Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
07/04/2024, 19:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe
- Size 444KB
- Sample240407-yevnsada46
- SHA256 6bd8dfbc8c83fee901bf74160ed87fd28ace9d358982634287d199b550e31edd
- MD5 e5b5eb1e61978a8f757c7011f5949959
- SHA1 7203c7048d1e3e4556fd3c45f53a7edf91ba34d9
- SHA512 c7c3b4392108fd2379534a93eaf30f74a5a89d230d19c255e8f0911c6bf1c8ecbf787bc406a481692f6c9e47550505e451baebaebed548e2803e2ad1631cf0ab
- SSDEEP 6144:nttttVkssroWoQTX5pS9t7RyBTBZEbv5QttttVkssroWoQTX5pS9t7RyB6:lkss8WBTGv5ekss8WB6
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe - Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\attrib.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\iscsicli.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wecutil.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ByteCodeGenerator.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\shrpubw.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msinfo32.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Robocopy.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\runas.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wextract.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cmstp.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fontview.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fsutil.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\HOSTNAME.EXE e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\PkgMgr.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\poqexec.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Dism.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dllhst3g.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\EhStorAuthn.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rasphone.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\srdelayed.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Windows.WARP.JITService.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Com\MigRegDB.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mobsync.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mspaint.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\calc.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\winver.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cmmon32.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mtstocom.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rekeywiz.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RMActivate.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sdchange.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SndVol.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wsmprovhost.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sort.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wermgr.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ARP.EXE e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\diskperf.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\prevhost.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\InfDefaultInstall.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\reg.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\UserAccountControlSettings.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Com\comrepl.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rasdial.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\hh.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\appidtel.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msra.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\systray.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ROUTE.EXE e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\secinit.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dfrgui.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\proquota.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\perfhost.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\relog.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\OposHost.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RmClient.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files\7-Zip\7z.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files\dotnet\dotnet.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeComRegisterShellARM64.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\GrantDisconnect.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\CallingShellApp.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4552 e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e5b5eb1e61978a8f757c7011f5949959_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 888KB
- SHA256 d6d6a2c96e6d92c0a4d9fbb3dae2eeacd02bdfbc30a0991000c9f7683b90c216
- MD5 8782d0a789c88bf6c3dba1ff251f1c29
- SHA1 3e895d543c6124e280285282fb4f80804babd015
- SHA512 12ee7138c9466da6b4738c7d3f9e946f4288eb85a1fe90f89cf784a62a6b1e9b72e91ce104ce7b29df95a561e2694c4b59cc3c772b79bf4e95221066bcfe49d8
- SSDEEP 12288:lkss8WBTGv5ekss8WBQkss8WBTGv5ekss8WB6:Kss86TYdss86fss86TYdss866
- MD5 SHA1 SHA512 SSDEEP