Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 21:00
Static task
static1
Behavioral task
behavioral1
Sample
e5d8fd3aeb2df221386026d477c9a29f_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
e5d8fd3aeb2df221386026d477c9a29f_JaffaCakes118.exe
-
Size
5.5MB
-
MD5
e5d8fd3aeb2df221386026d477c9a29f
-
SHA1
b0282c62eb15642255d4dcf7709a5480ba49c04c
-
SHA256
e528a7df88f2edb9a6b9d125fcf360ec4232de036f2ce9ef40c6183b957371e5
-
SHA512
e5ba2b989683672dfd02cfddf685dca91964c0a4cc89a9b398090485cc47e67a6df585c1f4e0a1c3b77b62ce65deb7122b71309226589a586167464b3967f638
-
SSDEEP
6144:btzsb5Uh28+V1WW69B9VjMdxPedN9ug0z9TB9SToScEMdFDIDIDVPQW9e7w4x4Qc:btzE5elwLz9TrszMnGGVoxU
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
Processes:
cmd.exedescription ioc process File opened for modification C:\Windows\System32\ComputerToastIcon.contrast-white.png cmd.exe File created C:\Windows\System32\PhoneSystemToastIcon.contrast-white.png cmd.exe File opened for modification C:\Windows\System32\RestartNowPower_80.png cmd.exe File opened for modification C:\Windows\System32\X_80.contrast-white.png cmd.exe File created C:\Windows\SysWOW64\@EnrollmentToastIcon.png cmd.exe File created C:\Windows\System32\ActiveHours.png cmd.exe File opened for modification C:\Windows\System32\BluetoothPairingSystemToastIcon.contrast-high.png cmd.exe File opened for modification C:\Windows\System32\BluetoothSystemToastIcon.contrast-white.png cmd.exe File created C:\Windows\SysWOW64\@WirelessDisplayToast.png cmd.exe File opened for modification C:\Windows\System32\PerceptionSimulation\Assets\ClosedHand.png cmd.exe File opened for modification C:\Windows\System32\Speech_OneCore\common\toast-hero-image.png cmd.exe File opened for modification C:\Windows\SysWOW64\@WirelessDisplayToast.png cmd.exe File opened for modification C:\Windows\System32\OkDone_80.contrast-white.png cmd.exe File created C:\Windows\System32\RemoteSystemToastIcon.png cmd.exe File opened for modification C:\Windows\System32\Snooze_80.png cmd.exe File created C:\Windows\System32\KeyboardSystemToastIcon.contrast-white.png cmd.exe File opened for modification C:\Windows\System32\OkDone_80.png cmd.exe File created C:\Windows\System32\PhoneSystemToastIcon.png cmd.exe File created C:\Windows\System32\RestartNowPower_80.png cmd.exe File opened for modification C:\Windows\System32\SvBannerBackground.png cmd.exe File created C:\Windows\System32\@EnrollmentToastIcon.png cmd.exe File opened for modification C:\Windows\System32\@WindowsUpdateToastIcon.contrast-white.png cmd.exe File created C:\Windows\System32\BluetoothSystemToastIcon.png cmd.exe File opened for modification C:\Windows\System32\RestartNowPower_80.contrast-black.png cmd.exe File created C:\Windows\System32\SpeakersSystemToastIcon.contrast-white.png cmd.exe File created C:\Windows\System32\SvBannerBackground.png cmd.exe File opened for modification C:\Windows\SysWOW64\Bthprops\@BthpropsNotificationLogo.png cmd.exe File opened for modification C:\Windows\System32\DefaultAccountTile.png cmd.exe File created C:\Windows\System32\HealthSystemToastIcon.png cmd.exe File opened for modification C:\Windows\System32\MediaSystemToastIcon.contrast-white.png cmd.exe File opened for modification C:\Windows\System32\HeadphoneSystemToastIcon.png cmd.exe File created C:\Windows\System32\HeadsetSystemToastIcon.contrast-white.png cmd.exe File opened for modification C:\Windows\System32\InputSystemToastIcon.contrast-white.png cmd.exe File opened for modification C:\Windows\System32\GameSystemToastIcon.contrast-white.png cmd.exe File created C:\Windows\System32\HeadphoneSystemToastIcon.contrast-white.png cmd.exe File created C:\Windows\System32\OkDone_80.contrast-black.png cmd.exe File opened for modification C:\Windows\System32\PerceptionSimulation\Assets\OpenHand.png cmd.exe File opened for modification C:\Windows\System32\@bitlockertoastimage.png cmd.exe File created C:\Windows\System32\@StorageSenseToastIcon.png cmd.exe File created C:\Windows\System32\@WindowsUpdateToastIcon.png cmd.exe File created C:\Windows\System32\BluetoothPairingSystemToastIcon.png cmd.exe File created C:\Windows\System32\MediaSystemToastIcon.png cmd.exe File created C:\Windows\System32\RestartTonight_80_contrast-white.png cmd.exe File created C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png cmd.exe File opened for modification C:\Windows\System32\@EnrollmentToastIcon.png cmd.exe File created C:\Windows\System32\@VpnToastIcon.png cmd.exe File created C:\Windows\System32\@WirelessDisplayToast.png cmd.exe File created C:\Windows\SysWOW64\Bthprops\@BthpropsNotificationLogo.png cmd.exe File created C:\Windows\System32\@optionalfeatures.png cmd.exe File opened for modification C:\Windows\System32\RemoteSystemToastIcon.png cmd.exe File opened for modification C:\Windows\System32\Bthprops\@BthpropsNotificationLogo.png cmd.exe File created C:\Windows\System32\HeadphoneSystemToastIcon.png cmd.exe File created C:\Windows\System32\SecurityAndMaintenance_Alert.png cmd.exe File created C:\Windows\System32\wpcatltoast.png cmd.exe File opened for modification C:\Windows\System32\PhoneSystemToastIcon.contrast-white.png cmd.exe File created C:\Windows\System32\ScheduleTime_80.contrast-black.png cmd.exe File opened for modification C:\Windows\System32\SecurityAndMaintenance_Alert.png cmd.exe File created C:\Windows\SysWOW64\@AppHelpToast.png cmd.exe File created C:\Windows\System32\@AdvancedKeySettingsNotification.png cmd.exe File opened for modification C:\Windows\System32\BluetoothSystemToastIcon.png cmd.exe File created C:\Windows\System32\OkDone_80.contrast-white.png cmd.exe File opened for modification C:\Windows\System32\RestartTonight_80.png cmd.exe File created C:\Windows\System32\DefaultAccountTile.png cmd.exe File created C:\Windows\System32\DisplaySystemToastIcon.contrast-white.png cmd.exe -
Drops file in Program Files directory 64 IoCs
Processes:
cmd.exedescription ioc process File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\SplashScreen\PaintSplashScreen.scale-200.png cmd.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxAccountsLargeTile.scale-100.png cmd.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-64.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\StoreLogo\PaintApplist.scale-200.png cmd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\Doughboy.scale-400.png cmd.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\FetchingMail.scale-150.png cmd.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MediumTile.scale-125_contrast-black.png cmd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-20.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60.png cmd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-100_contrast-black.png cmd.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptySearch-Dark.scale-400.png cmd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile.png cmd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-16_altform-unplated_contrast-white.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-200_contrast-white.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Square71x71Logo.scale-125.png cmd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Google.scale-400.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\WideLogo.scale-100_contrast-white.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square310x310Logo.scale-150.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-30_contrast-white.png cmd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptySearch.scale-150.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\fb_blank_profile_portrait.png cmd.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\SmallTile.scale-125.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteWideTile.scale-100.png cmd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarWideTile.scale-400.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-30.png cmd.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-400.png cmd.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreLargeTile.scale-100.png cmd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-100.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_contrast-black.png cmd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-256.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\PaintWideTile.scale-400.png cmd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-36_altform-unplated.png cmd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-72_altform-unplated.png cmd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-right.png cmd.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraMedTile.scale-125.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageWideTile.scale-125.png cmd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-40_altform-lightunplated.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-100_contrast-white.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\SmallTile.scale-200.png cmd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner-4x.png cmd.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-100_contrast-black.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-400.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\1x1transparent.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-256.png cmd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsStoreLogo.scale-100.png cmd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-32.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-16_altform-unplated_contrast-black.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-64_altform-unplated.png cmd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyView.scale-200.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_altform-lightunplated_devicefamily-colorfulunplated.png cmd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png cmd.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosWideTile.contrast-black_scale-125.png cmd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-150_contrast-black.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteMediumTile.scale-125.png cmd.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_altform-unplated_contrast-white.png cmd.exe File created C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.png cmd.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosMedTile.scale-125.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-200_contrast-black.png cmd.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\example_icons.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\TriPeaks.Medium.png cmd.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxSmallTile.scale-125.png cmd.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-100.png cmd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.GrayF.png cmd.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.scale-125_contrast-black.png cmd.exe -
Drops file in Windows directory 64 IoCs
Processes:
cmd.exedescription ioc process File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\SmallTile.scale-400.png cmd.exe File opened for modification C:\Windows\SystemResources\Windows.SystemToast.Calling\Images\YourPhoneCallingToast.scale-200.png cmd.exe File created C:\Windows\SystemResources\Windows.UI.AccountsControl\Images\Generic.Theme-Dark_Scale-300.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_edda8130b19d4286\Splashscreen.scale-100.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\square150x150logo.scale-150_contrast-black.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPStoreLogo.scale-150_contrast-white.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-white.searchapp_31bf3856ad364e35_10.0.19041.1_none_2f147508fcb33106\AppListIcon.targetsize-16.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-white.searchapp_31bf3856ad364e35_10.0.19041.1_none_2f147508fcb33106\MediumTile.scale-400.png cmd.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_f3a9dc0fe254a157\DMR_120.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\findResults.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\functionIcon.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\InputApp\Assets\SquareLogo310x310.scale-400.png cmd.exe File opened for modification C:\Windows\ImmersiveControlPanel\images\logo.scale-125_altform-unplated.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\TinyTile.scale-150.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\selectAllBreakpoints.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\NewWindowIcon.scale-125.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.906_none_a6600355b5f69459\YourPhoneCallingToast.scale-150.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\CellularToast.scale-200_contrast-black.png cmd.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.targetsize-80.png cmd.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-black\AppListIcon.targetsize-24.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Square310x310Logo.contrast-white_scale-200.png cmd.exe File opened for modification C:\Windows\SystemResources\Windows.ParentalControlsSettings\Images\MicrosoftFamily.scale-100_contrast-white.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\TileSmall.contrast-white_scale-200.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\minimize.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare310x310.scale-100_contrast-white.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare44x44.targetsize-16_contrast-white.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\WebNotifications.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.targetsize-16_contrast-white.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..tmenuexperiencehost_31bf3856ad364e35_10.0.19041.423_none_62aeb4079e61ade0\officehub71x71.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.264_none_a61d15efb6291d40\SendPhone.scale-300.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\InputApp\InputApp\Assets\StoreLogo.scale-400.png cmd.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\images\forceStorageCapState.png cmd.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\dom\images\BreadcrumbScrollLeft.png cmd.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\Assets\SplashScreen.scale-100.png cmd.exe File created C:\Windows\SystemResources\Windows.UI.AccountsControl\Images\Exchange.Theme-Dark_Scale-250.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\Square44x44Logo.targetsize-64.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\wide.Apps.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\Square150x150Logo.contrast-black_scale-100.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.19041.1_none_83b794e5516730a0\SplashScreen.scale-200.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\Folder_Small.scale-100.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\checkered_background.png cmd.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare150x150Logo.scale-100.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\Square44x44Logo.scale-200.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\tree_icons.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.264_none_a61d15efb6291d40\Placeholder_buddy.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\WiFiNetworkManagerWarningToast.scale-200.png cmd.exe File created C:\Windows\WinSxS\amd64_systemresource-wind..-ui-accountscontrol_31bf3856ad364e35_10.0.19041.1_none_8805ef3af31f4b8c\Outlook.Theme-Dark_Scale-250.png cmd.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSplashScreen.scale-100.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.746_none_2b9acc2d69574796\LocationIcon.contrast-black_scale-200.png cmd.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\Assets\Square44x44Logo.scale-200.png cmd.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Assets\PeopleLogo.scale-150_contrast-black.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_theme-light.png cmd.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Assets\PeopleLogo.targetsize-72_altform-unplated_contrast-white.png cmd.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\MediumTile.scale-125.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\Splashscreen.scale-100_contrast-white.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.19041.1_none_7862ca1f7379fdcf\SquareTile150x150.scale-100.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\i_table_options.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\OkDone_80.png cmd.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\perftools\images\i_checkered_background.png cmd.exe File opened for modification C:\Windows\SystemResources\Windows.UI.Shell\Images\Icon_MMXresume.contrast-black_scale-200.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.1_none_b719750f25d4cc37\SquareTile310x150.scale-100.png cmd.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\Square310x310Logo.contrast-white_scale-100.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\i_next.png cmd.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\WiFiNetworkManagerToast.scale-100.png cmd.exe -
Modifies registry class 8 IoCs
Processes:
cmd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mp3\ = "batfile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mp4 cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mp4\ = "batfile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.png cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.png\ = "batfile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt\ = "batfile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mp3 cmd.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
e5d8fd3aeb2df221386026d477c9a29f_JaffaCakes118.execmd.exedescription pid process target process PID 3528 wrote to memory of 4824 3528 e5d8fd3aeb2df221386026d477c9a29f_JaffaCakes118.exe cmd.exe PID 3528 wrote to memory of 4824 3528 e5d8fd3aeb2df221386026d477c9a29f_JaffaCakes118.exe cmd.exe PID 4824 wrote to memory of 1684 4824 cmd.exe cmd.exe PID 4824 wrote to memory of 1684 4824 cmd.exe cmd.exe PID 4824 wrote to memory of 1664 4824 cmd.exe cmd.exe PID 4824 wrote to memory of 1664 4824 cmd.exe cmd.exe PID 4824 wrote to memory of 4636 4824 cmd.exe cmd.exe PID 4824 wrote to memory of 4636 4824 cmd.exe cmd.exe PID 4824 wrote to memory of 4748 4824 cmd.exe cmd.exe PID 4824 wrote to memory of 4748 4824 cmd.exe cmd.exe PID 4824 wrote to memory of 2368 4824 cmd.exe cmd.exe PID 4824 wrote to memory of 2368 4824 cmd.exe cmd.exe PID 4824 wrote to memory of 4064 4824 cmd.exe cmd.exe PID 4824 wrote to memory of 4064 4824 cmd.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5d8fd3aeb2df221386026d477c9a29f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e5d8fd3aeb2df221386026d477c9a29f_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5488.tmp\5489.tmp\548A.bat C:\Users\Admin\AppData\Local\Temp\e5d8fd3aeb2df221386026d477c9a29f_JaffaCakes118.exe"2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y "3⤵PID:1684
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" FOR /F "tokens=1,* delims=: " %j in (InfList_mp3.txt) do copy /y C:\Users\Admin\AppData\Local\Temp\e5d8fd3aeb2df221386026d477c9a29f_JaffaCakes118.exe "%j:%k""3⤵PID:1664
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y "3⤵PID:4636
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" FOR /F "tokens=1,* delims=: " %j in (InfList_mp4.txt) do copy /y C:\Users\Admin\AppData\Local\Temp\e5d8fd3aeb2df221386026d477c9a29f_JaffaCakes118.exe "%j:%k""3⤵PID:4748
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y "3⤵PID:2368
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" FOR /F "tokens=1,* delims=: " %j in (InfList_png.txt) do copy /y C:\Users\Admin\AppData\Local\Temp\e5d8fd3aeb2df221386026d477c9a29f_JaffaCakes118.exe "%j:%k""3⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD5e5d8fd3aeb2df221386026d477c9a29f
SHA1b0282c62eb15642255d4dcf7709a5480ba49c04c
SHA256e528a7df88f2edb9a6b9d125fcf360ec4232de036f2ce9ef40c6183b957371e5
SHA512e5ba2b989683672dfd02cfddf685dca91964c0a4cc89a9b398090485cc47e67a6df585c1f4e0a1c3b77b62ce65deb7122b71309226589a586167464b3967f638
-
Filesize
7KB
MD590ff70f2778f116069b3d3a6cc0ab36e
SHA102a2f1a86ebb33a06f0392c365bea6e283e65ea0
SHA25624581f8d20043f2cfc2ca639054813a59181cb284af37872dc9578b837ec4b24
SHA512bcecb81121f8f7f29a50c79b01718bd92dda6054a55ab5ef440181b24352c973355d3bf4f0a780dc8fa5b22798dbe35b789933062dfa6385d8fc22721b36b725
-
Filesize
112B
MD5a7056e4034a1ab2e5c702872777b53d4
SHA12f9c08eb41c885a1bd5792fee317143eefb84b87
SHA256876f208b4ba4caac32e17b70bb08a4205a50806898b9c18ac2d6ac2ae7d18bff
SHA512406581d1d7b3b9e025d574ca37e495fb3f4db589e2def7ab835a6a5592e233dd56c721e4c2f8a6e880def433abd95dbd6494c71e6ebd222614b7d57ffd1edc4c
-
Filesize
2KB
MD56dbf4182cb7bb750dcf0dcb011580b85
SHA1b3e448cf78c4645c001931748c0567fd23efcee5
SHA2566cd2086d84385e9cfec76572888edb6b535e97f4175d66455269de9686742851
SHA512456de0f9461a32a5143ea38b88e61a825a9ecdb041f86bb57a48f340104f7d8c94baf89f4358090772436dcf19b4935fccd7e055751f180a93c233a27465237e
-
Filesize
1.7MB
MD5d9e55a59d2fef4c320dda108699a31db
SHA12be85caab1f4b004861912129ae90ec19b4534b4
SHA25619d27701ecc18710de79eb0eb7bf8e5eaf0d3b15a08010db20f0db592f76a4a5
SHA5123f2751ad610993e30884a22c52b25006f8af6fc0114bf6158d8312cbd3ce5013258e8ec65fdc7d763a1e4a1031abaf0b4fdedd6d632fa862689d5d52618c7f61