Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 09:35
Behavioral task
behavioral1
Sample
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe
-
Size
26.9MB
-
MD5
04e3a6f8c20c1b2c03b58310882a980f
-
SHA1
e63516275220885e7a1f5ab5477d725484509caf
-
SHA256
20ea7300f88cd1476ee0e65f9133c44f1213ea74ba2824e65a36d69d133df4c7
-
SHA512
c875692ae5831f9e8a2f89360ae8c6f0c3cd079307e1b205569457381d82bf56f866881573bf9ceb1794020e27670ac44c224fd930807773d340c7a614707fe5
-
SSDEEP
786432:zvDllryTZvDllryTCvDllryTZvDllryT:zvDllryTZvDllryTCvDllryTZvDllryT
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1972-0-0x0000000000400000-0x0000000000613000-memory.dmp family_blackmoon C:\Program Files\RegisterCopy.exe family_blackmoon -
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
XMRig Miner payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/1972-0-0x0000000000400000-0x0000000000613000-memory.dmp xmrig C:\Windows\svchost.exe xmrig C:\Program Files\RegisterCopy.exe xmrig behavioral1/memory/1892-180-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/1892-279-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/1892-344-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/1892-345-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/1892-368-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/1892-370-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/1892-371-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/1892-392-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/1892-754-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/1892-755-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/1892-756-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/1892-757-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/1892-758-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/1892-759-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 1892 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\wvmic.inf_amd64_neutral_b94eb92e8150fa35\vmicsvc.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\cipher.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\hdwwiz.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\iexpress.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\msiexec.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\schtasks.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\SecEdit.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\migwiz.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\attrib.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\gpresult.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\msinfo32.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\sc.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\TSTheme.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\wuapp.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP10\imjpuexc.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\colorcpl.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\ddodiag.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\msfeedssync.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\runonce.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\syskey.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPMGR.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\mmc.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\tzutil.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\SyncHost.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\bthudtask.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\driverquery.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\drvinst.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\regsvr32.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\taskeng.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\diskcomp.com 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\chcp.com 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\ARP.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\dccw.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\extrac32.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\ROUTE.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\sethc.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\sort.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\unregmp2.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllhost.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\dpapimig.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\esentutl.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\icsunattend.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\isoburn.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\relog.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\icardagt.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\recover.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\sfc.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\shrpubw.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Bubbles.scr 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\eudcedit.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\LocationNotifications.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\ntkrnlpa.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\OFFISUPP.HTM 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\clock.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\settings.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewFrame.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsColorChart.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\weather.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\WMPDMC.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplate.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\settings.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBlankPage.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\cpu.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\slideShow.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmprph.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePage.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBlankPage.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\slideShow.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\weather.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\clock.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\settings.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OSPP.HTM 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\Windows Defender\MSASCui.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\CURRENCY.HTM 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\weather.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehprivjob_31bf3856ad364e35_6.1.7601.17514_none_53393627486ae37b\ehprivjob.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_6.1.7601.17514_none_0d44b8d3df1c79a9\imjpuexc.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..opycompareutilities_31bf3856ad364e35_6.1.7600.16385_none_3575d2dc8edf4a22\diskcomp.com 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-cttune_31bf3856ad364e35_6.1.7600.16385_none_0f797e18d8361ef2\cttune.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_6.1.7601.17514_none_7f7f66788318015d\lpremove.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad\unlodctr.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\403-10.htm 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dbfc68edd3137610\settings.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\404-1.htm 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\svchost.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\ehome\mcspad.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..flicklearningwizard_31bf3856ad364e35_6.1.7600.16385_none_69769fd78b751ad3\FlickLearningWizard.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\msil_loadmxf_31bf3856ad364e35_6.1.7600.16385_none_388de5065074b62c\loadmxf.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_c718d071d9c10a2d\auditpol.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\403-2.htm 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_6.1.7600.16385_none_5120bf8b19591afa\pcwrun.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_6.1.7600.16385_none_9cef76e6ecab612f\SystemPropertiesHardware.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_23376bf5921e7b63_auditpol.exe_83c870f4 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_c79aef32ab85d92b\cmdl32.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-choice_31bf3856ad364e35_6.1.7600.16385_none_c33d412fed16819c\choice.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_0accb12490597570\settings.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\msil_comsvcconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_bfe4d387913dbb8f\ComSvcConfig.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..-currency.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2d42a6783ff36048\currency.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_8.0.7601.17514_none_752e3bb068638683\msfeedssync.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_6e30004a126a8db7_ntoskrnl.exe_0fb0ab79 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_6bcef05d7f04260a_rasautou.exe_477abe34 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49_wininit.exe_7a527f28 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-regsvr32_31bf3856ad364e35_6.1.7600.16385_none_782d737490d72da3\regsvr32.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pptico.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-14.htm 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\401-3.htm 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.1.7601.17514_none_f20ae427dbae4faf\ntprint.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f86c44a49a61f132\settings.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_6.1.7600.16385_none_f5b8f3d6a353fa89\SnippingTool.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4a5d2c9ecd59afa7_dnscacheugc.exe_aa32623e 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\msil_servicemodelreg_b03f5f7f11d50a3a_6.1.7601.17514_none_1f2918adb8a9c100\ServiceModelReg.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ipconfig_31bf3856ad364e35_6.1.7600.16385_none_4c104723794237c2\ipconfig.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_34ce5d95ad203bbe\NETSTAT.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Windows\svchost.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b60543bd2d988807\settings.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\WinMail.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8700586a70797a4c\settings.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-computerdefaults_31bf3856ad364e35_6.1.7600.16385_none_626b9352dcfa715c\ComputerDefaults.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sigverif_31bf3856ad364e35_6.1.7600.16385_none_178e7604150fa952\sigverif.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_6.1.7600.16385_none_c5e81c6ab4db0c88\TapiUnattend.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\SvcIni.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\403-5.htm 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\401-1.htm 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\print.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_c718d071d9c10a2d_auditpol.exe_83c870f4 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0212532a5cdf4b5f\picturePuzzle.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_de-de_82258a09c9170bac\RSSFeeds.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\404-8.htm 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-8.htm 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-2.htm 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_6.1.7600.16385_none_5a9496fc0f35b80b\DWWIN.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\shrpubw.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ShapeCollector.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exesvchost.exedescription pid process Token: SeDebugPrivilege 1972 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Token: 33 1972 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1972 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1892 svchost.exe Token: SeLockMemoryPrivilege 1892 svchost.exe Token: SeLockMemoryPrivilege 1892 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exepid process 1972 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription pid process target process PID 1972 wrote to memory of 1892 1972 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe svchost.exe PID 1972 wrote to memory of 1892 1972 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe svchost.exe PID 1972 wrote to memory of 1892 1972 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe svchost.exe PID 1972 wrote to memory of 1892 1972 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.htmlFilesize
6KB
MD5657eb3527d651515f97b960a67d19fda
SHA127404b587183bc2f3b3b6919fbb91892f505b60d
SHA256f301745232a72d84f277980ad53b65d94b02479369e8b73fe0e6717adcf11a35
SHA5121085550a8844de081a216bd864990e56fbe91498fb6186cce435173ab73e29932e7b8182078cd2876039addbdb7e3c9769d7d7923f7ed2a5422e6a2a36321b70
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.htmlFilesize
12KB
MD5cdea5d1cccee27144519c75bcf3015bd
SHA1c36862abb1ada006b3dd4c28adc8b393a92fd325
SHA2561184f2316c36648a2d457b602c713d5d5eb980e86e5e8ed388e94a47f8573dbd
SHA5125d0ea1cef2af7111098c19578c42bfdfd7bb00ec3259fe026df6dd867a24f9a94f3299b035235e3cb87b1c9010f0d1be434a08318dae0412e03ecfdb439edfe9
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.htmlFilesize
9KB
MD5bc3e199345ad8ba54e2fe4acad95433d
SHA1c93cb69c27e1c03069de3c952534a52f391e3fb9
SHA256462c197c83ee3d677b07fe000b2c4e64ac4be4ceaaea80c1c77a5e67d832edd8
SHA512c1941c9106ff0d665dfee1888afcdc3c54e4db8fdb11e3313cd92a147a1084264dba8f1f9cbac5216d3c5ce1f97ff7f8d7d7493826ec3538d5db57a933fe32e4
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.htmlFilesize
16KB
MD526986f79440b7a706b65724e509f009f
SHA19d8ff0beef1c19fbecd28e3f632101acf3d02599
SHA256e59b7fa34b947d5ada478ff17543204251955052fdace284e5a285bd2abec5d1
SHA5122c240c4f7b8912bd5049bef22c2507c7c1af15432c860549d0f1ea35f03183270eb7315607fdf35be86703a61ec0ed7801e9e6ea627a026dbf93d98ff11d2ed6
-
C:\Program Files\RegisterCopy.exeFilesize
27.2MB
MD50fdf60f1a58a43ae520568d8de80b356
SHA1b9268ffd943a22f764c72d685a228890a25af9e5
SHA256a3ec3dc2b4194c9d20b8030e39aa7ee42d17c86d9d24dab13f8470c8f3e5a8aa
SHA512b7d864d89bb64276c783604773bdf282eebb47f7f21dc3e89d8c5cca565dc35f1aa403b3f6ca3a80aab5924129a90a9bcfd8d9eab682daaa6c242b84c3673654
-
C:\Windows\config.jsonFilesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
C:\vcredist2010_x86.log.htmlFilesize
82KB
MD5039a080a9cd77f4d987c9e676c9da83d
SHA1f74040487890464002d255cf58e87a5c1f99c31f
SHA256f0bf5f90c956dfdfe9bfff298b2caa87ba56c6f130b7edc8c3243c2d3443300c
SHA512dfae0a8411748f18178c111412fa9a267d57d4f02084ac473f0971871a88ce804ba47968e6240e740468d786f341c8b59bee94b1b0ef50940a367fd4a6c1b89a
-
memory/1892-279-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1892-755-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1892-371-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1892-392-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1892-368-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1892-345-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1892-344-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1892-759-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1892-180-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1892-754-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1892-370-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1892-756-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1892-757-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1892-758-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1972-0-0x0000000000400000-0x0000000000613000-memory.dmpFilesize
2.1MB