Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/04/2024, 21:38
Behavioral task
behavioral1
Sample
03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe
-
Size
6.6MB
-
MD5
03af34a8a180f811a55a153ac194112a
-
SHA1
a99b4ba27c30c1c883a6bde670785ac8294e6c2f
-
SHA256
5b5a714356ccbcd9b282d541cf3ff2b5e93704c6079bb0fecf1a6c1f01224f98
-
SHA512
8c32f323b3696eebf34efc8988fee0c2bceff8cdc8c3394ba678394080248fde55c3811b5a14580ea9bd979219f3b3b06fc02372c35382b7d554e9e2aad26f49
-
SSDEEP
98304:FlerjesRJ8YQU//erPO0i5561qfG7Sjz2Ob7IIDQF:urj578YQbPy41qf7mbuQ
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 1 IoCs
resource yara_rule behavioral1/files/0x0034000000015c7c-8.dat family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ktmutil.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MigAutoPlay.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SecEdit.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\TapiUnattend.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cleanmgr.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\odbcad32.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sbunattend.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\srdelayed.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RmClient.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\com\comrepl.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fsutil.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\logman.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msfeedssync.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Netplwiz.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\replace.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sc.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\shrpubw.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bthudtask.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cmdkey.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\esentutl.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\TpmInit.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\userinit.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msra.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\TsWpfWrp.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\netbtugc.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\powercfg.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rundll32.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wlanext.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bootcfg.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\convert.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mshta.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\attrib.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\regedit.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\getmac.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ocsetup.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\TCPSVCS.EXE 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tzutil.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\charmap.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\verifier.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wecutil.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\imjppdmg.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dccw.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SearchProtocolHost.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SndVol.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rasdial.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\svchost.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\winver.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tasklist.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\IME\IMESC5\IMSCPROP.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DpiScaling.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\expand.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\syskey.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RegisterIEPKEYs.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ROUTE.EXE 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WSManHTTPConfig.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\AdapterTroubleshooter.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\javaws.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Media Player\WMPSideShowGadget.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_d5b4f96cdbb9a8b1\IMJPDSVR.EXE 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\f4a88265ac4ad47978daef8c5482fd30\MSBuild.ni.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\NETFXRepair.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_mcupdate_31bf3856ad364e35_6.1.7601.17514_none_26c2d72ec26de8d9\mcupdate.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_6.1.7601.17514_none_843a86a1bc33fcd1\bfsvc.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.22091_none_d2b1c721321aadf8\conhost.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.1.7601.17514_none_a505d556c9de886a\rstrui.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-pnputil_31bf3856ad364e35_6.1.7600.16385_none_5958b438d6388d15\PnPutil.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.17514_none_b94cbfa183466a89\winresume.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-directx-directplay8_31bf3856ad364e35_6.1.7601.17514_none_d6fc8d83d55eb77c\dpnsvr.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_8.0.7600.16385_none_d009281f9a108e04\mshta.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..yer-sideshow-gadget_31bf3856ad364e35_6.1.7600.16385_none_841e9494c8a32794\WMPSideShowGadget.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-scripting_31bf3856ad364e35_6.1.7600.16385_none_a45d44bd1a0af822\wscript.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpCmdRun.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\msil_addinutil_b77a5c561934e089_6.1.7601.17514_none_1a816bc7556b71eb\AddInUtil.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_6.1.7600.16385_none_9da1b3254ff796e9\msra.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_aspnet_regsql_b03f5f7f11d50a3a_6.1.7600.16385_none_2461659e78807255\aspnet_regsql.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\ComSvcConfig\9a69a26417a09c2d9d7f67bf7592bd74\ComSvcConfig.ni.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-driververifier_31bf3856ad364e35_6.1.7600.16385_none_1660ccbeb66c6cf1\verifier.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_6.1.7601.17514_none_3899b0ad2bb77a86_iscsicli.exe_20e14d4f 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\MSBuild\1a154709cdfe214029ea88c51ab2b579\MSBuild.ni.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-notepad_31bf3856ad364e35_6.1.7600.16385_none_cb0f7f2289b0c21a\notepad.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_netfx-ldr64_exe_31bf3856ad364e35_6.1.7600.16385_none_f98e4869675ab367\Ldr64.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_6.1.7600.16385_none_963d3becc3a475f1\raserver.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\MSBuild\af28543d9b3e7d9f110448ecce53cd72\MSBuild.ni.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_6.1.7600.16385_none_f8a40495785334a9\PrintIsolationHost.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_6.1.7600.16385_none_5120bf8b19591afa\pcwrun.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..erinboxgames-spades_31bf3856ad364e35_6.1.7600.16385_none_6fa6d7361acba514\shvlzm.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_6.1.7600.16385_none_33e01c5875c2e5cb\iscsicpl.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.1.7601.17514_none_288b7acec3a75696\WSManHTTPConfig.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7600.16385_none_ce6f64032560fa6b\setup16.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_6.1.7601.17514_none_d71fb1d63f05ef22\WFS.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\attrib.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..inboxgames-freecell_31bf3856ad364e35_6.1.7600.16385_none_b466b741b68bd29a\FreeCell.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_6.1.7601.17514_none_848b402bf3e1c3b1\wksprt.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_6.1.7600.16385_none_8fbb77bb3cd808d1\pcalua.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-commandlinehelp_31bf3856ad364e35_6.1.7600.16385_none_3020274b22e8a90f\help.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..xing-service-server_31bf3856ad364e35_6.1.7601.17514_none_0db5e5844ed6ffe9\CIDAEMON.EXE 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\IMCCPHR.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_netfx35linq-edmgen_31bf3856ad364e35_6.1.7601.17514_none_0ca1fd81527e1e9a\EdmGen.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4a5d2c9ecd59afa7\dnscacheugc.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-snmp-trap-service_31bf3856ad364e35_6.1.7600.16385_none_2b7ff0845918e12f\snmptrap.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-t..localsessionmanager_31bf3856ad364e35_6.1.7601.17514_none_036ad230212a39ce_lsm.exe_ecbd567a 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_6.1.7600.16385_none_5da314d233bb2676\dvdplay.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\rwinsta.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_c8df7823424473a1\netbtugc.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_c79aef32ab85d92b\cmstp.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ng-spooler-splwow64_31bf3856ad364e35_6.1.7601.17514_none_25d05769a8973724\splwow64.exe 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\5f1a06c0108b2c81cde1dc491d74043d\ComSvcConfig.ni.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\b3ade8d5c0d4bb5d4940bcafd3453642\PresentationFontCache.ni.exe$ 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2172 03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\03af34a8a180f811a55a153ac194112a_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2172
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD503af34a8a180f811a55a153ac194112a
SHA1a99b4ba27c30c1c883a6bde670785ac8294e6c2f
SHA2565b5a714356ccbcd9b282d541cf3ff2b5e93704c6079bb0fecf1a6c1f01224f98
SHA5128c32f323b3696eebf34efc8988fee0c2bceff8cdc8c3394ba678394080248fde55c3811b5a14580ea9bd979219f3b3b06fc02372c35382b7d554e9e2aad26f49