Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2024, 03:19
Behavioral task
behavioral1
Sample
fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe
-
Size
11KB
-
MD5
fbcff06b38e4ac7bcb904bdad1f9bdb9
-
SHA1
b4844e4398344a035507bb085353d8cce62739cd
-
SHA256
f75b7535365c80c14523f074f5007fc6769e0453562d369362dff9c7e52874e5
-
SHA512
29399e1558e4cffc128b38ba87d39d82184a971c4ab4baefc5ce452d9e03ce8f8515e9b41dc1038df65c11bbaec08200da42dfdc631820a1ea945b2ec4959a1d
-
SSDEEP
192:S06iazzoKkrt/F53lGHuL3/E/GCizES4TN/o/04qcB6bdhSz46OXddIxa4sy6kp:S06ih3t/rgOL3/EZiw5o0AadUz46OXdg
Malware Config
Signatures
-
Drops file in Drivers directory 22 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\gm.dls fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\wfplwfs.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\afunix.sys fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\wfplwfs.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\NdisImPlatform.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\NdisImPlatform.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\wfplwfs.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\NdisImPlatform.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\NdisImPlatform.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\wfplwfs.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\uk-UA\NdisImPlatform.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\NdisImPlatform.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe -
Manipulates Digital Signatures 2 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wintrust.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe -
Modifies Installed Components in the registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}\ = "ϵͳÉèÖÃ" fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}\stubpath = "%SystemRoot%\\system32\\exloroe.exe" fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK} fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3296-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000100000000002b-7.dat upx behavioral2/memory/3296-343-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/3296-4822-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\3D Objects\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.19041.1_none_5476a60692fad199\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commondesktop_31bf3856ad364e35_10.0.19041.1_none_a81a33274fb1b624\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_10.0.19041.1_none_a208296858c76413\Desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.19041.1_none_905c6a851ca62951\Desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\Web\Wallpaper\Theme2\Desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commonstartup_31bf3856ad364e35_10.0.19041.1_none_b2014b56ea660ec9\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2\Desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\Web\Wallpaper\Theme1\Desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-commonvideos_31bf3856ad364e35_10.0.19041.1_none_923716ddadd939c8\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Admin\Searches\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\Fonts\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-accessoriesuser_31bf3856ad364e35_10.0.19041.1_none_d9f53b39b3834744\Desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Admin\Videos\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.19041.1_none_2108f0881e5a7a03\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-commonmusic_31bf3856ad364e35_10.0.19041.1_none_2f07a4cad3dec315\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Admin\Music\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Public\Downloads\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Public\Desktop\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Public\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1132431369-515282257-1998160155-1000\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-theme2_31bf3856ad364e35_10.0.19041.1_none_8ccaf9c8444b9274\Desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\Media\Desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Public\Libraries\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Public\Music\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-s..ccessagent-binaries_31bf3856ad364e35_10.0.19041.1_none_3802d0d85b60df4c\autorun.inf fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\autorun.inf fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification F:\autorun.inf fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\atl110.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-VmBus-VirtualDevice-merged-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\en-US\wiadss.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\spp\tokens\legacy\rac-generic-private.xrm-ms fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\winmsipc.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\es-ES\mstask.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\adprovider.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-Common-WOW64-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0211~31bf3856ad364e35~amd64~~10.0.19041.1288.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Embedded-UnifiedWriteFilter-WOW64-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SMB1Deprecation-Group-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\WceISVista.inf_loc fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-RemoteFX-HyperV-Integration-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_1_for_KB4537759~31bf3856ad364e35~amd64~~10.0.1.0.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fr-FR\odbcconf.exe.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\KBDUSL.DLL fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\acppage.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\AudioEndpoint.inf_loc fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Storage-VirtualDevice-FibreChannel-merged-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\it-IT\jscript.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\en-US\sdstor.inf_loc fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\en-US\sisraid2.inf_loc fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netvf63a.inf_amd64_a090e6cfaf18cb5c\fetn63a.sys fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ETWESEProviderResources.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Containers-Guest-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Common-RegulatedPackages-WOW64-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\netavpna.inf_loc fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gameux.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\XPSViewer\ja-JP\XPSViewer.exe.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectPlay-OC-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\de-DE\mmcshext.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\netevbda.inf_loc fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NFS-ClientLocalUI-D-Opt-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SMB1Deprecation-Group-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\de-DE\onexui.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wtsapi32.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Keywords\{A5A7C794-3D59-41DF-915F-19ACDA526FC9}4105.bin fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\th-TH\windows.ui.xaml.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\ja-JP\MSFT_WaitForSome.schema.mfl fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SimpleTCP-Opt-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\iaLPSS2i_GPIO2_BXT_P.inf_loc fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\netnvma.inf_loc fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\srmshell.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Virtualization-RemoteFX-User-Mode-Transport-WOW64-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\nete1g3e.inf_loc fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\SmbBandwidthLimit.cdxml fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WINSRPC.DLL fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Hyper-V-Services-Package~31bf3856ad364e35~amd64~~10.0.19041.264.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\downlevel\api-ms-win-core-namedpipe-l1-1-0.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\ufxchipidea.inf_loc fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\Amd64\MSECP-manifest.ini fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\sisraid4.inf_loc fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\MSFT_NetAdapterVmq.Format.ps1xml fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-UX-UI-63-Package~31bf3856ad364e35~amd64~~10.0.19041.1288.