a63630d5693aa0df2d41847b2c6ad6c91e7a21fdf53ca39246acaafa9f649c14

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
Size

7.2MB
MD5

ff6228357aedc5a2486c7e4c48bd5e62
SHA1

61e1bca85d5d25e9d54b221608f24e374107ec1a
SHA256

a63630d5693aa0df2d41847b2c6ad6c91e7a21fdf53ca39246acaafa9f649c14
SHA512

9bfb209f312972aeda7a2af1421b06cff4783ad2a3ea1c32c039a55e32cae62a2a8eb52b962a6a264fd0ec7a015e0b33f4ee0b038ebbb8dcae021aa3e13e2e60
SSDEEP

98304:jjBxcO4EYTjigxC9Y5lpuG8RNay091BAGUoq2VjnmL:jjBxcO4jjSQIG8WyizUGnQ

Score

8^/10

persistence upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Drivers\ETC\HOSTS	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1720-0-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/files/0x0030000000010440-7.dat	upx
behavioral1/memory/1720-371-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe"	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\DbTasker.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\hal.dll	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DBTASK.EXE	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dbzip2.dll	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dbexe2.dll	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\LockFile.dat	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DbTasker.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\WinAmp 5.08 FULL.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\it-it\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\triedit\en-us\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\vsto\10.0\1033\DVD Xcopy PRO Illegal Warez.iso .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\web\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\he-il\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\nb-no\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\th-th\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Full warez download sites.html .pif	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Full warez download sites.html .pif	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\pl-pl\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\pt-pt\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ar-sa\Internet Explorer 7 FULL BETA.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SP2 WORKING activation crack.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SECRET DEVELOPER serials.txt .cmd	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\de-de\Internet Explorer 7 FULL BETA.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\pt-br\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\vsto\10.0\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\bg-bg\Internet Explorer 7 FULL BETA.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\WinAmp 5.08 FULL.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\WinAmp 5.08 FULL.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\it-it\WinAmp 5.08 FULL.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\Windows XP SP3 REAL VERSION.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\web\WinAmp 5.08 FULL.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\sl-si\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\filters\Internet Explorer 7 FULL BETA.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ar-sa\HalfLife 2 WORKING Steam Activation crack.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\de-de\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\WinAmp 5.08 FULL.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Pamela Anderson FULL VIDEO.mpg .scr	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\stationery\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\vsto\10.0\1033\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\WinAmp 5.08 FULL.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\zh-tw\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\es-es\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\triedit\de-de\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\textconv\es-es\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\textconv\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\da-dk\Internet Explorer 7 FULL BETA.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fi-fi\How to stop NetSky.doc .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\WinTask.zip	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
332	1720	WerFault.exe	27

NTFS ADS 64 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\textconv\en-us\WinRAR 4.01 Cracked BETA.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\`ç(c:\program files\common files\microsoft shared\ink\arc:\program files\common files\microsoft shared\ink\bg-bg\WinAmp 5.08 FULL.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\â(c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\WinRAR 4.01 Cracked BETA.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\À5c:\program files\common files\microsoft shared\ink\nb-no\Windows 2000.iso .com	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\textconv\ja-jp\WinRAR 4.01 Cracked BETA.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\3¨Mwc:\program files\common files\microsoft shared\ink\cs-cz\Hacking for Dummies.pdf .cpl	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\À5c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Windows 2000.iso .com	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\À5c:\program files\common files\microsoft shared\ink\lt-lt\Windows 2000.iso .com	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\åO-uÜç(c:\program files\common files\microsoft shared\textconv\it-it\Hacking and Virus Writing for Dummies.pdf .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\c:\program files\common files\microsoft shared\triedit\en-us\Windows XP SP3 REAL VERSION.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\ink\de-de\Windows XP SP3 REAL VERSION.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\el-gr\WinAmp 5.08 FULL.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	\??\c:\program files\common files\microsoft shared\ink\it-itc:\program files\common files\microsoft shared\ink\ja-jp\WinAmp 5.08 FULL.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\sv-se\WinRAR 4.01 Cracked BETA.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\åO-uÜç(c:\program files\common files\microsoft shared\msinfo\fr-fr\Hacking and Virus Writing for Dummies.pdf .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SP3 REAL VERSION.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\3¨Mwc:\program files\common files\microsoft shared\ink\bg-bg\Hacking for Dummies.pdf .cpl	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ .cmdc:\program files\common files\microsoft shared\ink\cs-czc:\program files\common files\microsoft shared\ink\cs-cz\Kazaa Lite 2005 Edition.rar .pif	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\f .exec:\program files\common files\microsoft shared\office14\WinAmp 5.08 FULL.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\åO-ulê(c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\Hacking and Virus Writing for Dummies.pdf .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\åO-uÜç(c:\program files\common files\microsoft shared\ink\pt-pt\Hacking and Virus Writing for Dummies.pdf .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\åO-uÜç(c:\program files\common files\microsoft shared\msinfo\en-us\Hacking and Virus Writing for Dummies.pdf .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\fi-fi\WinRAR 4.01 Cracked BETA.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\À5c:\program files\common files\microsoft shared\ink\hr-hr\Windows 2000.iso .com	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\À5c:\program files\common files\microsoft shared\ink\lv-lv\Windows 2000.iso .com	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\tc:\program files\common files\microsoft shared\filters\Playboy centerfold HOT.gif .scr	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\üË†c:\program files\common files\microsoft shared\ink\bg-bg\Pamela Anderson FULL VIDEO.mpg .scr	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\mmonc:\program files\common files\microsoft shared\msinfc:\program files\common files\microsoft shared\msinfo\ja-jp\WinAmp 5.08 FULL.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\Ä‰c:\program files\common files\microsoft shared\ink\cs-cz\Pamela Anderson FULL VIDEO.mpg .scr	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\åO-uÜç(c:\program files\common files\microsoft shared\ink\fr-fr\Hacking and Virus Writing for Dummies.pdf .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\åO-uÜç(c:\program files\common files\microsoft shared\textconv\fr-fr\Hacking and Virus Writing for Dummies.pdf .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\<È†c:\program files\common files\microsoft shared\filters\Pamela Anderson FULL VIDEO.mpg .scr	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\À5c:\program files\common files\microsoft shared\ink\pt-pt\Windows 2000.iso .com	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\®c:\program files\common files\microsoft shared\vsto\10.0\1033\Visual Studio .NET FULL.zip .cpl	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\åO-uÜç(c:\program files\common files\microsoft shared\textconv\ja-jp\Hacking and Virus Writing for Dummies.pdf .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\triedit\en-us\WinRAR 4.01 Cracked BETA.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\c:\program files\common files\microsoft shared\triedit\es-es\Windows XP SP3 REAL VERSION.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\À5c:\program files\common files\microsoft shared\ink\el-gr\Windows 2000.iso .com	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\åO-uÜç(c:\program files\common files\microsoft shared\ink\hr-hr\Hacking and Virus Writing for Dummies.pdf .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\À5c:\program files\common files\microsoft shared\ink\ru-ru\Windows 2000.iso .com	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\À5c:\program files\common files\microsoft shared\ink\hwrcustomization\Windows 2000.iso .com	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\ro-ro\WinRAR 4.01 Cracked BETA.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\uk-ua\WinRAR 4.01 Cracked BETA.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\Fˆc:\program files\common files\microsoft shared\msinfo\it-it\Pamela Anderson FULL VIDEO.mpg .scr	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\åO-uÜç(c:\program files\common files\microsoft shared\vsto\10.0\Hacking and Virus Writing for Dummies.pdf .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\åO-uÜç(c:\program files\common files\microsoft shared\ink\de-de\Hacking and Virus Writing for Dummies.pdf .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\åO-uÜç(c:\program files\common files\microsoft shared\ink\ja-jp\Hacking and Virus Writing for Dummies.pdf .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\åO-uÜç(c:\program files\common files\microsoft shared\ink\ru-ru\Hacking and Virus Writing for Dummies.pdf .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\À5c:\program files\common files\microsoft shared\textconv\es-es\Windows 2000.iso .com	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\À5c:\program files\common files\microsoft shared\triedit\fr-fr\Windows 2000.iso .com	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\N Internet security 2006.rar c:\program files\common files\microsoft shared\vc\WinAmp 5.08 FULL.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\4zŒc:\program files\common files\microsoft shared\vsto\10.0\1033\Pamela Anderson FULL VIDEO.mpg .scr	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\common files\microsoft shared\vsto\10.0\Visual Studio .NET FULL.zip .cpl	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\cs-cz\WinAmp 5.08 FULL.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\À5c:\program files\common files\microsoft shared\ink\de-de\Windows 2000.iso .com	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\åO-uÜç(c:\program files\common files\microsoft shared\ink\th-th\Hacking and Virus Writing for Dummies.pdf .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\êøËÀzÙBÈâ(c:\program files\common files\microsoft shared\msinfo\en-us\Full warez download sites.html .pif	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ .exec:\program files\common files\microsoft shared\vsto\10.0\WinAmp 5.08 FULL.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\åO-uÜç(c:\program files\common files\microsoft shared\ink\en-us\Hacking and Virus Writing for Dummies.pdf .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\zh-cn\WinRAR 4.01 Cracked BETA.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\tr-tc:\program files\common files\microsoft shared\ink\zh-tw\WinAmp 5.08 FULL.zip .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\åO-uLå(c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\Hacking and Virus Writing for Dummies.pdf .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\Hc:\program files\common files\microsoft shared\ink\ar-sa\DVD Xcopy PRO Illegal Warez.iso .exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\cs-cz\WinRAR 4.01 Cracked BETA.exe	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 332	1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe	28
PID 1720 wrote to memory of 332	1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe	28
PID 1720 wrote to memory of 332	1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe	28
PID 1720 wrote to memory of 332	1720	ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ff6228357aedc5a2486c7e4c48bd5e62_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 2196
  2⤵
  - Program crash
  PID:332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Filesize
7.4MB

MD5
2f0d6d369abc11b04c892eb115a5f1d6

SHA1
792c8d6ec3ec7fcbc16888cf1e89ad91dd927f3a

SHA256
95892c1a6b784a4915db28543924c61e0b644f44ac703b6308ec11dc542c5943

SHA512
2ba9a8619adff2c8bbf0d3c9f26d02c8d1b8f99f4dc1fbe815694c6300d7f1a5575eff4706b170498c2f9021959141e6799fa6f469b032bd2ede51056b697e60

Download Submit
memory/1720-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1720-371-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download