Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 17:15
Behavioral task
behavioral1
Sample
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe
-
Size
18.6MB
-
MD5
05af8059269d76cb7f5929bd03953749
-
SHA1
a614ff5395c53a8cf0fdee31dd6fcc32277faae3
-
SHA256
92f91b9e78c49bd39cc7a446f4d63dec275d34da99d2d5ed742a069be41ce77b
-
SHA512
5e6470d76ed3575b446e84b4a8734a9d0e92fe4bc98266ce06861464379071f094e3974ef259f9fc580f78f8286f220ac3201436ceae444765391bda8013fdb1
-
SSDEEP
393216:TFgRsWeW0QfSWgyzPpeSKfFgRsWeW0QfSWgyzPpeSKS2:o0yTjKU0yTjKB
Malware Config
Signatures
-
Detect Blackmoon payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2956-0-0x0000000000400000-0x0000000000619000-memory.dmp family_blackmoon C:\Program Files\7-Zip\Uninstall.exe family_blackmoon behavioral2/memory/2956-393-0x0000000000400000-0x0000000000619000-memory.dmp family_blackmoon behavioral2/memory/2956-541-0x0000000000400000-0x0000000000619000-memory.dmp family_blackmoon -
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
XMRig Miner payload 19 IoCs
Processes:
resource yara_rule behavioral2/memory/2956-0-0x0000000000400000-0x0000000000619000-memory.dmp xmrig C:\Windows\svchost.exe xmrig C:\Program Files\7-Zip\Uninstall.exe xmrig behavioral2/memory/2144-282-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2144-392-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2956-393-0x0000000000400000-0x0000000000619000-memory.dmp xmrig behavioral2/memory/2144-394-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2144-396-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2144-398-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2144-401-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2144-419-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2144-420-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2144-429-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2144-430-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2144-465-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2956-541-0x0000000000400000-0x0000000000619000-memory.dmp xmrig behavioral2/memory/2144-542-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2144-543-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2144-544-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2144 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/2956-0-0x0000000000400000-0x0000000000619000-memory.dmp upx C:\Program Files\7-Zip\Uninstall.exe upx behavioral2/memory/2956-393-0x0000000000400000-0x0000000000619000-memory.dmp upx behavioral2/memory/2956-541-0x0000000000400000-0x0000000000619000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\netsh.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\RdpSa.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\bthudtask.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\tar.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\whoami.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\chcp.com 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\tzutil.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\nslookup.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\attrib.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\dplaysvr.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\Magnify.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\Robocopy.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\sc.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\TSTheme.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\auditpol.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\findstr.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\setup16.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\taskkill.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\wlanext.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\fontview.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\lodctr.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\msiexec.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\ddodiag.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\replace.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\grpconv.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\diskpart.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\dpapimig.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\forfiles.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\mshta.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\sethc.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\credwiz.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\netiougc.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\tttracer.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\fc.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\perfhost.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\msdt.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\calc.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\charmap.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmdl32.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\dpnsvr.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\secinit.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\sort.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\wusa.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SysWOW64\cacls.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101187\javaws.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\WebviewOffline.html 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateSetup.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WebviewOffline.html 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\accessibilitychecker\index.html 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\WebviewOffline.html 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.19041.1_none_4e5e653d48e95632\wextract.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6a67731cf3e151f2\pcaui.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\default.html 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\pdferrordisabledforregion.html 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\hvsirpcd.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1237_none_7578510aa0f564fa\f\vfpctrl.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.746_none_5536c5683efe1dad\f\CameraSettingsUIHost.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\404-6.htm 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_5f22b28b2f384ed0\TRACERT.EXE 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-vaultcmd_31bf3856ad364e35_10.0.19041.1_none_9c72be2bf95a87f6\VaultCmd.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\iisrstas.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.610_none_d94fa044111e8308\r\StartMenuExperienceHost.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_ce6643a69c39f80a\f\ThumbnailExtractionHost.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.19041.1266_none_3b00801193b15c0f\Windows.Media.BackgroundPlayback.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.19041.1_none_d2c567b17279a950\adamuninstall.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.153_none_3c9b504ec5293ad0\f\WpcTok.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.207_none_4054ef70f69f6ff9\r\wpr.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\unifiedEnrollment\views\unifiedEnrollmentProvisioningProgress.html 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\LearnMore.html 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.19041.746_none_428efbd28b482d1c\r\bdeunlock.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\f\wsmprovhost.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\RetailDemo\retailDemoAdvanced.html 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\403-14.htm 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\invalidcert.htm 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.19041.1_none_b8c5253467557e69\shutdown.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_d93ee361fbbc8f0a\f\XGpuEjectDialog.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_816403dd2374fa29\f\dfrgui.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\r\MicrosoftEdge.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.264_none_4a12028313046a9e\ntoskrnl.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\r\msra.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config.comments 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_8c45e6e8b672ffff\sxstrace.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_8c45e6e8b672ffff\f\sxstrace.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..egistration-cmdline_31bf3856ad364e35_10.0.19041.1_none_f526198caecd7792\dsregcmd.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bootconfig_31bf3856ad364e35_10.0.19041.1_none_cc5c34dfee065cea\bootcfg.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.19041.1_none_afb33d8068b0adc0\ie4ushowIE.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.844_none_9b62a70f9278f2cd\ofdeploy.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx-netfxsbs10_exe_31bf3856ad364e35_10.0.19041.1_none_9561617494f4801d\NETFXSBS10.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.153_none_b4f0bd83cfc7701e\r\AxInstUI.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\r\MicrosoftPdfReader.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\403-5.htm 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\404.htm 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.19041.1_none_f69c49e870acf520\ddodiag.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\OfflineTabs\OfflineTabs.html 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\SgrmLpac.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\SearchProtocolHost.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\pdferrorneedcontentlocally.html 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_b321f2c2ab7710a2\f\sdbinst.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_e73f0197262d9fec\poqexec.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_10.0.19041.1_none_10c7bab3a237c3a9\SystemPropertiesPerformance.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\f\wscript.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1_none_8aab2d3580c614cb\wsmprovhost.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\pdferrorrepurchasecontent.html 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_76e6fb38a70dbd6d\GameBarPresenceWriter.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.264_none_223a5768a6257099\f\CustomShellHost.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\OfflineTabs\OfflineTabs.html 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\r\Microsoft.Uev.CscUnpinTool.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.19041.264_none_7dd490aa65cdf624\r\runexehelper.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_comsvcconfig_b03f5f7f11d50a3a_10.0.19041.1_none_ac711518659a66a5\ComSvcConfig.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobe-chrome-breadcrumb-template.html 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\r\hvix64.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.1266_none_8f272afdd624490f\f\sppsvc.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.1_none_22d9ddcd4b2b9d68\CameraSettingsUIHost.exe 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exesvchost.exedescription pid process Token: SeDebugPrivilege 2956 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Token: 33 2956 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2956 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2144 svchost.exe Token: SeLockMemoryPrivilege 2144 svchost.exe Token: SeLockMemoryPrivilege 2144 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exepid process 2956 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription pid process target process PID 2956 wrote to memory of 2144 2956 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe svchost.exe PID 2956 wrote to memory of 2144 2956 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
05af8059269d76cb7f5929bd03953749_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05af8059269d76cb7f5929bd03953749_JaffaCakes118.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\Uninstall.exeFilesize
18.7MB
MD55eff47c5163260738ac0435170ca90a5
SHA12662f60943c09cb0be7436dbbe597026a263d43c
SHA2562d6f3680d5f37f40b7751598a07593a6e7bfdc0a9a9d44eba8dcbb0d44b30200
SHA512c1b16a4cc4da92bbc1ed0b0f38879b85b67cb1d7f0eb05466bb2b473b3e93d635e33d535327bd46950613dc0b725b3d5f3086693a6ff2389b72b79881d0cb4fd
-
C:\Windows\config.jsonFilesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
C:\vcredist2010_x86.log.htmlFilesize
80KB
MD58d506df5bf56914267572ff81f8bfeb8
SHA16bf00d0f76fbba208911c592dace6f66de13712b
SHA256007a2157d5842a181171bc5e19d52b47ab721b8c6aba7938810fc87698a5a8a4
SHA5120cc203f634d5cafc5010c02b6fad9fb429371ef2fe45ec7a17b4855e9d3a9a5fd725506119e63d1a7ad6755d869773ff83853cab3ef607b59b947631a9998ddc
-
memory/2144-401-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2144-429-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2144-544-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2144-394-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2144-396-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2144-398-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2144-543-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2144-419-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2144-420-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2144-392-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2144-430-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2144-465-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2144-282-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2144-542-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2956-541-0x0000000000400000-0x0000000000619000-memory.dmpFilesize
2.1MB
-
memory/2956-0-0x0000000000400000-0x0000000000619000-memory.dmpFilesize
2.1MB
-
memory/2956-393-0x0000000000400000-0x0000000000619000-memory.dmpFilesize
2.1MB