Analysis
-
max time kernel
131s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 04:08
Behavioral task
behavioral1
Sample
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe
-
Size
25.5MB
-
MD5
045786107260b79f118f73ad58f68bc4
-
SHA1
ed93910aa6872d69df361d90b5baa0a6405f900c
-
SHA256
262637f0d632fb2cbb247377a1fbbdeb5fa94f2708155efb3ed9dcd060510cca
-
SHA512
7fb9c7f4d4cde73daa3faa55a61973a41f8eb685b0090de523039e111c35b192f78d08562d101702f9cce86c2d6e228c959ed189d381fef001b63e856a61bae8
-
SSDEEP
393216:dFgRav6cD534K8vhdFgRav6cD534K8vh:zv6cDqKChzv6cDqKCh
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2544-0-0x0000000000400000-0x0000000000613000-memory.dmp family_blackmoon C:\Program Files\7-Zip\Uninstall.exe family_blackmoon -
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
XMRig Miner payload 17 IoCs
Processes:
resource yara_rule behavioral2/memory/2544-0-0x0000000000400000-0x0000000000613000-memory.dmp xmrig C:\Windows\svchost.exe xmrig C:\Program Files\7-Zip\Uninstall.exe xmrig behavioral2/memory/3196-252-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3196-372-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3196-394-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3196-396-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3196-397-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3196-400-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3196-401-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3196-403-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3196-421-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3196-422-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3196-431-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3196-432-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3196-466-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/3196-537-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 3196 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\dplaysvr.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\OposHost.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\quickassist.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\tasklist.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\waitfor.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\AtBroker.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\autochk.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmd.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\colorcpl.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\mmc.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\RdpSa.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\WWAHost.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\certutil.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\wecutil.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\xcopy.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllhst3g.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\fsquirt.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\setupugc.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\more.com 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\LaunchTM.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\srdelayed.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\wusa.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\DWWIN.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\grpconv.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\regini.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\replace.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\Netplwiz.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\fltMC.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\mtstocom.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\rundll32.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\cipher.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\control.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\net.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\wscript.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\ttdinject.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\doskey.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasphone.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\sdbinst.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\xwizard.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\scrnsave.scr 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmmon32.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\recover.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\relog.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\winver.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\IEChooser.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SysWOW64\MRINFO.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7zG.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\Windows Mail\wab.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\ThirdPartyNotices\ThirdPartyNotices.html 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\iexplore.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\WriteRename.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.html 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\view\default-contentview-template.html 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_87b019d7cebd66d4\r\appcmd.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_d848cc62b1883bca\f\cttunesvr.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.19041.1_none_a2c8d19f92a1cc22\PkgMgr.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-uimanagerbroker_31bf3856ad364e35_10.0.19041.388_none_57e235d809a12c5b\f\UIMgrBroker.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.264_none_39eaf2470cfe88f0\explorer.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\needhvsi.html 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\r\logman.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.19041.746_none_3ed4d566b640ef5b\WmsUserAgent.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\chcp.com 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\ErrorPages\pdferrorrenewrentallicense.html 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.19041.1_none_21244f0b33e2b22d\PerceptionSimulationInput.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_be98bb8265bc211a\mmgaserver.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-format_31bf3856ad364e35_10.0.19041.1_none_dc79f03629571954\format.com 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_f786fa028426f858\f\fltMC.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\acsr.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_aee92417063babbe\f\WinRTNetMUAHostServer.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_1befc89391e44c23\autoconv.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_ed4855448241f7e7\Magnify.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobeenterpriseprovisioning-main.html 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.19041.1_none_e6307765e4f96817\msfeedssync.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\wmpshare.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.19041.84_none_8a067925a612632c\f\ApproveChildRequest.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\r\rmttpmvscmgrsvr.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.19041.1_none_7aff9045397d4a4c\RdpSaUacHelper.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\ssh.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7a559100246cff2b\CloudNotifications.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.19041.1_none_992adeb39ce930a0\PackagedCWALauncher.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.19041.423_none_edab5dd3a4c202d9\CredDialogHost.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_c42bf1ebf80a8661\f\isoburn.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_ac2441dbb712f006\r\msra.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1_none_ed4924afa14354c2\msra.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_10.0.19041.1_none_19a36451bbe13a1c\SystemPropertiesProtection.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\f\user.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.19041.1202_none_7d4ea219d613c9d8\f\TpmTool.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\f\instnm.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.1_none_26e3edd6087852fc\backgroundTaskHost.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.19041.1_none_6037ee587a56d834\dasHost.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.1266_none_bfb5312df2d5c960\r\WpcMon.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_10.0.19041.1_none_87e54edbaf62ca00\repair-bde.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_b12cf6d951bfadc2\StartMenuExperienceHost.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\print.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.19041.1_none_04959f34117554a3\odbcad32.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.264_none_be8a8ad4892e651d\f\printui.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobekeyboard-main.html 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_4cb1ff2aa122b5dd\ttdinject.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\pdferrorrenewrentallicense.html 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\AppVShNotify.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\hvsirdpclient.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_477a57e55b61aba8\r\SyncHost.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\rdpshell.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\f\XblGameSaveTask.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_ed5986fc58f1b817\SystemUWPLauncher.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobewelcome-main.html 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.746_none_6275453e12708a76\recdisc.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\f\sdclt.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\r\usocoreworker.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\f\SearchFilterHost.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.19041.1_none_7c2bba0f7ddd8c61\Windows.Media.BackgroundPlayback.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1266_none_7e2b6be969016c27\r\licensingdiag.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.19041.1_none_7a53549f2797bc70\nmbind.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sort_31bf3856ad364e35_10.0.19041.1_none_61af30d6b8e070e1\sort.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\f\gpresult.exe 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exesvchost.exedescription pid process Token: SeDebugPrivilege 2544 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Token: 33 2544 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2544 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3196 svchost.exe Token: SeLockMemoryPrivilege 3196 svchost.exe Token: SeLockMemoryPrivilege 3196 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exepid process 2544 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription pid process target process PID 2544 wrote to memory of 3196 2544 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe svchost.exe PID 2544 wrote to memory of 3196 2544 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
045786107260b79f118f73ad58f68bc4_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\045786107260b79f118f73ad58f68bc4_JaffaCakes118.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\Uninstall.exeFilesize
25.5MB
MD509e73bb58a7bd5c1b34f1b63b8e56b7d
SHA10cd90cac3350a269b6ab76d8fa0ad5d309dad066
SHA25683bfdad6ea69a2ef2705dc97d0cc90ad2aae25374eaa4e24c7fd6091ed989452
SHA5129352556e5795812b780a2e3f168459d40d5621e3a7bdbf5631380df0adac89c785d83f20d43c3f8facfbfba661c2c2294e29ca26808883c8d987cd3bf7662cf2
-
C:\Windows\config.jsonFilesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
C:\vcredist2010_x86.log.htmlFilesize
81KB
MD57627a61b867b4d2da0e79bad2b282352
SHA191d1993d7ded2455d42354a0103a8af19124138b
SHA2564bc895e0f1b367200833217226968606339d153d5f2664e1f41f9c8aac130231
SHA5123c1c8000a54038c94604fb64a5038f4b0edb10e5d76fe59e2fd1673dba837f627a586b5790ae32047db143e9ca3fc50ce2b79a8cde17dd4db030f5f7270f3a4f
-
memory/2544-0-0x0000000000400000-0x0000000000613000-memory.dmpFilesize
2.1MB
-
memory/3196-397-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3196-421-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3196-396-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3196-372-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3196-400-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3196-401-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3196-403-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3196-394-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3196-422-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3196-431-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3196-432-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3196-466-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3196-252-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/3196-537-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB