Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
29-03-2024 17:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe
-
Size
531KB
-
MD5
28170eaa9be5bd7a9dcce21b50371db2
-
SHA1
4e062ff043374e0fdf403389d0e91e39c0110b1d
-
SHA256
8d0313c0a31c44f03eb90523a5ffd448e5c78985b31d79af25fdb9e8e56a410b
-
SHA512
aa82a575ed9c7806c676b2ceb0dca2aae4c67fdbcb21c8c9e9a23ace744b0b4331720547b3445aaf4931f67b6cd249dcb613f5dabef10f31135ec776dec56984
-
SSDEEP
6144:2VWYGnd1E6dqi4py5I+TyiJd1E6dqi4py58pvrlA1r8+6/I3z/s1F1C5zroISwMd:2gYsEy1DXdEy1tP6/ors1F1KzrVSwM+4
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\at.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\PATHPING.EXE 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\regsvr32.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cttune.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sort.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\clip.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\net1.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\reg.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\unregmp2.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WerFaultSecure.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dpnsvr.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gpupdate.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mcbuilder.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\runonce.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\takeown.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\UserAccountControlSettings.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ddodiag.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dvdplay.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\find.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ipconfig.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\schtasks.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\eudcedit.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ieUnatt.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\iscsicli.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\newdev.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cmd.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cacls.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\hdwwiz.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\diskpart.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\icardagt.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wevtutil.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wininit.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wsmprovhost.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\TRACERT.EXE 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wermgr.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Dism\DismHost.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DeviceProperties.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\LocationNotifications.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MigAutoPlay.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\proquota.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\migwiz\mighost.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cliconfg.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\taskmgr.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesHardware.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\timeout.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\charmap.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cmdkey.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\colorcpl.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dpapimig.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RMActivate_isv.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bootcfg.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\expand.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rundll32.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WSManHTTPConfig.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\autoconv.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gpscript.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mtstocom.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\misc.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\rmiregistry.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7z.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\javaws.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_bf4980401574a899\relog.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-processmodel_31bf3856ad364e35_6.1.7601.17514_none_1f3c3defefc3a10e\w3wp.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-at_31bf3856ad364e35_6.1.7600.16385_none_4cd7fa8ce5381b26\at.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_6.1.7601.17514_none_a1636a92177e3020\prevhost.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7600.16385_none_ce6f64032560fa6b\setup16.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\MSBuild\1a154709cdfe214029ea88c51ab2b579\MSBuild.ni.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-a..ime-upgrade-results_31bf3856ad364e35_6.1.7601.17514_none_21de7e134213566a\WindowsAnytimeUpgradeResults.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_6.1.7601.17514_none_d4c5c995fb3f4a1b\audiodg.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-a..ce-useractionrecord_31bf3856ad364e35_6.1.7600.16385_none_8ee34c400d95f0ab\psr.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_6.1.7600.16385_none_c10c2a29895d4994\gpscript.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_6.1.7601.17514_none_698e475b97512fc9\PushPrinterConnections.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.1.7601.17514_none_d527b0a5438b8346_drvinst.exe_6593e92a 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_4605aca152cc8281\mshta.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_6.1.7601.17514_none_a54b31331066c8e2\Dxpserver.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_6.1.7600.16385_none_ad5854ca0a23343d\mount.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\msil_addinprocess_b77a5c561934e089_6.1.7601.17514_none_f9a5b9a7f0e068e4\AddInProcess.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-openfiles_31bf3856ad364e35_6.1.7600.16385_none_431b58a8041530aa\openfiles.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_subsystem-for-unix-based-applications_31bf3856ad364e35_6.1.7601.17514_none_d20e5d35068f261a\posix.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\ehome\ehrec.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..cationnotifications_31bf3856ad364e35_6.1.7600.16385_none_737951ab23cf8ea0\LocationNotifications.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-pnputil_31bf3856ad364e35_6.1.7600.16385_none_5958b438d6388d15\PnPutil.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_d5b4f96cdbb9a8b1\IMJPDSVR.EXE 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4a5d2c9ecd59afa7\dnscacheugc.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\Narrator\4cc02fad33053737088d4c18267ca0a0\Narrator.ni.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\ehome\ehmsas.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_6.1.7600.16385_none_a018e05d0d33081d\dllhost.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-cttune_31bf3856ad364e35_6.1.7600.16385_none_0f797e18d8361ef2\cttune.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-servicepackcoordinator_31bf3856ad364e35_6.1.7601.17514_none_92e727843e307e1b\spinstall.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_6.1.7600.16385_none_1ddd261c4e350476\upnpcont.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wmi-snmp-provider_31bf3856ad364e35_6.1.7601.17514_none_08e183f8dd5f48b7\smi2smir.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\loadmxf.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\SMSvcHost\0b4d4e172e8054cb61d27f5ab9e0e445\SMSvcHost.ni.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\f4a88265ac4ad47978daef8c5482fd30\MSBuild.ni.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_931b5f1fdcdd6496\wowreg32.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_netfx-ieexec_b03f5f7f11d50a3a_6.1.7600.16385_none_7dfc94f7357c56d2\IEExec.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\SMSvcHost\04d794428d635f6a82ac57dd3d6f3628\SMSvcHost.ni.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_177a088436382a34\mofcomp.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7600.16385_none_cd7aeeff1897d018_unlodctr.exe_69df45bb 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..-japanese-migration_31bf3856ad364e35_6.1.7600.16385_none_6a5b38699f97e38d\imjppdmg.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_6.1.7601.17514_none_d71fb1d63f05ef22\FXSCOVER.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_6.1.7600.16385_none_c50af05b1be3aa2b\powershell.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17514_none_b94cbfa183466a89_winload.exe_75835076 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad_unlodctr.exe_69df45bb 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.17932_none_d088def7226177d5\instnm.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe$ 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_6.1.7600.16385_none_b70694aa97134f37\rdrleakdiag.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-runonce_31bf3856ad364e35_6.1.7601.17514_none_73e0da0bd5a77c41\runonce.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.17932_none_d088def7226177d5\setup16.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_6.1.7600.16385_none_8945930a7d61b9f0\MigRegDB.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..platform-input-core_31bf3856ad364e35_6.1.7601.17514_none_2f3651e7f36d703f\wisptis.exe 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2040 28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\28170eaa9be5bd7a9dcce21b50371db2_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5fdde974e2d37a3437d514a97c02ef299
SHA1a9be4208d46f49b2215374f383fbba7cc0e839d2
SHA256f0cc6c126b2493c8632e397cc3cdd2c0631a258c3bed9ff05991403c7f7ee3fb
SHA51224a6beb14e8362a93fcfb0b9ddc551d36d538ed6a5d7f2f964d7742abf8746aeb622359cd2bb3645835c71daaa72444908ea3f3080ffec4e2ee36ba680becb56