Analysis
-
max time kernel
127s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 03:55
Behavioral task
behavioral1
Sample
0450d70ba017af2405227d453ded067f_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
0450d70ba017af2405227d453ded067f_JaffaCakes118.exe
-
Size
22.4MB
-
MD5
0450d70ba017af2405227d453ded067f
-
SHA1
2737e43a59c36e240d620045819ec336134364e6
-
SHA256
5a2a5eedca4ab80dd519cad86c47a55747e6f80b727f81f70e5cad82288a8f57
-
SHA512
143d087ced0d7be53bb094f344493d6f326d558cbf010b778621ce40b18345989f8d0b3ad02e46aa643d38fb82a047b789e44e7dbb3abeb74c0d84d9f2cf74b7
-
SSDEEP
393216:dFgRavDllzWiKjyDFgRavDllzWiKjylBI1uB:zvDllbKjyNvDllbKjyHrB
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2320-0-0x0000000000400000-0x0000000000613000-memory.dmp family_blackmoon C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe family_blackmoon -
Processes:
0450d70ba017af2405227d453ded067f_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe -
XMRig Miner payload 17 IoCs
Processes:
resource yara_rule behavioral2/memory/2320-0-0x0000000000400000-0x0000000000613000-memory.dmp xmrig C:\Windows\svchost.exe xmrig C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe xmrig behavioral2/memory/1460-271-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1460-391-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1460-392-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1460-394-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1460-396-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1460-398-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1460-400-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1460-418-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1460-419-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1460-428-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1460-429-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1460-465-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1460-542-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1460-543-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
Processes:
0450d70ba017af2405227d453ded067f_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0450d70ba017af2405227d453ded067f_JaffaCakes118.exe" 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0450d70ba017af2405227d453ded067f_JaffaCakes118.exe" 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0450d70ba017af2405227d453ded067f_JaffaCakes118.exe" 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0450d70ba017af2405227d453ded067f_JaffaCakes118.exe" 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0450d70ba017af2405227d453ded067f_JaffaCakes118.exe" 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0450d70ba017af2405227d453ded067f_JaffaCakes118.exe" 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0450d70ba017af2405227d453ded067f_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 1460 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0450d70ba017af2405227d453ded067f_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0450d70ba017af2405227d453ded067f_JaffaCakes118.exe" 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe -
Processes:
0450d70ba017af2405227d453ded067f_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
0450d70ba017af2405227d453ded067f_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\ARP.EXE 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\ddodiag.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\more.com 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\fsquirt.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\shutdown.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\timeout.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmmon32.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\edpnotify.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\fixmapi.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\ftp.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\runonce.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\dtdump.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\explorer.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\iscsicpl.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Netplwiz.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\PresentationHost.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\TpmTool.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\tracerpt.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\tttracer.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\certutil.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\openfiles.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\typeperf.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\user.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmstp.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\credwiz.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\ieUnatt.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\regedt32.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\RpcPing.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\lodctr.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\netbtugc.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\sdchange.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmd.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\fontview.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\logagent.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\mfpmp.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\pcaui.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\ReAgentc.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\wevtutil.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\extrac32.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\icsunattend.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\control.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\msdt.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\msfeedssync.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasphone.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\rrinstaller.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\wecutil.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
0450d70ba017af2405227d453ded067f_JaffaCakes118.exedescription ioc process File created C:\Program Files\Windows Media Player\setup_wm.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7z.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\chrmstp.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.html 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\msapp-error.html 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{C3E3E3FE-58F3-42A4-88BF-9E018DCE4D47}\MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
