Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 04:11
Behavioral task
behavioral1
Sample
0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe
-
Size
19.8MB
-
MD5
0458b8e5d1cde56d5920c8db855f6534
-
SHA1
19040be4f7d1bed1b19b2e8b3d8756caec2a1db3
-
SHA256
d2556e86c6a81adb27f6ddd42c5d0d0ed1f9b3e492fd5dae44e571adba3c04b7
-
SHA512
91f5d4c684e6848ca5da1024d3e6675f6a066725e045cb10876fb631e1194e6e31e7c1f5988bea5637e7526b913266bba12d7629c36aa0020504af11e8c41f20
-
SSDEEP
393216:dFgRavDllzWEyzPpe4hsFgRavDllzWEyzPpe4h:zvDllLyTlhYvDllLyTlh
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1440-0-0x0000000000400000-0x0000000000613000-memory.dmp family_blackmoon C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe family_blackmoon -
Processes:
0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe -
XMRig Miner payload 17 IoCs
Processes:
resource yara_rule behavioral2/memory/1440-0-0x0000000000400000-0x0000000000613000-memory.dmp xmrig C:\Windows\svchost.exe xmrig C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe xmrig behavioral2/memory/1404-256-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1404-393-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1404-394-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1404-396-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1404-398-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1404-401-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1404-402-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1404-420-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1404-425-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1404-430-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1404-465-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1404-537-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1404-538-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1404-539-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
Processes:
0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe" 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe" 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe" 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe" 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe" 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe" 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 1404 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe" 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe -
Processes:
0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\bitsadmin.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\format.com 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\gpresult.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\OposHost.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\perfmon.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\print.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\userinit.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\unlodctr.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\netbtugc.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\ARP.EXE 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\cliconfg.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\AtBroker.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\msiexec.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\shutdown.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\msdt.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\RmClient.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\sc.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\timeout.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\Fondue.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\ipconfig.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasphone.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\TRACERT.EXE 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\RdpSa.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\WerFault.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\cacls.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\dialer.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\DWWIN.EXE 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\msra.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\mmc.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\waitfor.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrs.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\credwiz.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\logman.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\mountvol.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\netiougc.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\newdev.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\poqexec.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\regini.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmstp.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\comp.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\dxdiag.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\extrac32.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\runonce.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\wevtutil.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\eventcreate.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\wextract.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SysWOW64\scrnsave.scr 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\ThirdPartyNotices\ThirdPartyNotices.html 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.185.29\MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\WebviewOffline.html 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\WebviewOffline.html 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91015\javaw.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\ThirdPartyNotices\ThirdPartyNotices.html 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1202_none_ca1e0a7a1f21274c\r\drvinst.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\ScriptRunner.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.1266_none_3e00d223332897b8\f\SearchApp.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.19041.1_none_76b501b13155d66b\WmsSvc.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\Backup\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334_xblgamesavetask.exe_e6e69c44 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\403-18.htm 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\413-1.htm 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\VmComputeAgent.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.19041.1_none_a2b2be7cc3d8faf5\DisplaySwitch.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dlna-mdeserver_31bf3856ad364e35_10.0.19041.746_none_b4017de081b11e02\f\MDEServer.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.746_none_1eeb97b23978a488\r\desktopimgdownldr.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.1266_none_3e00d223332897b8\SearchApp.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.746_none_49d38afb2289b178\f\netiougc.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\404-2.htm 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.19041.1266_none_b5fa73367bbd2f91\f\klist.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1_none_cc2783ead104d62a\winrs.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_d93ee361fbbc8f0a\f\XGpuEjectDialog.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\f\SgrmLpac.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_presentationcore_31bf3856ad364e35_4.0.15805.110_none_d15861be869a7825\GlobalUserInterface.CompositeFont 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\pdferrorquitapplicationguard.html 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\retailDemoAdvancedInclusive.html 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\mofcomp.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobe-light-contentview-template.html 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\retailDemoSetupInclusive.html 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\401-2.htm 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\403-14.htm 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\http_501.htm 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.19041.844_none_de5d9fe254d9f8c4\r\BioEnrollmentHost.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.153_none_6ef8a222ac00dbc2\TrustedInstaller.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.844_none_7eaa07ee55c22dcc\WinMgmt.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.746_none_46f79836a0dc7206\Dism.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_e341f52007f6d1a8\r\wecutil.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\r\SearchIndexer.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\proxyerror.htm 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_b2e64138c9682982\r\InputSwitchToastHandler.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\unifiedEnrollment\views\unifiedEnrollmentProgress.html 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\Microsoft.Uev.SyncController.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\http_gen.htm 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1202_none_958d6588f50ca146\edpnotify.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.1_none_86e0e6ce46c9ed74\WinRTNetMUAHostServer.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.264_none_309e9e4a939c0bac\cscript.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\405.htm 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.19041.662_none_746c3bfaa509091f\dtdump.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.19041.1_none_765fc5f6e37c509d\ieinstal.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\errorHandler.html 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.19041.964_none_5c42846f47acb1a6_smss.exe_d7209c3a 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\oobe-listview-template.html 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\http_500.htm 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.19041.1_none_82a36c559596820a\aspnet_regbrowsers.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\r\hcsdiag.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVDllSurrogate.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1_none_000f198549aaa20d\spaceman.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\f\gpupdate.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx4-web_config_b03f5f7f11d50a3a_4.0.15805.0_none_cc8c87368388e29a\web.config.comments 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_10.0.19041.1_none_f6eb92c37257e103\SystemPropertiesHardware.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_1d38815769c81e5a\r\dllhost.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1151_none_43c494653a7536d0\wiaacmgr.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_d0cf24ea634e86e3\explorer.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\500-18.htm 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.19041.746_none_a5986eca8fd4063b\f\CastSrv.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compact_31bf3856ad364e35_10.0.19041.1_none_afe6484e54f00fd0\compact.exe 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exesvchost.exedescription pid process Token: SeDebugPrivilege 1440 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe Token: 33 1440 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1440 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1404 svchost.exe Token: SeLockMemoryPrivilege 1404 svchost.exe Token: SeLockMemoryPrivilege 1404 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exepid process 1440 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exedescription pid process target process PID 1440 wrote to memory of 1404 1440 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe svchost.exe PID 1440 wrote to memory of 1404 1440 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0458b8e5d1cde56d5920c8db855f6534_JaffaCakes118.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeFilesize
21.9MB
MD5baedfce3644c616287afdcbce867599e
SHA16e6d2ec591617659f0154ce90beee9bcc89811c2
SHA2569f18cd21c6b3dfcd4dc5bb003f3e3674615faf20e72d56d8b8f94968f068f730
SHA5127263114f4afba314dcd9e95e4660da9e1b2de7a1f82f91e066a015716e0964540edae70244f20ac96d275c92683e6686f00a2c8b8f6bf2be5bd33e7f14abfdca
-
C:\Windows\config.jsonFilesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
C:\vcredist2010_x64.log.htmlFilesize
86KB
MD520b54a52e578505997b77f14017219ae
SHA18033e2e8dfbec0c21d174f6255475a2dc84ec061
SHA256db7c18b33d9f85d2354d1ce6f220e79dcf98f282823302c7c4ab8de27887f660
SHA512ca31d8e5395f2097a17cefc3f4a7039c166f8655e86678bdc6b07f7a05bc88cc6a07907523703329881d5af76bccd4c751688f5ebba0a97ce400298adf2525e1
-
memory/1404-398-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1404-465-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1404-394-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1404-396-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1404-539-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1404-401-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1404-402-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1404-420-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1404-425-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1404-430-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1404-393-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1404-256-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1404-537-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1404-538-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1440-0-0x0000000000400000-0x0000000000613000-memory.dmpFilesize
2.1MB