4d625dc62c2cf5fbcd19fb5816ac278168bfcb561ee58acd433220b292cc3c6a

General

Target

056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
Size

17.1MB
MD5

056518f26a873389cbb7e29591c47fef
SHA1

aeb62e0dfae894ec460b0fea6b7eb468ba1e7eba
SHA256

4d625dc62c2cf5fbcd19fb5816ac278168bfcb561ee58acd433220b292cc3c6a
SHA512

93eb81ace5f1a5ab9a793778c71ed22f04565eb5433c7e82a8e4852b5ac855a9b61c4848fc1826b964e015f51222a913046227f26c53f0f861f2f1a3bc8e0362
SSDEEP

98304:XX77GBfWgx1t4+Cgaw7YOXwnS4rV5IDQ61HMEYOXwnS4rVuD:vGBfWO1Gj3ISuQ61CI9

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ati display driver = "ÔN@"	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

Processes:

056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rekeywiz.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\SystemPropertiesComputerName.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\TSTheme.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\waitfor.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winrs.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\grpconv.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\PING.EXE_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\setx.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\where.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\odbcad32.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\net.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Taskmgr.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\clip.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MuiUnattend.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\eventcreate.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fc.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\forfiles.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\gpupdate.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\perfhost.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\RMActivate.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WPDShextAutoplay.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\CertEnrollCtrl.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sfc.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wiaacmgr.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\rasdial.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mountvol.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mstsc.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\odbcad32.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\raserver.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dialer.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\odbcconf.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wscript.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\netsh.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\_isdel.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\forfiles.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\resmon.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\w32tm.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\isoburn.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\TokenBrokerCookies.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xcopy.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sdchange.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DpiScaling.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\SystemPropertiesRemote.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\TCPSVCS.EXE_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\UserAccountControlSettings.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WerFaultSecure.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\CertEnrollCtrl.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\systray.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HOSTNAME.EXE_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\CredentialUIBroker.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\TapiUnattend.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winrshost.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wowreg32.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\charmap.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dialer.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\NETSTAT.EXE_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\PING.EXE-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\PresentationHost.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\quickassist.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\secinit.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\SyncHost.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

Processes:

056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\7-Zip\7zFM.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateCore.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Update\Install\{544CD458-F493-4888-9A56-33661A7F5454}\chrome_installer.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

Processes:

056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.19041.1_none_3640cf5b039ce2f0\DiskSnapshot.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_470f45b46101edfb\f\powershell.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_d0cf24ea634e86e3\f\explorer.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_c47fb20821633815\f\imecfmui.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\r\msinfo32.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\f\ApplySettingsTemplateCatalog.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-bubbles_31bf3856ad364e35_10.0.19041.1_none_246f53bf694f27f8\Bubbles.scr-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.153_none_47569e595c44e70c\FileExplorer.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_87b019d7cebd66d4\iissetup.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\r\FsIso.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\f\SpatialAudioLicenseSrv.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\r\SearchFilterHost.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\logman.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.19041.928_none_4621828876257e43\n\certreq.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-slidetoshutdown_31bf3856ad364e35_10.0.19041.1_none_4a1699e73b1ad297\SlideToShutDown.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\f\WSManHTTPConfig.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15805.0_none_468e01fabfc37212\ComSvcConfig.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\adamsync.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_93b4a0a1641d085c\r\svchost.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.264_none_51891893184281d8\LaunchWinApp.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\ScreenClipping\ScreenClippingHost.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1060d2d22df7c6eb\f\WWAHost.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\UevAgentPolicyGenerator.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.19041.1_none_c367e800917abc7d\odbcconf.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.19041.1_none_8bc62bc63a30d6fb\nslookup.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\r\FsIso.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15805.0_none_0e9691ac6feedc0d\aspnet_wp.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\f\SenseSampleUploader.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_b2e64138c9682982\InputSwitchToastHandler.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\explorer.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1266_none_82441dbab862ff6a\r\msoobe.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-slidetoshutdown_31bf3856ad364e35_10.0.19041.1_none_4a1699e73b1ad297\SlideToShutDown.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_4cb1ff2aa122b5dd\tttracer.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.19041.1_none_cdd05846922cdabb\msdtcvtr.bat-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.19041.1_none_00c77b5a9e4f1bee\dsmgmt.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.19041.1023_none_d3d892f3280079d7\r\MdmDiagnosticsTool.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1266_none_ba0845abb58c8bdd\f\BioIso.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_908b22903a403149\r\ndadmin.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\FXSCOVER.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\f\audit.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.19041.1_none_5d525a67aae579a5\dpnsvr.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1_none_2d89ee37314a19a9\cleanmgr.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_ef39acce2648e404\WerFault.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\ApplySettingsTemplateCatalog.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\ByteCodeGenerator.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.19041.572_none_bfb752f1e1449c59\dnscacheugc.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.19041.1_none_bf2412b3ea69b4cb\lpkinstall.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1_none_bf506ecc66a800df\TiFileFetcher.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.19041.1_none_df1a7ee54b62a4fd\quser.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.84_none_809ebfa242fbf368\r\wimserv.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.844_none_c0d0cb934c1c1f17\r\DTUHandler.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\r\WerFaultSecure.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.746_none_556ec3cb05e3ec5a\OpenWith.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2f8c879e7c6f8b16\rasphone.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.264_none_c1c396da5ea1410f\wbengine.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.1_none_4721ab47285172c4\net1.exe_	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.1_none_3d521dedd6c76700\hcsdiag.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.1_none_51facbaf4051768b\perfmon.exe-	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420476344"	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900299547899da01	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007fe03b4cb10a344eb13f4ed23e329ce100000000020000000000106600000001000020000000557a9363e022ba006c3c0c405851058e9993546e6df6061b600e5ef09372a818000000000e8000000002000020000000c06936e9f92c832be2f533f3531b17789baff42eaa09a736b0430da66fda590720000000958ed5a03cb6cb9fe73ab82fa9ef41f3f1946877b1b59ef549cc69bc8f6a9ae44000000021243d843600d615af831b871b2650c3ab38e9a0be3a1ec3866b39fbdbf58396d3d14bb15dea8ae7de05043a3950af01136639a9f4078bdbcb1c23c4150668c1	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7B8C2F7C-056B-11EF-B37B-76C98F9B6106} = "0"	IEXPLORE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007fe03b4cb10a344eb13f4ed23e329ce100000000020000000000106600000001000020000000208b0737a7a9e5e79ad182e57f7fefbf37ce2b4a5d552bd6901ccaa4870b5ac6000000000e8000000002000020000000e4eeb87500d06eab4dbd24524cffae488ee5fb69cfa56fe8d68408c1267ed02120000000ee6ebd168791e9179942af1c87d96f625643b5875c2a8ada0160d93f1209cacf40000000a68d3f7a0cb777ddeecf28980d1957fca1ad4408ede9dfea2c3751256600a6d6d120b8a5a9aaefd36bcad87c55b5f3bfefe0f1e548339620d238ecae88a5a2b4	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80bd9d547899da01	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.exe

pid process

3376 IEXPLORE.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.exeIEXPLORE.EXE

pid process

3376 IEXPLORE.exe
3376 IEXPLORE.exe
3688 IEXPLORE.EXE
3688 IEXPLORE.EXE
3688 IEXPLORE.EXE
3688 IEXPLORE.EXE

pid	process
3376	IEXPLORE.exe

pid	process
3376	IEXPLORE.exe
3376	IEXPLORE.exe
3688	IEXPLORE.EXE
3688	IEXPLORE.EXE
3688	IEXPLORE.EXE
3688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

056518f26a873389cbb7e29591c47fef_JaffaCakes118.exeIEXPLORE.exe

description	pid	process	target process
PID 4636 wrote to memory of 3376	4636	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe	IEXPLORE.exe
PID 4636 wrote to memory of 3376	4636	056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe	IEXPLORE.exe
PID 3376 wrote to memory of 3688	3376	IEXPLORE.exe	IEXPLORE.EXE
PID 3376 wrote to memory of 3688	3376	IEXPLORE.exe	IEXPLORE.EXE
PID 3376 wrote to memory of 3688	3376	IEXPLORE.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\056518f26a873389cbb7e29591c47fef_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4636

C:\Program Files\Internet Explorer\IEXPLORE.exe
"C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3376 CREDAT:17410 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3688

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.exe
Filesize
17.6MB

MD5
d90dabcbadcb6daabf3b68d954c8481d

SHA1
16b1de3373ef0a879d0127bda408cdfa69539b6a

SHA256
3285fc252731ec8caf20ec711be77dcd797dbc161cf63d344c2eb7e11e830f2f

SHA512
10f18a7e02d999b34e5008582e41a54e96f576571d7c016d9e0f1b57199d8bf1df12fb44eec37dfeb8c5aab8bbe0068672113b7a43a9ac612697feb7ff138787

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads