Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 08:20
Static task
static1
Behavioral task
behavioral1
Sample
f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe
-
Size
752KB
-
MD5
f79e2ec35038ead23e7dd5bc7bc59ef6
-
SHA1
7d59a1e8569d238767517b4bbb2ad4319a85cb63
-
SHA256
648dee15c3a9f15fefd07511703768076d59e1afe718902af4266668428c40b4
-
SHA512
e518a12b870b55ca041afd7a265be352a6ca7c814108d0202ec52383a16c8622e6589e37503662ba83a83171e20206146907d605dd195edbffe27adce9c2d6c7
-
SSDEEP
12288:Ls/AlvrMoB7UqB7Q1KLLHO6Wzvdq/CEQwNDrjtf+O73vO9M3xB4s0z:SITMoJi1KLszlYxN3G9yBA
Malware Config
Signatures
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/2712-53-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral1/memory/2712-54-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral1/memory/2712-55-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
Nirsoft 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2484-37-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/2484-38-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/2484-40-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/2900-47-0x0000000000400000-0x0000000000425000-memory.dmp Nirsoft behavioral1/memory/2900-48-0x0000000000400000-0x0000000000425000-memory.dmp Nirsoft behavioral1/memory/2712-53-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/2712-54-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/2712-55-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/2364-62-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/2364-64-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/2804-70-0x0000000000400000-0x000000000043E000-memory.dmp Nirsoft behavioral1/memory/2804-71-0x0000000000400000-0x000000000043E000-memory.dmp Nirsoft behavioral1/memory/2804-73-0x0000000000400000-0x000000000043E000-memory.dmp Nirsoft behavioral1/memory/672-80-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/672-81-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1148-83-0x0000000000400000-0x0000000000410000-memory.dmp Nirsoft behavioral1/memory/1148-88-0x0000000000400000-0x0000000000410000-memory.dmp Nirsoft behavioral1/memory/1704-94-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft behavioral1/memory/1704-98-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft behavioral1/memory/576-105-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft behavioral1/memory/576-109-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft behavioral1/memory/1148-113-0x0000000000400000-0x0000000000410000-memory.dmp Nirsoft -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/660-19-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/660-21-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/660-24-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/660-26-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/660-30-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/660-28-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2484-34-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2484-36-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2484-37-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2484-38-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2484-40-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2900-43-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/2900-45-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/2900-47-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/2900-48-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/2712-50-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2712-52-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2712-53-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2712-54-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2712-55-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2364-57-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/660-58-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2364-60-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2364-62-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2364-64-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2804-67-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2804-69-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2804-70-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2804-71-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2804-73-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/672-76-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/672-78-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/672-80-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/672-81-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/1704-91-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/1704-94-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/1704-98-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/576-101-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/576-105-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/576-109-0x0000000000400000-0x0000000000419000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exedescription ioc process File opened for modification \??\PhysicalDrive0 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe -
Suspicious use of SetThreadContext 11 IoCs
Processes:
f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exef79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exef79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exedescription pid process target process PID 1324 set thread context of 2020 1324 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 2020 set thread context of 660 2020 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 set thread context of 2484 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 set thread context of 2900 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 set thread context of 2712 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 set thread context of 2364 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 set thread context of 2804 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 set thread context of 672 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 set thread context of 1148 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 set thread context of 1704 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 set thread context of 576 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exef79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2900 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe Token: SeDebugPrivilege 672 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe Token: SeRestorePrivilege 672 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe Token: SeBackupPrivilege 672 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exef79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exef79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exepid process 1324 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe 2020 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exef79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exef79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exedescription pid process target process PID 1324 wrote to memory of 2020 1324 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 1324 wrote to memory of 2020 1324 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 1324 wrote to memory of 2020 1324 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 1324 wrote to memory of 2020 1324 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 1324 wrote to memory of 2020 1324 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 1324 wrote to memory of 2020 1324 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 1324 wrote to memory of 2020 1324 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 1324 wrote to memory of 2020 1324 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 1324 wrote to memory of 2020 1324 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 2020 wrote to memory of 660 2020 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 2020 wrote to memory of 660 2020 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 2020 wrote to memory of 660 2020 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 2020 wrote to memory of 660 2020 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 2020 wrote to memory of 660 2020 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 2020 wrote to memory of 660 2020 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 2020 wrote to memory of 660 2020 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 2020 wrote to memory of 660 2020 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2484 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2484 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2484 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2484 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2484 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2484 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2484 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2484 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2484 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2900 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2900 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2900 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2900 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2900 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2900 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2900 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2900 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2900 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2712 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2712 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2712 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2712 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2712 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2712 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2712 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2712 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2712 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2364 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2364 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2364 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2364 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2364 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2364 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2364 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2364 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2364 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2804 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2804 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2804 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2804 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2804 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2804 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2804 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2804 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 2804 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 672 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe PID 660 wrote to memory of 672 660 f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe"2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe/stext "C:\Users\Admin\AppData\Local\Temp\offc.dat"4⤵
-
C:\Users\Admin\AppData\Local\Temp\f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe/stext "C:\Users\Admin\AppData\Local\Temp\mess.dat"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe/stext "C:\Users\Admin\AppData\Local\Temp\mail.dat"4⤵
- Accesses Microsoft Outlook accounts
-
C:\Users\Admin\AppData\Local\Temp\f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe/stext "C:\Users\Admin\AppData\Local\Temp\dial.dat"4⤵
-
C:\Users\Admin\AppData\Local\Temp\f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe/stext "C:\Users\Admin\AppData\Local\Temp\chro.dat"4⤵
-
C:\Users\Admin\AppData\Local\Temp\f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe/stext "C:\Users\Admin\AppData\Local\Temp\iexp.dat"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe/stext "C:\Users\Admin\AppData\Local\Temp\ptsg.dat"4⤵
-
C:\Users\Admin\AppData\Local\Temp\f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe/stext "C:\Users\Admin\AppData\Local\Temp\ffox.dat"4⤵
-
C:\Users\Admin\AppData\Local\Temp\f79e2ec35038ead23e7dd5bc7bc59ef6_JaffaCakes118.exe/stext "C:\Users\Admin\AppData\Local\Temp\opra.dat"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dial.datFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\offc.datFilesize
1KB
MD557a0678ab7bea0ea82a9b09ee70ebaf1
SHA151b681b2c0494a322f42627fcc8eebc796ad4751
SHA256e9db776799d257955933a74d6665ad52dadafbd47f5cdcd4dd95a13dcb243ed4
SHA51291a40215a9e10ba5302afc0956cf1ca4ebf8ac268c77b056da29f12582c4fed7d96778c9a6ab2a4e6b699d037893fe8dce18148437de053b4d387d744fbe0089
-
memory/576-109-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/576-105-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/576-101-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/660-26-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/660-28-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/660-19-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/660-21-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/660-24-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/660-58-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/660-30-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/660-17-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/672-76-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/672-81-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/672-80-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/672-78-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1148-113-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1148-88-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1148-83-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1704-91-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1704-98-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1704-94-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2020-27-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/2020-4-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/2020-6-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/2020-2-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/2020-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2020-12-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/2020-14-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/2364-57-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2364-60-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2364-62-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2364-64-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2484-40-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2484-34-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2484-36-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2484-37-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2484-38-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2712-53-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2712-55-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2712-50-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2712-52-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2712-54-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2804-69-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2804-67-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2804-73-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2804-70-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2804-71-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2900-48-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2900-47-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2900-45-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2900-43-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB