Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 14:27
Static task
static1
Behavioral task
behavioral1
Sample
056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
-
Size
17.1MB
-
MD5
056518f26a873389cbb7e29591c47fef
-
SHA1
aeb62e0dfae894ec460b0fea6b7eb468ba1e7eba
-
SHA256
4d625dc62c2cf5fbcd19fb5816ac278168bfcb561ee58acd433220b292cc3c6a
-
SHA512
93eb81ace5f1a5ab9a793778c71ed22f04565eb5433c7e82a8e4852b5ac855a9b61c4848fc1826b964e015f51222a913046227f26c53f0f861f2f1a3bc8e0362
-
SSDEEP
98304:XX77GBfWgx1t4+Cgaw7YOXwnS4rV5IDQ61HMEYOXwnS4rVuD:vGBfWO1Gj3ISuQ61CI9
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
056518f26a873389cbb7e29591c47fef_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ati display driver = "ÔN@" 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
056518f26a873389cbb7e29591c47fef_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\rekeywiz.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\TSTheme.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\waitfor.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrs.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\grpconv.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\PING.EXE_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\setx.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\where.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\odbcad32.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\net.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\Taskmgr.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\clip.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\eventcreate.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\fc.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\forfiles.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\gpupdate.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\perfhost.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\sfc.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasdial.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\mountvol.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\mstsc.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\odbcad32.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\raserver.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\dialer.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\odbcconf.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\wscript.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\netsh.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\forfiles.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\resmon.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\w32tm.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\isoburn.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\xcopy.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\sdchange.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\Dism.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\DpiScaling.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\systray.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrshost.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\wowreg32.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\charmap.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\dialer.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\NETSTAT.EXE_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\PING.EXE- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\quickassist.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\secinit.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SysWOW64\SyncHost.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
056518f26a873389cbb7e29591c47fef_JaffaCakes118.exedescription ioc process File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\7-Zip\7zFM.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateCore.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\Install\{544CD458-F493-4888-9A56-33661A7F5454}\chrome_installer.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
056518f26a873389cbb7e29591c47fef_JaffaCakes118.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.19041.1_none_3640cf5b039ce2f0\DiskSnapshot.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_470f45b46101edfb\f\powershell.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_d0cf24ea634e86e3\f\explorer.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_c47fb20821633815\f\imecfmui.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\r\msinfo32.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\f\ApplySettingsTemplateCatalog.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bubbles_31bf3856ad364e35_10.0.19041.1_none_246f53bf694f27f8\Bubbles.scr- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.153_none_47569e595c44e70c\FileExplorer.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_87b019d7cebd66d4\iissetup.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\r\FsIso.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\f\SpatialAudioLicenseSrv.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\r\SearchFilterHost.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\logman.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.19041.928_none_4621828876257e43\n\certreq.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-slidetoshutdown_31bf3856ad364e35_10.0.19041.1_none_4a1699e73b1ad297\SlideToShutDown.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\f\WSManHTTPConfig.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15805.0_none_468e01fabfc37212\ComSvcConfig.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\adamsync.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_93b4a0a1641d085c\r\svchost.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.264_none_51891893184281d8\LaunchWinApp.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\ScreenClipping\ScreenClippingHost.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1060d2d22df7c6eb\f\WWAHost.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\UevAgentPolicyGenerator.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.19041.1_none_c367e800917abc7d\odbcconf.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.19041.1_none_8bc62bc63a30d6fb\nslookup.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\r\FsIso.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15805.0_none_0e9691ac6feedc0d\aspnet_wp.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\f\SenseSampleUploader.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_b2e64138c9682982\InputSwitchToastHandler.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\explorer.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1266_none_82441dbab862ff6a\r\msoobe.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-slidetoshutdown_31bf3856ad364e35_10.0.19041.1_none_4a1699e73b1ad297\SlideToShutDown.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_4cb1ff2aa122b5dd\tttracer.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.19041.1_none_cdd05846922cdabb\msdtcvtr.bat- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.19041.1_none_00c77b5a9e4f1bee\dsmgmt.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.19041.1023_none_d3d892f3280079d7\r\MdmDiagnosticsTool.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1266_none_ba0845abb58c8bdd\f\BioIso.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_908b22903a403149\r\ndadmin.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\FXSCOVER.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\f\audit.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.19041.1_none_5d525a67aae579a5\dpnsvr.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1_none_2d89ee37314a19a9\cleanmgr.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_ef39acce2648e404\WerFault.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\ApplySettingsTemplateCatalog.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\ByteCodeGenerator.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.19041.572_none_bfb752f1e1449c59\dnscacheugc.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.19041.1_none_bf2412b3ea69b4cb\lpkinstall.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1_none_bf506ecc66a800df\TiFileFetcher.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.19041.1_none_df1a7ee54b62a4fd\quser.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.84_none_809ebfa242fbf368\r\wimserv.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.844_none_c0d0cb934c1c1f17\r\DTUHandler.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\r\WerFaultSecure.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.746_none_556ec3cb05e3ec5a\OpenWith.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2f8c879e7c6f8b16\rasphone.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.264_none_c1c396da5ea1410f\wbengine.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.1_none_4721ab47285172c4\net1.exe_ 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.1_none_3d521dedd6c76700\hcsdiag.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.1_none_51facbaf4051768b\perfmon.exe- 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe -
Processes:
IEXPLORE.EXEIEXPLORE.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420476344" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900299547899da01 IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007fe03b4cb10a344eb13f4ed23e329ce100000000020000000000106600000001000020000000557a9363e022ba006c3c0c405851058e9993546e6df6061b600e5ef09372a818000000000e8000000002000020000000c06936e9f92c832be2f533f3531b17789baff42eaa09a736b0430da66fda590720000000958ed5a03cb6cb9fe73ab82fa9ef41f3f1946877b1b59ef549cc69bc8f6a9ae44000000021243d843600d615af831b871b2650c3ab38e9a0be3a1ec3866b39fbdbf58396d3d14bb15dea8ae7de05043a3950af01136639a9f4078bdbcb1c23c4150668c1 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7B8C2F7C-056B-11EF-B37B-76C98F9B6106} = "0" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007fe03b4cb10a344eb13f4ed23e329ce100000000020000000000106600000001000020000000208b0737a7a9e5e79ad182e57f7fefbf37ce2b4a5d552bd6901ccaa4870b5ac6000000000e8000000002000020000000e4eeb87500d06eab4dbd24524cffae488ee5fb69cfa56fe8d68408c1267ed02120000000ee6ebd168791e9179942af1c87d96f625643b5875c2a8ada0160d93f1209cacf40000000a68d3f7a0cb777ddeecf28980d1957fca1ad4408ede9dfea2c3751256600a6d6d120b8a5a9aaefd36bcad87c55b5f3bfefe0f1e548339620d238ecae88a5a2b4 IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80bd9d547899da01 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.exepid process 3376 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.exeIEXPLORE.EXEpid process 3376 IEXPLORE.exe 3376 IEXPLORE.exe 3688 IEXPLORE.EXE 3688 IEXPLORE.EXE 3688 IEXPLORE.EXE 3688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
056518f26a873389cbb7e29591c47fef_JaffaCakes118.exeIEXPLORE.exedescription pid process target process PID 4636 wrote to memory of 3376 4636 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe IEXPLORE.exe PID 4636 wrote to memory of 3376 4636 056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe IEXPLORE.exe PID 3376 wrote to memory of 3688 3376 IEXPLORE.exe IEXPLORE.EXE PID 3376 wrote to memory of 3688 3376 IEXPLORE.exe IEXPLORE.EXE PID 3376 wrote to memory of 3688 3376 IEXPLORE.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3376 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\7z.exeFilesize
17.6MB
MD5d90dabcbadcb6daabf3b68d954c8481d
SHA116b1de3373ef0a879d0127bda408cdfa69539b6a
SHA2563285fc252731ec8caf20ec711be77dcd797dbc161cf63d344c2eb7e11e830f2f
SHA51210f18a7e02d999b34e5008582e41a54e96f576571d7c016d9e0f1b57199d8bf1df12fb44eec37dfeb8c5aab8bbe0068672113b7a43a9ac612697feb7ff138787