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dmcompos.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\it-IT\Dism.exe.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Speech_OneCore\Common\en-US\VES-Disambiguation.0409.grxml fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-NetFx2-OC-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmpace.inf_amd64_5e0fbd01da4f7c7b\mdmpace.inf fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\it-IT\wevtfwd.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ja-JP\eapphost.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\tpmvsc.inf_amd64_9b03a5f041e8d2b2\VirtualSmartcardReader.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fr-FR\wmitomi.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\nlaapi.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Microsoft.Support.SDK.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\175.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\ui-strings.js fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36_altform-colorize.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.altform-unplated_targetsize-16.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\OneNoteAppContracts.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\SourceAppService.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-256_altform-unplated.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\WideTile.scale-200.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_listview_18.svg fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\joni.md fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorSplashScreen.contrast-black_scale-200.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-72_altform-unplated.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxMediumTile.scale-400.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\2.jpg fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\de-DE\msdaremr.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-24.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp10.scale-200.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\ui-strings.js fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\PREVIEW.GIF fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSplash.scale-200_contrast-black.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\DeleteToastQuickAction.scale-80.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_bg.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\185.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FetchingMail.scale-150.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Light\IsoLeft.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\Videos\people_wel_motionAsset.m4v fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-64_altform-lightunplated.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_contrast-black.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\System\ado\msado28.tlb fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\ImportFromDevice.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-72.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.scale-400.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-72_altform-unplated_contrast-white.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-40_altform-unplated.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-36_altform-unplated_contrast-black.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\da-dk\ui-strings.js fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right-pressed.gif fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Light.scale-400.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.19041.1_none_ab1cdb679f059ace\pcwutl.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mlang_31bf3856ad364e35_10.0.19041.746_none_3f2d4097772e54ff\f\mlang.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\1033\alinkui.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_10.0.19041.1266_none_153dc4c3b9f13a6f\ci.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nifests-onecorebase_31bf3856ad364e35_10.0.19041.746_none_dd92b0d44ce363ab\mup-replacement.man fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mapcontrol_31bf3856ad364e35_10.0.19041.1202_none_9269f331f42a1765\MapControlCore.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..wdm-audio.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_55752eff5e7e1565\wdmaud.drv.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-docprop.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_bfce1fe5bc80bb98.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-t..ces-serverlicensing_31bf3856ad364e35_10.0.19041.1_none_a7ba8461d4d5f4b9.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-qos-adm_31bf3856ad364e35_10.0.19041.1_none_89d4812563ddb6c1\QOS.admx fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-p..inrt-core.resources_31bf3856ad364e35_10.0.19041.1_de-de_6dd06b57074d7979.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-basedependencies_31bf3856ad364e35_10.0.19041.1_none_c2e7a999fc8db0b6.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_msmq-driver-deployment-languagepack_31bf3856ad364e35_10.0.19041.1_es-es_4d22a6a01df2e39a.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\diagnostics\system\Power\fr-FR\DiagPackage.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_1394.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_a556c45e8b680b98\1394.inf_loc fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..d-library.resources_31bf3856ad364e35_10.0.19041.1_en-us_6b197ad8f6377bcb\Windows.UI.PicturePassword.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-SearchEngine-Client-Package-shell-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.mum fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-refsutil.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d95dc3069abe8236.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-s..osoftaccountcloudap_31bf3856ad364e35_10.0.19041.423_none_281093d42ab395f7.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\OkDone_80.png fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_c413487bfdbf0ab34e81a4fb6f95b58c_31bf3856ad364e35_10.0.19041.1220_none_0ec4d3dd6aafcd6d.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-a..wdm-audio.resources_31bf3856ad364e35_10.0.19041.1_en-us_26a4e6c8a1381605.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-homegroup-controlpanel_31bf3856ad364e35_10.0.19041.746_none_9e82b4275481e1ba\hgcpl.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-dssetupcli_31bf3856ad364e35_10.0.19041.546_none_d7336849176fde95\f\dsrole.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-peerdist_31bf3856ad364e35_10.0.19041.1151_none_91f4a96c9f464c76\f\PeerDistSvc.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..vider-dll.resources_31bf3856ad364e35_10.0.19041.1_de-de_0af4ba380f3bcf69\whqlprov.mfl fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..imeserver.resources_31bf3856ad364e35_10.0.19041.844_en-us_1d267af587f56b9c\r\assignedaccessmanager.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..ernal-adaptivecards_31bf3856ad364e35_10.0.19041.1_none_730c46ad4e9db2d8\Windows.UI.Shell.Internal.AdaptiveCards.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-secinit.resources_31bf3856ad364e35_10.0.19041.1_es-es_32875f533521a9ea.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\servicing\Sessions\31100112_89286732.back.xml fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppxManifest.xml fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_nvraid.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_6eb421edad0bca03.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_it-it_0d9052e350483924\createPermission.aspx.it.resx fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_dual_wceisvista.inf_31bf3856ad364e35_10.0.19041.1_none_7027182b5e87323d\WceISVista.inf fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..qos-pacer.resources_31bf3856ad364e35_10.0.19041.1_es-es_a107b29eb32c7d51\pacer.sys.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-signalmanager_31bf3856ad364e35_10.0.19041.264_none_bcf75b4aec20c233.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-mccs-accountsrt_31bf3856ad364e35_10.0.19041.264_none_0d7b2f9f635b8d49.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Manifests\msil_system.data.entity.design.resources_b77a5c561934e089_10.0.19041.1_en-us_f063c9bd0eef4d6a.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-tapi3_31bf3856ad364e35_10.0.19041.746_none_4996a6e922c0747b\tapi3.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\servicing\InboxFodMetadataCache\metadata\Language.Basic~fi-fi~1.0.mum fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\servicing\Packages\HyperV-VmTpm-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.mum fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-azman.resources_31bf3856ad364e35_10.0.19041.1_en-us_c7a697ad09c27813\azroles.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-onesettings-client_31bf3856ad364e35_10.0.19041.1081_none_707e08cfb7595994\OneSettingsClient.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\EPDF_RHP.aapp fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-gdi32full_31bf3856ad364e35_10.0.19041.264_none_33cd145286244f7a.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-p..istfolder.resources_31bf3856ad364e35_10.0.19041.1_en-us_b8fc917c15baa796.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..tservices.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_f15c2f5815b5c92d\TipTsf.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..mof-admin.resources_31bf3856ad364e35_10.0.19041.1_en-us_d9389be11d868c46\smtpcons.mfl fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-winrt-windowsgraphics_31bf3856ad364e35_10.0.19041.264_none_e7a7ff8203ef827a\f\Windows.Graphics.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.19041.1_none_a2fa28d9db4c0081\w32tm.exe fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_networking-mpssvc-netsh.resources_31bf3856ad364e35_10.0.19041.1_de-de_f3914308c2a0d4de\fwcfg.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$_system32_wbem_fr-fr_45318c94b21276b4.cdf-ms fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-n..datastore.resources_31bf3856ad364e35_10.0.19041.1_it-it_c9ce7fb39e1d55da.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_mssmbios.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_8705544587370182.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.resources\v4.0_4.0.0.0_de_b77a5c561934e089\System.Data.resources.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..xcorecomp.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_e8440c09eef3f557\CvtResUI.dll fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps.resources_31bf3856ad364e35_10.0.19041.1_es-es_f85bc4532ee87d3f\hidphone.tsp.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.19041.1023_nl-nl_348ed0341bb1fbff\comctl32.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.1_none_9478227a478f23d5\ShouldContain.snippets.ps1xml fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..fontcache.resources_31bf3856ad364e35_10.0.19041.1_en-us_86cec2673098cffa\FntCache.dll.mui fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l.desktop.searchapp_31bf3856ad364e35_10.0.19041.1_none_37a8fc596f462cbc\12.js fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-shell32_31bf3856ad364e35_10.0.19041.1266_none_eb43a8b5fb8e05e3.manifest fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3296 fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSystemtimePrivilege 3296 fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3296 fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe 3296 fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3296 wrote to memory of 4888 3296 fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe 86 PID 3296 wrote to memory of 4888 3296 fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fbcff06b38e4ac7bcb904bdad1f9bdb9_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Modifies Installed Components in the registry
- Drops startup file
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:4888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD517ac4cb365920e2d43bd1e9cbbb1dd33
SHA1210234702c0baa07c10d8953e85d8d10458cfb0e
SHA25664b5269b2e5b9fb6e3f751c4acf9eba8c49d1ab2f426b9b54f691fe80a03e233
SHA51252a18901e8bf07ae43160c78004c1a31a884f51bddffe4b5d0920fb86f3a70733b65ee9a9360f72ae934961f3dfe7d9dc415191ec49d8e6c57ea3ff05b5bbd88
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspx
Filesize3KB
MD5bf6f6901b7f70ad8842fc2f3be213aa6
SHA1e45bded84c4fc25f84004afba058b0097799af8e
SHA256d9328d2967b697533ec040317dd70e3651c9a44210da1ed978a4b8e5597dc2ee
SHA5126839ca885820f8ba901147a725618b8fcba46c02a1bfea02c34b0d32c3017a62ecd6bb93c7046d88e77cb730d986dccc1da6360e2aad871321f0e4724ccb6cf0
-
Filesize
2KB
MD53dc3ec21e9edd8c9d2d52c6ce0bb3e5a
SHA1a0ac3f8a970e1ff5d8bb86d2a7be0926cda8ad0d
SHA256b2acad5ce3e2060b8f92e1421e253b432c255cb8867de1db6115702afd2f3fc5
SHA512c714028e16f50b2aa9511701f52b2d9e7b8d0f2bf07dc0e226d2002b09d7b72a64445737f3c0054b5d3d9faa4d043323a10f262fb9cba74bb3a7adde5bd60001
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\ManageAppSettings.aspx
Filesize14KB
MD555eae5d2fb72223fa3fe71d82745bd9f
SHA1de9f7907ffb13acc83f17594ab1d34d596144cf8
SHA25679141e881a5abb763614dac04b029e645cfa4d1f1a3623f1048c657e2fe4a4cf
SHA51255f4511499f628485aaa79baa528bf3a981a5db7912445394b98540a6fe8789c768eb3dc760ef8e37665ed0d8f345c110657684d11fdef8b4c8d50f4766b2a9f
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\ManageConsolidatedProviders.aspx
Filesize12KB
MD50e1dbac67a1c5a71c49d0c5e1fde8b59
SHA12e88debe7ebf900a8b3e618d12ebe0bc3eb929a1
SHA256d0f5a0a25faf3d12565292f5b38848ca53b5397af0b7529d259e36b9d21eef35
SHA5122bf3c1bd7095dd39c0c8db9d5811a54c4f3ea94e4607d5c5606bfaeffd5cf1df64d1a6b14e10ec4628d53cc94fc0472eb619469faf224cb2deeec42c15deae66
-
Filesize
9KB
MD5edf0afdc0128d7f629fed0faf2579a81
SHA1e5aee733e3dce326f122c2c3c35a7359b1754fcb
SHA256800ce0a74b1cec0e7f13290432c7de48f90f7efabf1003db8e87ddc5b7cf7a52
SHA5125ff249e68d50bdacaec6e9d4c0c1c37cbcb9ff29682cd09dd7a53ece2b3e61d9a38f32775d14b5ba1e825a9cf47e8157a7a20532a8df49ed2a121b803a4c8b24
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\chooseProviderManagement.aspx
Filesize2KB
MD5bec2c348aae4e370a119304b7089fab5
SHA1cf4286052402d47d67fa63b22d523427b90fe7fd
SHA256323889556cff285b78a3e55c7df3d03e4d5fab4c41bcc4f9a2d96e9a62b155ef
SHA512395829fe62536674f16ba76e3030cfec449aada4d081d7b2cd0697876a8db2474b05bf697cdd49eff250dedc34d9dde4a69daa8c76be6a3f5754f024cfa3342a
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\createPermission.aspx
Filesize10KB
MD5cf26386ce9fc8b90cfff4d9380a8e527
SHA171d4c6f5acc0e35dad26dbc0ee8c265e36acf254
SHA2568d18e110498599912b227282f70656f608755303b8acbaedfc1ed66ca94a3a57
SHA5124fcef6795d625f07a79e1c344e9430d762981bd0b518ec49a2016a8806243e8f5f84aec6bcba1ccab494f8e39afe8a38d6e39463741649c354f649d461260aa7
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\managePermissions.aspx
Filesize21KB
MD5a49a8994e1d3c8440b1ac9edd6cd2b3a
SHA10db4ef18a268b4e6714f22dab1d935422e1ad718
SHA2561cd8827d0fa815c7c3e74a4267edb94b7e2080831c48356395aacbc703aef5bd
SHA512684275aa2e5ea9dd3e968cf3756efb4e6a3f851b84e5c54e3bbae7e7ddba213850e98b4e14e17b57dd1c9a8ce7d9ffc1672704b564c2bf81cc0ad155c533f8d7
-
Filesize
11KB
MD50fbc61632974f6f29b389af69737faeb
SHA1c6548ce17d48b0301938e3607ccc5ddeb6a29afe
SHA256ea2e659f94962c0f2a1979d97f40f21a3bb69e16efd4f2e57fac9697f6e0be0f
SHA512e09574ac51bf44175ef24143a16e80254561edf0b73f813bc8f453ee30ddb06c93e74ace3fdadc6b96f8a115bae4c2efc6cc3ba3bac79e7cf612799da6506770
-
Filesize
10KB
MD53b807ee26c98b495a919961b5e212926
SHA1de9def29b45a9194ce09c276f34fdc6dd2377fec
SHA256dbfe9720eaf3ed06618c3825e235cd685a7e49e321d5ce41b76d32716024dfa6
SHA512d188399a76b16402a569a94973cd94c6bce9592efcb0ce07178214fab03403b16bd2766e21e0a1aec2d6ce13ddaf35e58848bd9ca40605aeba9591d0900c90f1
-
Filesize
9KB
MD549626189b170ef1f616fedbb8e9659fe
SHA16df320f02e0d792db7a9270bdf26e1116351bd2d
SHA25686ad023b154bc56f0479808fdf3d462076c2f721ee896adf45439423ebabc435
SHA5129c212d2220109b8375a366bf0bc1caa3446a26beab856c496b9699771d4786e5c51a3e1753942529d23545a16008e5e7ef8cf04451892691bc9dd2b9d85f6933
-
Filesize
1KB
MD5b62de344039504b0b7e9ecab12a1ddc6
SHA111699ed72e4a0fb9d5eed0bbbf1f7178f232ad67
SHA25658061f377a32f4f7c17f754045f858ff470cfa4a709e98e67ef073e9de4c7864
SHA5123f210258f81a22db9132027499bf655bbdb1c2b5d09552901f986a20b7586cf8a09d33d736db4b78a49f8ea2ea5b85ef2e7412d4e8a8ab01f213a1a98f56ae57
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\setUpAuthentication.aspx
Filesize2KB
MD5117e3c281379bb081f92c8e89bc80907
SHA1be5812f2261db2102209720cc7828bd27fc7e4d4
SHA256e7cec71c01d3b7c1d0746a0014a948bd1ce69c5329b5c1ef0b984360a82644b2
SHA5124ae89f89af79dc59341d4a43956e61b45d7a3dfce1584bca6ac99968027689cdf45a13442cd826c06d09598cec43e674d13dd49c3a0100fa375f1acad5c0b2f6
-
Filesize
6KB
MD50810e56f14150a49f329fd814e44681a
SHA16274a45877ec782cf2d81c8682593a0318b98313
SHA25643745e2610184e8a962f1618db51f58bbd82572a8fa01f67bdf520a579f1c079
SHA5128b06819f3b3124c1a8c7205231eb4bb8628f98a42ef73698954afbc8b7e67cc5180352fe582b1c386cb2991d446e92835db1d6f55935ab8b1b4ddabede2e2121
-
Filesize
13KB
MD5cd84b119ebffaba74773617033cb6674
SHA17b0e335b8b678704566e0f216bc62b0e6655acc0
SHA256466351c7e536669c4f42bd366ac43db91dc47e5b7f95af56507cb3294d0c1419
SHA512fd9e7525c9b363d487edc5b14b9a68cb28ee5632cbb046726f15868d288bcc776d40e031c3af2fcbadee08cf83208160eeeda18caa1bd49f9fbedd6f30cf9af1
-
Filesize
4KB
MD5ed4bf7a3d573a2f74174f4b6b2b3ce4e
SHA19eb14f7ffef1b9a1efdf67712758a579f7625a3a
SHA256fce41934a2771525c68c524d90427f7e246ebe25bd407be2ca87b8eb28c81eab
SHA51257b631db6887288d442eb529bc6c24b692c7d276b56c7952af3ab5e95f54765613e4dda03fd1297b2fb7d2bbd06bc837da76b4f1fa1115c3fdb43539b7bffef0
-
Filesize
6KB
MD59ee37bbd48ff7a1a68456b117b0a303b
SHA14561b070fadc2ba68d41f46560bd77ecd196b0a4
SHA25680f4235cdf0ef650b6b58dbdacaec6e5720eb4679f28c274861660d08c9514f6
SHA5121bc598aa04668826e93e4c2709fff37192105932c0e62b05fafe913986d675c7f1c12af2f45af4a8be41a74a95b393511e0e56173a6eb1388169f8409240bf18
-
Filesize
10KB
MD5bc8c570bc0f2b3a7b840c068657fa6b6
SHA174e3b62dc1d8e7eb6e4403ce70e9eaab6af33355
SHA256cd894ffde7a140b5d032a29ec43694a5d133448104cf79db87c866f7820d955d
SHA512eeb5dce278690e4a57569b1a8fb3df126930b8106106c0915ef9627bf4f744a1024b56c7b7125df0e00e47dcb99ccad6f4d31713aa293869125ce3529e370b36
-
Filesize
4KB
MD5cb6ccab77622fa57c7fa8c99dd5c8cc5
SHA10631987814aeeb4b88974ff10f0311cfe4f87ef6
SHA2560c220ffa13badfd659c6747258b451f07ad9150304e731eea9bbe6d24739b0d8
SHA512fa5e40d949235e1b3b2aace3e8c8c79dc6940b0c31aa2004bb352a463a6ed186bc876bc6e6ab0714403649b6235a6a47a2fb7afaec100c429b2eea6b2efcf3b9
-
Filesize
6KB
MD5b4ecddf369366bfe52e9cba8d0bedc99
SHA1af4c5407dd2ed37b639e79a6154f567636036ee8
SHA25678f0a199d86fee526a7135a1cc442c4955d683688b902d38328c1d6b53c1940f
SHA51257cb8bf7d6a3660cb09b10bf2b790ae789d52d9f8aae08a38ae1d1d9e12ce20fbb8f1e4eaa8fcadac49c289d4ca545ddc89dc09210c48788059fcaf9a27fe5d3
-
Filesize
1KB
MD5d9881ea1ea38b56c4130d2a28e8b4337
SHA131e5db83ddb68d283684adeecd47bb84aadb1a2e
SHA256b4ba4ba3f832a667ef50e211655396cd0c49f193956a58a8ab0c74e208c63ae1
SHA512c98fa43c3f026c9fa7a4a52a2693eb7ccf09e355d5a81baef2aee8b0612dc92080f960f7bfa598d5d01933334641012dbada4ce6cd5f1684bdda25b1186b9d86
-
Filesize
817B
MD5b68eff3595c120f016ccd89df416f8eb
SHA1eb735b03325d735ba0f6200543c3458b73547a23
SHA25605127968f649098c105f24b04c04f8d67169f4de3f653f72ba5b722cbbfce090
SHA51264ddb97022f4be63a994c1781fb3d98385f611c35ae05cf8013ac42d9381c703fdae48bf117eb44be8c3efd0fd0d88685c07b72c8457d173e78b3c26ea3525f2
-
Filesize
1KB
MD5e2a262b41c4a32497031cf5848d9a2c9
SHA17f6a242757bf718f4db296287e17471fd7cfe227
SHA256784fa62464b85e13965d74e1f5216628a1b6fcb77aec811401bba6f88294a9d2
SHA512d17aae2ffa0827de63ee12dece114a90738f53266a3f93e3d9d2cf95d1f23eba04e0067270e1588a71f2ac42def615815408bcbcf8d6de7bd7806c3f58894cab
-
Filesize
68KB
MD59e4eb001ebdb502833796b593dd475bd
SHA192b05f9a5887e349bbc478eb57f94234381c3417
SHA2564e32479ccb6a9567cc9fdcd37e36ea723d7c616d4b1058fb4fecdc17e78bbc12
SHA512af7ce86d4e393965585e9295a85dd48790eb373650e3c75895c9690329f5bbc469ad242493fddb6fc994ed800d890a80ef2346021b6015a518daaf5c7392c308
-
Filesize
91B
MD51ecbee74203c68e028f33401bf4bbe36
SHA1d61cb792dbf96b5a9b4d72367cb1150ca2618279
SHA25605b04e8a590868f3fb7386de34a72288b90531d5d067bdc40f954a2736706293
SHA51235620ad6fe8c69154311d71bd2459aa0048d8b98e24b4c5bcd8bc73780ac2b45cf7eb2e8adc0b8dfaeec2f54c0141ebe93a00bfb999ab17ee7d24948a6082960
-
Filesize
82KB
MD56c07e9e2d6621105cfb1458cda118951
SHA1ad36e673ac77d211a2743ac498132d8381cbaaa3
SHA25605fa0c6167fd9c207da904277665c7f87353629afa7df1495b6c10fdfbc8e8fd
SHA512a131a066b63205863e692207581c9ef363322c6ea066570e27c7d0ed06b1ead84f172ac9e82899ea7df5cbb86f85044749d8d471426b5256989db024c53db0ad
-
Filesize
11KB
MD5fbcff06b38e4ac7bcb904bdad1f9bdb9
SHA1b4844e4398344a035507bb085353d8cce62739cd
SHA256f75b7535365c80c14523f074f5007fc6769e0453562d369362dff9c7e52874e5
SHA51229399e1558e4cffc128b38ba87d39d82184a971c4ab4baefc5ce452d9e03ce8f8515e9b41dc1038df65c11bbaec08200da42dfdc631820a1ea945b2ec4959a1d