Analysis
-
max time kernel
134s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 09:35
Behavioral task
behavioral1
Sample
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe
-
Size
26.9MB
-
MD5
04e3a6f8c20c1b2c03b58310882a980f
-
SHA1
e63516275220885e7a1f5ab5477d725484509caf
-
SHA256
20ea7300f88cd1476ee0e65f9133c44f1213ea74ba2824e65a36d69d133df4c7
-
SHA512
c875692ae5831f9e8a2f89360ae8c6f0c3cd079307e1b205569457381d82bf56f866881573bf9ceb1794020e27670ac44c224fd930807773d340c7a614707fe5
-
SSDEEP
786432:zvDllryTZvDllryTCvDllryTZvDllryT:zvDllryTZvDllryTCvDllryTZvDllryT
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2032-0-0x0000000000400000-0x0000000000613000-memory.dmp family_blackmoon C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe family_blackmoon -
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
XMRig Miner payload 17 IoCs
Processes:
resource yara_rule behavioral2/memory/2032-0-0x0000000000400000-0x0000000000613000-memory.dmp xmrig C:\Windows\svchost.exe xmrig C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe xmrig behavioral2/memory/2868-230-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2868-355-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2868-392-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2868-393-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2868-395-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2868-398-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2868-399-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2868-401-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2868-419-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2868-420-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2868-424-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2868-430-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2868-454-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2868-540-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2868 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\verifiergui.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\fsquirt.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasautou.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\netiougc.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\sfc.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\choice.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Fondue.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\RdpSa.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\wscadminui.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\expand.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\ddodiag.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrs.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmdl32.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\net1.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Robocopy.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\Taskmgr.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\gpscript.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\label.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\dialer.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\notepad.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\shutdown.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\autofmt.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\colorcpl.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\RpcPing.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\user.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WWAHost.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\at.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\relog.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\print.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\regini.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\systeminfo.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\TpmInit.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\charmap.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\mshta.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\ftp.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\grpconv.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\newdev.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\poqexec.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\setx.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\appidtel.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasphone.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\w32tm.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SysWOW64\extrac32.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7z.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_pwa_launcher.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_98703\javaw.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateBroker.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateOnDemand.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process File created C:\Windows\WinSxS\wow64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.19041.1_none_f0b8ea270ffc4674\SystemPropertiesComputerName.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.19041.1_none_14f1e9e91239944a\MdmDiagnosticsTool.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_87b019d7cebd66d4\f\appcmd.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\poqexec.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.19041.1288_none_91a5fb477b6af5a0\SIHClient.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\f\Microsoft.Uev.CscUnpinTool.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.1_none_a5ebe4c7bdb5bb85\cttunesvr.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\pdferrorrenewrentallicense.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\es-ES\assets\ErrorPages\pdferrorrepurchasecontent.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\views\helloEnrollment.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.928_none_138fb436497565f4\directxdatabaseupdater.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.19041.844_none_de5d9fe254d9f8c4\BioEnrollmentHost.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.153_none_42505a6de732f7ca\r\MusNotification.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.746_none_581ccf386ba57d51\browserexport.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_f57e58b71b913c6b\r\auditpol.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.1151_none_0f2f3a9cb1826509\f\nltest.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\TSAppInstall.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_510ebdd9292eed06\r\diskpart.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_a892faef80a943dc\r\MuiUnattend.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVShNotify.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_4eec2752c7ea16f8\r\backgroundTaskHost.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_presentationcore_31bf3856ad364e35_4.0.15805.110_none_a78a1aa4c54fe308\GlobalMonospace.CompositeFont 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_7d1b4a535854fe42\r\quickassist.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1_none_8f3a372b5909de8a\wiaacmgr.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.264_none_223a5768a6257099\r\CustomShellHost.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.19041.746_none_8443a7febb9ab03d\f\consent.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.1151_none_b46b739f71bbb8b7\bash.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1_none_0d7764d82a75e629\BitLockerWizard.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-takeown_31bf3856ad364e35_10.0.19041.1_none_ba311d9fe95c6271\takeown.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\r\CustomInstallExec.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.19041.423_none_edab5dd3a4c202d9\f\CredDialogHost.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_9fcce199936290f4\f\upnpcont.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\Backup\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.19041.1_none_9ab96313e8d638bb_iscsicli.exe_20e14d4f 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winhstb_31bf3856ad364e35_10.0.19041.1_none_e94bc62edd251a47\winhlp32.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx4-globaluserinterfacecf_b03f5f7f11d50a3a_4.0.15805.110_none_37d1a2d9cb9f6707\GlobalUserInterface.CompositeFont 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\view\common-listview-template.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Local\Desktop\2.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.19041.1202_none_36057e94c281704a\r\DeviceEnroller.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.746_none_dfcf5b6f69f16f7a\r\rdpclip.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.153_none_42505a6de732f7ca\MusNotification.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\dnserror.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobenetworklossaversion-main.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1266_none_7e2b6be969016c27\r\licensingdiag.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_69061189792bce34\cmd.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.19041.1151_none_329784a84ed43acd\r\wslhost.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.19041.1266_none_149b57f8509ce672\r\wuapihost.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\qappsrv.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.1266_none_d92abf553d8a282c\f\MusNotification.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_7dd23580df04442f\DWWIN.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.1_none_f53047daaa565a5e\dllhost.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.1_none_4b527e92ee1ad1e5\cmd.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\iisreset.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1_none_80e38b0746f5a926\wmprph.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\popup\popup.html 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.19041.1266_none_41843efc8f66bc7c\f\uwfmgr.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1266_none_a88c5999d8585853\r\pcalua.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.19041.1052_none_648fbf276da33ed4\r\NcsiUwpApp.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\notepad.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\r\Microsoft.AAD.BrokerPlugin.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.746_none_dbecc8a3cdc7c3cf\DataUsageLiveTileTask.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.19041.1_none_18e6b82c93a9c5f6\xcopy.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\f\instnm.exe 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\IMEPADSV.EXE 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exesvchost.exedescription pid process Token: SeDebugPrivilege 2032 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Token: 33 2032 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2032 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2868 svchost.exe Token: SeLockMemoryPrivilege 2868 svchost.exe Token: SeLockMemoryPrivilege 2868 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exepid process 2032 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription pid process target process PID 2032 wrote to memory of 2868 2032 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe svchost.exe PID 2032 wrote to memory of 2868 2032 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\04e3a6f8c20c1b2c03b58310882a980f_JaffaCakes118.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeFilesize
29.0MB
MD5700cf98a79193904f2ffb40d54460a4d
SHA13e05a438a522117f1b33b12b668792ceaf0db0ed
SHA25627a530db441cc32ee9cf3de9264c33afcb73b01c90a0a461a224dd7752f71d5d
SHA5124fc92726574d4eaeaed068cbcf6adddc1549a7bbba4e3d19258f95934b53a184576eaf5193c1b3797ddaed59e1e2ba035bf5e9949eda6aad29ab43dd245a969f
-
C:\Windows\config.jsonFilesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
C:\vcredist2010_x86.log.htmlFilesize
81KB
MD5342cfad86fdd10458e0993392073ff57
SHA162c363c788750f80417f1efa961618297153de01
SHA256a5a7ef8783bdcf90ba15fecddb545a3a72c48efd4ded5ec62c6d207a734fa798
SHA512c7c3bb29eeb871e1c4a0838a1b403d09324ac312a4de7344544cf9368d3b52871d69ed20b0629f80934aa1881f47184d4bb35b050afa55d82c2f3aa0815738d5
-
memory/2032-0-0x0000000000400000-0x0000000000613000-memory.dmpFilesize
2.1MB
-
memory/2868-395-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2868-419-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2868-393-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2868-355-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2868-398-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2868-399-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2868-401-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2868-392-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2868-420-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2868-424-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2868-430-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2868-454-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2868-230-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2868-540-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB