e5310c0c53ae465f1c6e7941be2e3e6956ba59361a4648a68fb785fa6e8bcd32

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
Size

6.4MB
MD5

e8183d793b216f7c9e832c5de0060800
SHA1

d3318abe8a0c76032ecc7906814d66f809b85bf7
SHA256

e5310c0c53ae465f1c6e7941be2e3e6956ba59361a4648a68fb785fa6e8bcd32
SHA512

f7a301308869eb85d18325a1bec52ea32bf4f3521320c08422bcb07aa17685145c3f7bd473c285b32505f90b1c173b9ef356fd5b56593070f3aa7c132614176e
SSDEEP

196608:jjBxcO4jjoQIG8S1NLniBPJhRELqS/rhb59SRZ5Vb9sybbsB0rns2:z7QIG8cNLniBPJhRELqS/rhN9SRZ5VbD

Score

8^/10

persistence upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Drivers\ETC\HOSTS	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4904-0-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral2/files/0x000a0000000231c7-5.dat	upx
behavioral2/memory/4904-624-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe"	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DbTasker.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DbTasker.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\hal.dll	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DBTASK.EXE	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dbzip2.dll	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dbexe2.dll	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\LockFile.dat	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\it-it\Pamela Anderson FULL VIDEO.mpg .scr	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\de-de\Pamela Anderson FULL VIDEO.mpg .scr	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\textconv\How to stop NetSky.doc .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\zh-hant\How to stop NetSky.doc .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ar-sa\Matrix Reloaded.avi .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\de-de\Internet Explorer 7 FULL BETA.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\insert\WinAmp 5.08 FULL.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\lt-lt\Full warez download sites.html .pif	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\en-gb\Full warez download sites.html .pif	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ar-sa\Internet Explorer 7 FULL BETA.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\zh-cn\Full warez download sites.html .pif	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\vc\Full warez download sites.html .pif	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\da-dk\Full warez download sites.html .pif	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\How to stop NetSky.doc .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\de-de\Internet Explorer 7 FULL BETA.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\es-es\How to stop NetSky.doc .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\cs\Playboy centerfold HOT.gif .scr	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\nl-nl\Full warez download sites.html .pif	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\How to stop NetSky.doc .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\office16\office setup controller\Playboy centerfold HOT.gif .scr	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\Full warez download sites.html .pif	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Windows XP SP3 REAL VERSION.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\office16\office setup controller\DVD Xcopy PRO Illegal Warez.iso .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\vgx\Full warez download sites.html .pif	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.25\DVD Xcopy PRO Illegal Warez.iso .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\it-it\Full warez download sites.html .pif	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\zh-tw\Full warez download sites.html .pif	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\dotnet\shared\microsoft.netcore.app\8.0.0\How to stop NetSky.doc .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\cs-cz\How to stop NetSky.doc .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\How to stop NetSky.doc .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\he-il\Full warez download sites.html .pif	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\cs\Pamela Anderson FULL VIDEO.mpg .scr	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\sv-se\Full warez download sites.html .pif	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\es\Pamela Anderson FULL VIDEO.mpg .scr	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\WinAmp 5.08 FULL.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\hu-hu\Full warez download sites.html .pif	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ko-kr\Full warez download sites.html .pif	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\cs-cz\Pamela Anderson FULL VIDEO.mpg .scr	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\WinAmp 5.08 FULL.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\hwrcustomization\How to stop NetSky.doc .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\es-es\Full warez download sites.html .pif	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskclearui\How to stop NetSky.doc .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ko-kr\How to stop NetSky.doc .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\pt-br\Full warez download sites.html .pif	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\es-es\Internet Explorer 7 FULL BETA.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\office16\How to stop NetSky.doc .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\WinTask.zip	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4580	4904	WerFault.exe	85

NTFS ADS 64 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SP3 REAL VERSION.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\h„Ùw€c:\program files\common files\microsoft shared\ink\fsdefinitions\insert\Pamela Anderson FULL VIDEO.mpg .scr	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\h„Ùwc:\program files\common files\microsoft shared\ink\fsdefinitions\oskclearui\Pamela Anderson FULL VIDEO.mpg .scr	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program fÿc:\program files\common files\microsoft shared\ink\zh-tw\WinAmp 5.08 FULL.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]}v¼çdc:\program files\common files\microsoft shared\msinfo\de-de\Hacking and Virus Writing for Dummies.pdf .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ ÿc:\program files\common files\microsoft shared\vgx\WinAmp 5.08 FULL.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\—\ç¨€ìdc:\program files\common files\microsoft shared\WinRAR 4.01 Cracked BETA.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\€ßdc:\program files\common files\microsoft shared\ink\da-dk\Hacking for Dummies.pdf .cpl	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]}v¼çdc:\program files\common files\microsoft shared\ink\ko-kr\Hacking and Virus Writing for Dummies.pdf .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\GWç¨Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\es\WinRAR 4.01 Cracked BETA.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\#c:\program files\common files\microsoft shared\ink\ar-sa\Visual Studio .NET FULL.zip .cpl	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\msinfo\de-de\Windows XP SP3 REAL VERSION.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\`¤™c:\program files\common files\microsoft shared\vsto\10.0\Windows 2000.iso .com	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\·Qç¨`çdc:\program files\common files\microsoft shared\ink\de-de\WinRAR 4.01 Cracked BETA.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\it-it\Windows XP SP3 REAL VERSION.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ELOPER seriac:\program files\common files\microsoft shared\source engine\WinAmp 5.08 FULL.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]}v¼çdc:\program files\common files\microsoft shared\ink\el-gr\Hacking and Virus Writing for Dummies.pdf .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\`¢™c:\program files\common files\microsoft shared\vgx\Windows 2000.iso .com	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\·Qç¨`çdc:\program files\common files\microsoft shared\ink\nl-nl\WinRAR 4.01 Cracked BETA.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\Ûdc:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SP2 WORKING activation crack.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\€ßdc:\program files\common files\microsoft shared\ink\bg-bg\Hacking for Dummies.pdf .cpl	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\es-mx\Windows XP SP3 REAL VERSION.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\ja-jp\Windows XP SP3 REAL VERSION.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]}vLêdc:\program files\common files\microsoft shared\ink\Hacking and Virus Writing for Dummies.pdf .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]}vLêdc:\program files\common files\microsoft shared\vgx\Hacking and Virus Writing for Dummies.pdf .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]}v¼çdc:\program files\common files\microsoft shared\ink\da-dk\Hacking and Virus Writing for Dummies.pdf .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\·Qç¨`çdc:\program files\common files\microsoft shared\ink\en-us\WinRAR 4.01 Cracked BETA.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\à§™c:\program files\common files\microsoft shared\vc\Windows 2000.iso .com	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\cs-cz\Windows XP SP3 REAL VERSION.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program filesJc:\program files\common files\microsoft shared\ink\de-de\WinAmp 5.08 FULL.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ Dc:\program files\common files\microsoft shared\vsto\10.0\WinAmp 5.08 FULL.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\`©™c:\program files\common files\microsoft shared\vsto\Windows 2000.iso .com	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program filesJc:\program files\common files\microsoft shared\ink\es-es\WinAmp 5.08 FULL.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\mmies.pdf ÿc:\program files\common files\microsoft shared\ink\fsdefinitions\WinAmp 5.08 FULL.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]}v¼çdc:\program files\common files\microsoft shared\msinfo\fr-fr\Hacking and Virus Writing for Dummies.pdf .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]}v¼çdc:\program files\common files\microsoft shared\msinfo\uk-ua\Hacking and Virus Writing for Dummies.pdf .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\fi-fi\Windows XP SP3 REAL VERSION.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\mmies.pdf ÿc:\program files\common files\microsoft shared\ink\hu-hu\WinAmp 5.08 FULL.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\·Qç¨`çdc:\program files\common files\microsoft shared\ink\languagemodel\WinRAR 4.01 Cracked BETA.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]}v¼çdc:\program files\common files\microsoft shared\ink\ru-ru\Hacking and Virus Writing for Dummies.pdf .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\„ædc:\program files\common files\microsoft shared\vgx\Windows XP SP3 REAL VERSION.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\·Qç¨`çdc:\program files\common files\microsoft shared\ink\es-mx\WinRAR 4.01 Cracked BETA.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program fÿc:\program files\common files\microsoft shared\msinfo\ja-jp\WinAmp 5.08 FULL.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]}vLêdc:\program files\common files\microsoft shared\officesoftwareprotectionplatform\Hacking and Virus Writing for Dummies.pdf .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]}v¼çdc:\program files\common files\microsoft shared\ink\ar-sa\Hacking and Virus Writing for Dummies.pdf .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\À#˜c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\Windows 2000.iso .com	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\GWç¨Ðädc:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\WinRAR 4.01 Cracked BETA.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ ¡™c:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\Windows 2000.iso .com	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]}v,ådc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\pt-br\Hacking and Virus Writing for Dummies.pdf .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ ž™c:\program files\common files\microsoft shared\ink\zh-cn\Windows 2000.iso .com	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\dádc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\tr\Windows XP SP3 REAL VERSION.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program files@c:\program fil0ædc:\program files\dotnet\shared\microsoft.windowsdójç¨ÿVç¨ˆãdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\zh-hant\WinAmp 5.08 FULL.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]}v¼çdc:\program files\common files\microsoft shared\ink\pl-pl\Hacking and Virus Writing for Dummies.pdf .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ œ™c:\program files\common files\microsoft shared\msinfo\it-it\Windows 2000.iso .com	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program filesJc:\program files\common files\microsoft shared\ink\es-mx\WinAmp 5.08 FULL.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]}v,ådc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\ja\Hacking and Virus Writing for Dummies.pdf .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ š™c:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\Windows 2000.iso .com	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	\??\c:\program fÿc:\program files\common files\microsoft shared\ink\th-th\WinAmp 5.08 FULL.zip .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\à¤™c:\program files\common files\microsoft shared\textconv\en-us\Windows 2000.iso .com	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]}v¼çdc:\program files\common files\microsoft shared\ink\fi-fi\Hacking and Virus Writing for Dummies.pdf .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\·Qç¨`çdc:\program files\common files\microsoft shared\ink\zh-tw\WinRAR 4.01 Cracked BETA.exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\,]}v,ådc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\cs\Hacking and Virus Writing for Dummies.pdf .exe	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\Ic:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Visual Studio .NET FULL.zip .cpl	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\`¢™c:\program files\common files\microsoft shared\textconv\Windows 2000.iso .com	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
4904	e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e8183d793b216f7c9e832c5de0060800_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 3948
  2⤵
  - Program crash
  PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4904 -ip 4904
1⤵
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp

Filesize
3.6MB

MD5
c19ea450f531fc1dc588c3eb6185d949

SHA1
749527797cbcb019d9f7e5dc856fdb72e895d593

SHA256
1e9143559db6f107d8b188f9e4c966912aa5552d1bb39d8b1d0a0df61e44600f

SHA512
4e97218325435c4adeff9bd73746bc3b90bf7d2b66fbbbdc2fb3420b42e4ef334039b618925b0c917d6c6e9d9a63eef8582f74322ee619573f0e7ba49a4c23d3

Download Submit
memory/4904-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4904-624-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download