0450d70ba017af2405227d453ded067f_JaffaCakes118.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.19041.844_none_3a7392af5414371e\CCG.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\http_501.htm 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_e43cebe9807e08e3\setupugc.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobelanguage-main.html 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_770f598aef14382e\r\dfrgui.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.84_none_809ebfa242fbf368\f\wimserv.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.19041.1_none_d1d4cd9c4b409594\TabTip32.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\RetailDemo\retailDemoSetupInclusive.html 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\navcancl.htm 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_5f22b28b2f384ed0\PING.EXE 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.19041.264_none_c813a1965bacf6d2\SystemSettingsBroker.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_b3df5aa8d99e9b89\r\TSTheme.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\needhvsi.html 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\500-19.htm 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\invalidcert.htm 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.19041.1_none_bc67af2f62a6f130\ComputerDefaults.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\iisreset.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\pdferrorunknownerror.html 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\es-ES\assets\ErrorPages\pdferrorquitapplicationguard.html 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\f\appidpolicyconverter.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\pdferrorrepurchasecontent.html 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\f12host.html 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\500-16.htm 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.19041.1_none_faedbaa2bd7d01c2\MDMAgent.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.746_none_1eeb97b23978a488\desktopimgdownldr.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-firstlogonanimexe_31bf3856ad364e35_10.0.19041.1_none_81400e8a2cfebcbb\FirstLogonAnim.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.84_none_d062347205e52d46\r\PerceptionSimulationService.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.264_none_098f3a6c3a48359d\printfilterpipelinesvc.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.19041.1_none_09dd65fa3d1bcf14\PktMon.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.19041.746_none_38c6194376a6b88c\r\VSSVC.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\appidpolicyconverter.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.19041.1_none_112f38db81e24102\csvde.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\f\ApplySettingsTemplateCatalog.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.173_none_f837263e7fdd508f\f\sppsvc.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\dnserror.html 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\views\roamingDisambiguation.html 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.19041.928_none_31fd477afc7b8278\r\PktMon.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\r\SenseCncProxy.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\WerFaultSecure.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.264_none_de5e254ba7caf399\f\tcblaunch.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\r\WerFault.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.19041.746_none_b7a67ddd8bcc7470\ApplicationFrameHost.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\WSManHTTPConfig.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.1_none_f58a3da76ed0f251\dsdbutil.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\logman.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.1202_none_fdbbcf53ca14e151\wimserv.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\403-18.htm 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\navcancl.htm 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.19041.746_none_e72c4ffca9db7315\r\lpkinstall.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.19041.1_none_9053c2b542fdf1c3\BitLockerDeviceEncryption.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.19041.1202_none_7d4ea219d613c9d8\r\TpmTool.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.746_none_b60bd945ca2276e4\f\IEChooser.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\f\ssh-keyscan.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\Backup\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.19041.1_none_9ab96313e8d638bb_iscsicli.exe_20e14d4f 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\es-ES\assets\OfflineTabs\OfflineTabs.html 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\403-3.htm 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\change.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\Backup\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_9e094af3987dca57_svchost.exe_4dd0f0bc 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobe-listview-template.html 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\SystemPropertiesRemote.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.789_none_e07abbe9902a4f60\Utilman.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netsh_31bf3856ad364e35_10.0.19041.1_none_1fe6ae13cb971ac8\netsh.exe 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
0450d70ba017af2405227d453ded067f_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
0450d70ba017af2405227d453ded067f_JaffaCakes118.exesvchost.exedescription pid process Token: SeDebugPrivilege 2320 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe Token: 33 2320 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2320 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1460 svchost.exe Token: SeLockMemoryPrivilege 1460 svchost.exe Token: SeLockMemoryPrivilege 1460 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
0450d70ba017af2405227d453ded067f_JaffaCakes118.exepid process 2320 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
0450d70ba017af2405227d453ded067f_JaffaCakes118.exedescription pid process target process PID 2320 wrote to memory of 1460 2320 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe svchost.exe PID 2320 wrote to memory of 1460 2320 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
0450d70ba017af2405227d453ded067f_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0450d70ba017af2405227d453ded067f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0450d70ba017af2405227d453ded067f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0450d70ba017af2405227d453ded067f_JaffaCakes118.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2320 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1460
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeFilesize
24.5MB
MD56cc28f4206bd39426c5989fd29b77177
SHA1adc3b621d56171c10059358992d7814f53e4ff6d
SHA256d279b97b6c586b49daa4531607c8efc0dffb6b2806e31f36142e979bfba5e76f
SHA5120bae7a629f3d20122ef9c6ceda885e0b10d37c062aa749f591c6136a4f351e5b4da722bdadbea87f5cd0fc840de877cc1be4b729d24f57afa3d7f1135f566395
-
C:\Windows\config.jsonFilesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
C:\vcredist2010_x86.log.htmlFilesize
81KB
MD5dca5f9dda474e58571f809c868a1bca7
SHA169bf2441f04aaa8ecd3f72bd6d3c1b83c7bafc4a
SHA256d1d53253843c5636ec391d7e90aefd1727a8a3eaaf658ea1665696c2c285c7fc
SHA5125387e51329a1d9b564493b32c878be1dff90075c4a01d67f3f3f06f3e1a317e9de828ab5b45055be4ec0f3abf64cb7eca1fd4a2e6342e98cf8bae7e7ed324e8c
-
memory/1460-396-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1460-429-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1460-392-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1460-394-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1460-543-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1460-398-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1460-400-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1460-418-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1460-419-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1460-428-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1460-391-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1460-465-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1460-271-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1460-542-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2320-0-0x0000000000400000-0x0000000000613000-memory.dmpFilesize
2.1MB