Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 04:08
Behavioral task
behavioral1
Sample
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe
-
Size
25.5MB
-
MD5
045786107260b79f118f73ad58f68bc4
-
SHA1
ed93910aa6872d69df361d90b5baa0a6405f900c
-
SHA256
262637f0d632fb2cbb247377a1fbbdeb5fa94f2708155efb3ed9dcd060510cca
-
SHA512
7fb9c7f4d4cde73daa3faa55a61973a41f8eb685b0090de523039e111c35b192f78d08562d101702f9cce86c2d6e228c959ed189d381fef001b63e856a61bae8
-
SSDEEP
393216:dFgRav6cD534K8vhdFgRav6cD534K8vh:zv6cDqKChzv6cDqKCh
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1712-0-0x0000000000400000-0x0000000000613000-memory.dmp family_blackmoon C:\Program Files\7-Zip\7z.exe family_blackmoon -
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
XMRig Miner payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/1712-0-0x0000000000400000-0x0000000000613000-memory.dmp xmrig C:\Windows\svchost.exe xmrig C:\Program Files\7-Zip\7z.exe xmrig behavioral1/memory/2648-53-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2648-105-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2648-152-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2648-190-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2648-227-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2648-257-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2648-283-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2648-318-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2648-349-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2648-350-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2648-351-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2648-352-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2648-353-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2648-370-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2648 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\makecab.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\write.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\ditrace.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\ieUnatt.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\isoburn.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\rundll32.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\tracerpt.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\wermgr.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmmon32.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\dpnsvr.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\icacls.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\xcopy.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\cipher.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\RmClient.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\sc.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\user.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMESC5\IMSCPROP.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\cttune.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\Magnify.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\nslookup.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\openfiles.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\MRINFO.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\systray.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP10\imjpuexc.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\fsutil.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\rrinstaller.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\fontview.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\gpupdate.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\msdt.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\ndadmin.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\print.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\cacls.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\certutil.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\explorer.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\wimserv.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\com\comrepl.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\sdchange.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\taskkill.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\Utilman.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\PING.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\shrpubw.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\SyncHost.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\winver.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\convert.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\grpconv.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\label.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\ipconfig.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\odbcad32.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\userinit.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\where.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\autofmt.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllhst3g.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\ftp.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\wlanext.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\whoami.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\wininit.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\dialer.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7z.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmpenc.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\sidebar.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\WMPDMC.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\Windows Journal\PDIALOG.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\Windows Mail\wab.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\Windows Mail\WinMail.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process File created C:\Windows\winsxs\amd64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_6.1.7600.16385_none_bfa748753634ba48\SystemPropertiesProtection.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_6.1.7601.17514_none_3d9977977190cdc4\tabcal.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\wordicon.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_6.1.7600.16385_none_45fe6fe8a9201e55\comrepl.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_6.1.7600.16385_none_76e39d87a834545e\dccw.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_6.1.7601.17514_none_0c19cef0ed2a642e\unregmp2.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-pnphotplugui_31bf3856ad364e35_6.1.7600.16385_none_44d62330646f757a\DeviceEject.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\explorer.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\inficon.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..integration-support_31bf3856ad364e35_6.1.7600.16385_none_8429bbdebd38db4a\isintsup.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_8.0.7600.16385_none_7d25450501edb94f\ielowutil.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-notepadwin_31bf3856ad364e35_6.1.7600.16385_none_9ebebe8614be1470\notepad.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\ehome\MediaCenterWebLauncher.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\servicing\TrustedInstaller.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-clip_31bf3856ad364e35_6.1.7600.16385_none_03d0d3c435b27637\clip.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_bf4980401574a899\tracerpt.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\ehome\Mcx2Prov.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\misc.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_6.1.7600.16385_none_a018e05d0d33081d\dllhst3g.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-rundll32_31bf3856ad364e35_6.1.7600.16385_none_33fa4336c49b998b\rundll32.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_6.1.7600.16385_none_761ad65676427bd9\sdiagnhost.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-smss_31bf3856ad364e35_6.1.7600.16385_none_082f99a432e2a661\smss.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_6.1.7601.17514_none_7832a1aacb77df29\mcbuilder.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\1bc1ee3c3aa45d28dcf4657bceb2fcb4\SMSvcHost.ni.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-convert_31bf3856ad364e35_6.1.7601.17514_none_fafb502abef1be40\autoconv.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_6.1.7601.17514_none_81e99da174638311\dxdiag.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_6.1.7601.17514_none_412fcd2afecdc412\mqsvc.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-r..s-regkeys-component_31bf3856ad364e35_6.1.7601.17514_none_58b4153116c17b41\RDVGHelper.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_6.1.7600.16385_none_7861b83567d966e6\ksetup.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-cttune_31bf3856ad364e35_6.1.7600.16385_none_0f797e18d8361ef2\cttune.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_6.1.7601.17514_none_a54b31331066c8e2\Dxpserver.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\WinMail.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sigverif_31bf3856ad364e35_6.1.7600.16385_none_178e7604150fa952\sigverif.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\shadow.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_6.1.7601.17514_none_3d9977977190cdc4\MultiDigiMon.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-fax-service_31bf3856ad364e35_6.1.7601.17514_none_0b499f2c96e8f6b2\FXSSVC.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-runas_31bf3856ad364e35_6.1.7600.16385_none_bbdd3aeb771e694e\runas.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..restartup-baaupdate_31bf3856ad364e35_6.1.7600.16385_none_9243b833ecd918df\baaupdate.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..c-journalnotewriter_31bf3856ad364e35_6.1.7600.16385_none_9e59e11166b683d3\PDIALOG.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-convert_31bf3856ad364e35_6.1.7601.17514_none_fafb502abef1be40\convert.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..-setieinstalleddate_31bf3856ad364e35_11.2.9600.16428_none_eace14b8d6178cca\SetIEInstalledDate.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_6.1.7600.16385_none_1c92c4d88ce86757\wmprph.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sort_31bf3856ad364e35_6.1.7600.16385_none_07b314fa3333f10d\sort.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\twunk_16.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_6.1.7601.17514_none_12d42225a9a7aef7\rpcinfo.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..g-xpsdocumentwriter_31bf3856ad364e35_6.1.7601.17514_none_80fea45979a5d3f2\MxdwGc.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-pnputil_31bf3856ad364e35_6.1.7600.16385_none_5958b438d6388d15\PnPutil.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_bth.inf_31bf3856ad364e35_6.1.7601.17514_none_d06ac9aad230c1d6\fsquirt.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exesvchost.exedescription pid process Token: SeDebugPrivilege 1712 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Token: 33 1712 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1712 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2648 svchost.exe Token: SeLockMemoryPrivilege 2648 svchost.exe Token: SeLockMemoryPrivilege 2648 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exepid process 1712 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription pid process target process PID 1712 wrote to memory of 2648 1712 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 2648 1712 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 2648 1712 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe svchost.exe PID 1712 wrote to memory of 2648 1712 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\7z.exeFilesize
26.0MB
MD5406ab2792e575fbf27e9a920a05ede93
SHA1a37ea4e240d24785c3d4fa309f36c96f7b872426
SHA25652847976b6b8f93bca7062d016a26cc7edc3c66cbb94b887eb62976ae49683dc
SHA512c2e434832bdaf80a33bf3a73e777071ac4e3df26d6af03caf1c63efe1c32c2fc8d605b002e124174a1196c85e05d6dc32e1e509ff6eb16c597a35ec2c6a80393
-
C:\Windows\config.jsonFilesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
memory/1712-0-0x0000000000400000-0x0000000000613000-memory.dmpFilesize
2.1MB
-
memory/2648-227-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2648-318-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2648-152-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2648-190-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2648-53-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2648-257-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2648-283-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2648-105-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2648-349-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2648-350-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2648-351-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2648-352-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2648-353-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2648-370-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB