.StandardCollector.Service.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15805.0_none_646d7347043be71c\aspnet_regbrowsers.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.19041.423_none_204af7ff19532470\OOBENetworkCaptivePortal.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.19041.1_none_69f4af04dd2c1f80\lpq.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3fb851095cc978d4\f\wmprph.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.19041.746_none_f7c1402f08d2457a\mmc.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.610_none_d94fa044111e8308\r\StartMenuExperienceHost.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.19041.1288_none_91a5fb477b6af5a0\SIHClient.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\UevTemplateConfigItemGenerator.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.207_none_4054ef70f69f6ff9\r\wpr.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.264_none_098f3a6c3a48359d\f\printfilterpipelinesvc.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\r\UNPUXLauncher.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx-ldr64_exe_31bf3856ad364e35_10.0.19041.1_none_538a6445ed07333b\Ldr64.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.746_none_6ba9668b45cb4938\f\IcsEntitlementHost.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1081_none_8b145c40e6c6207f\winrs.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_ieexec_b03f5f7f11d50a3a_10.0.19041.1_none_3fc8ddfd98ad3137\IEExec.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.423_none_2cade1bc915dca0d\f\Microsoft.AsyncTextService.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_6c7de5b30e8f6071\BackgroundTransferHost.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\aspnetca.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\ROUTE.EXE_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.19041.1_none_3e243d8308cd1079\aspnet_wp.exe- 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.746_none_476e348ff3b593af\cmstp.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe File created C:\Windows\explorer.exe_ 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{C0F7788B-ED94-11EE-9216-CE945492B8DF} = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2510381952" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 207bbf96a181da01 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31097249" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2506631898" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31097249" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c5c196a181da01 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31097249" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb81c2d97e83014aa839d28a6b89bdd400000000020000000000106600000001000020000000be0659ff5bcfab3f1d9f594eacf9b47da5439e8e069c8c7772476e4805bdf404000000000e8000000002000020000000da62b8f8059d7dec09b56b7ceffb15ae31b897a66accc2f46d3eaf4cc289b11920000000ea5e1ddcf9c069241f327a741a4641ab028240886fe3f6b34c8253e713da7e8540000000feb42393fdd99ba8da71781ec650caa498bcf31aaecbfdc65c0ba453e2538289b2b6b0c8cee727baab4008878ef581887635370e606e8dd43a1d3168c1a19cf5 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418458339" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2506631898" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb81c2d97e83014aa839d28a6b89bdd400000000020000000000106600000001000020000000f4f516dfaa306e50554e71354d6d65a78d669a402ffbc5e2d9418babb045eb92000000000e800000000200002000000006225564b9e2f32719c96bc2307b1d41ced2b1c99ccb9831cf2d100ab20bd7e120000000b559708fac55a800b816669add50d92a5a02a2dd605dc073e81aa3f4c9eff4d040000000a192c09b09f4d5d16b925479cf85010d1c3cc4ab6e37ae31a9338866be86b578a2b51c40a37c9fcdad211cf164639565916406b5bdeab67cb46a517a9d830482 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1684 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1684 IEXPLORE.exe 1684 IEXPLORE.exe 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3128 wrote to memory of 1684 3128 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe 85 PID 3128 wrote to memory of 1684 3128 1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe 85 PID 1684 wrote to memory of 1620 1684 IEXPLORE.exe 86 PID 1684 wrote to memory of 1620 1684 IEXPLORE.exe 86 PID 1684 wrote to memory of 1620 1684 IEXPLORE.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1ade129e97da2044851cf86ef9c2f805_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1620
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD50c31d4e05deae551b0b7370d3c6ff007
SHA135afd1c9a8521d99e15f38d12b672aa63a8519d3
SHA256b4bc96640fc934eee7a4737f5f8c147ba5372c77bc598d6e27054fc3f5db51d3
SHA5128fea3602bd5a1f188a986522c610b547d80c8805f93e7077cd3acec0ef21ca7a1f5ab0e433fd23a6788b63aa4a4f11fc3cdf483dfbed121c95a9110d1683733f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD566c10bbef50d2b6b0bbac02027a8a034
SHA1f4b01bf5eeaf629d0b09b108ef84cf4f63d57fd2
SHA2569a04b1abf5725510ce5dcc81e64861dff5025d63f4da5de39ac34ab045a8e5d8
SHA512ac823053ac4ad9b4d387ab7b3e3287a6cf3b2a472ac213aa5a2f9f13e7eb41a08bcc184c6a0337f6cdf5688da0a348f93fe5f211a6f0dd00084f926d52b1323a
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
5.9MB
MD527ba69c980707fc79fe241d177c68c08
SHA19bd29d6205c464cd08e9b69218f2d281cdfbe8ae
SHA256f276619babf9f7600353d53d8ff81006bf8eee019908e82a1a349ec96b3c7e1f
SHA512a70d12bb50457de1ee7debe3a87b781c984c6562a7c7e350af224b4c828735d6605e59c10e9c6b6e3c421f54e670c31877bab3e94f60a51ce2d1ea73e572f916