Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 19:23
Behavioral task
behavioral1
Sample
05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe
-
Size
16.1MB
-
MD5
05e66b7cde6c4929122e8042cc3093b6
-
SHA1
acefb24a5630f8657056c729758b69ffdde287b3
-
SHA256
526bd0f29e71cb485c51b0f40ed36667e8f341ec4191cd680c39fd4a59ce3635
-
SHA512
61d676d6555c2b1557872c7b6fda474f8f8f85d558d4760c53a97bebc95f7fec01b3e6bee2340c6c8aa7500fd09d05dc44ba2dc571e318fddb35d0da671a7bda
-
SSDEEP
393216:dFgR5WrWeWcKZWeW8W7FgR5WrWeWcKZWeW8WuQf:PKiK4
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4344-0-0x0000000000400000-0x0000000000613000-memory.dmp family_blackmoon C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe family_blackmoon -
Processes:
05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe -
XMRig Miner payload 17 IoCs
Processes:
resource yara_rule behavioral2/memory/4344-0-0x0000000000400000-0x0000000000613000-memory.dmp xmrig C:\Windows\svchost.exe xmrig C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe xmrig behavioral2/memory/5064-298-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/5064-391-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/5064-393-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/5064-395-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/5064-396-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/5064-399-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/5064-417-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/5064-418-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/5064-427-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/5064-428-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/5064-531-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/5064-532-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/5064-533-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/5064-534-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
Processes:
05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe" 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe" 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe" 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe" 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe" 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe" 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 5064 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe" 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe -
Processes:
05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\fixmapi.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\MRINFO.EXE 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\systeminfo.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\systray.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\Taskmgr.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\unlodctr.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\ctfmon.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\dpapimig.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\regsvr32.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\sxstrace.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\PresentationHost.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\prevhost.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\quickassist.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\tar.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\msdt.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\mshta.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\bootcfg.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\ipconfig.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\expand.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\netbtugc.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\wevtutil.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\compact.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\ddodiag.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\credwiz.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\mavinject.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\notepad.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\PATHPING.EXE 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\printui.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\Robocopy.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\attrib.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\control.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\ROUTE.EXE 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\tttracer.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\edpnotify.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\autoconv.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\makecab.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\setup16.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\tcmsetup.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\dvdplay.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\fltMC.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\format.com 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\TRACERT.EXE 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\Utilman.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\wscript.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\dplaysvr.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\recover.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\userinit.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\diskpart.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\iscsicli.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\tasklist.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SysWOW64\TpmTool.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateCore.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateBroker.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseHostPage.html 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateOnDemand.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101187\javaw.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseHostPage.html 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\locallaunch\locallaunch.html 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\locallaunch\locallaunchdlg.html 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.19041.423_none_0b0196a3d38fda4e\OOBENetworkConnectionFlow.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.746_none_6275453e12708a76\r\recdisc.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1_none_0d7764d82a75e629\BitLockerWizardElev.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\chgusr.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.19041.746_none_38c6194376a6b88c\VSSVC.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\r\SgrmLpac.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1266_none_9a152e76298cd801\f\wmlaunch.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.1288_none_f92f7256107c0e35\nvspinfo.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\http_400.htm 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.1151_none_2e15548db03a22c8\f\CheckNetIsolation.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_8c45e6e8b672ffff\f\sxstrace.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.746_none_a9ff72b1a43fd663\f\DeviceCredentialDeployment.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\tscon.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-charmap_31bf3856ad364e35_10.0.19041.1_none_b29f753478196f5e\charmap.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\pdferrorrepurchasecontent.html 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..documents.resources_31bf3856ad364e35_10.0.19041.1_en-us_c863490bca720bd6\oobe_learn_more_activity_history.htm 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_e9349b06dfab6fdc\f\imjpuexc.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1_none_0990e3dd20dd5732\omadmclient.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deploymentcsps_31bf3856ad364e35_10.0.19041.746_none_4c096bd75d4397f3\deploymentcsphelper.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_15114cf4ffe3136a\cmmon32.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\404-5.htm 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\repost.htm 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\CallingShellApp.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\f\SearchIndexer.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobecortana-main.html 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\serviceworker.html 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\http_501.htm 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_10.0.19041.1_none_3f67a7384812df13\ComSvcConfig.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winver_31bf3856ad364e35_10.0.19041.1_none_6c428bc03bd6600a\winver.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\pdferrormfnotfound.html 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\conhost.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.19041.546_none_36dd2ad842e4f8c3\f\csrss.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.1266_none_adfc223229a335a6\r\MusNotifyIcon.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\cscript.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobe-retaildemo-exit-dialog-template.html 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\http_406.htm 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.84_none_8ea6a37043f4ae90\r\ClipUp.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.19041.1_none_0220120c9d66a59c\dcdiag.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1_none_c76758d7f0069e2e\ndadmin.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.662_none_0070027dab4e4ffe\r\UtcDecoderHost.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.19041.746_none_eda92e20fee7d318\r\PhotoScreensaver.scr 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\view\oobe-light-footer-template.html 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.746_none_8ea10e81a707d623\dcomcnfg.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.19041.746_none_d99fd60bc1fde773\LockAppHost.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..oreuap-iotuap-tools_31bf3856ad364e35_10.0.19041.1_none_e15558ebc4b8bd81\iotstartup.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.19041.1_none_3e243d8308cd1079\aspnet_wp.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.19041.1_none_679d42cd97347ace\PresentationFontCache.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.19041.1_none_2ace380757b108f3\provlaunch.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\unifiedEnrollmentProgress.html 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.19041.1202_none_a5a4c3f2637b55fa\r\aitstatic.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_1d907c422e447b14\dsdbutil.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ioningsecureprocess_31bf3856ad364e35_10.0.19041.1_none_4cc7187cbf1ef970\psp.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_96167fa49059f7a3\shrpubw.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\f\vdsldr.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\404-8.htm 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.1_none_513ebdc8ffa81e3d\coredpussvr.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.19041.746_none_18520236ff9eab63\colorcpl.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\ea94772a36e5d701947000001815341f.tlsbln.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.1_none_96907e39a64a62d0\mmgaserver.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx-dw_b03f5f7f11d50a3a_10.0.19041.1_none_8e850c52ac392ae6\dw20.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\emulation\emulation.html 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exesvchost.exedescription pid process Token: SeDebugPrivilege 4344 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe Token: 33 4344 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4344 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 5064 svchost.exe Token: SeLockMemoryPrivilege 5064 svchost.exe Token: SeLockMemoryPrivilege 5064 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exepid process 4344 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exedescription pid process target process PID 4344 wrote to memory of 5064 4344 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe svchost.exe PID 4344 wrote to memory of 5064 4344 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05e66b7cde6c4929122e8042cc3093b6_JaffaCakes118.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4344 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5064
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeFilesize
18.2MB
MD5d09d1c56233dcdd83b1c91fba5389136
SHA1a4e2152d818c5beebd838156c712d69ddd831a0e
SHA25665b02536d7478291c48cd9147efbea36237daad69844dfb115b8723496d9b27b
SHA512097556edc9748630388b47468632b1f1b5bf2f2d663ca529f25b70322864fc111e057266bf499d21b78b43988a2921a3c1d264699e8115cba73cd8a5dc211979
-
C:\Windows\config.jsonFilesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
C:\vcredist2010_x86.log.htmlFilesize
80KB
MD58d506df5bf56914267572ff81f8bfeb8
SHA16bf00d0f76fbba208911c592dace6f66de13712b
SHA256007a2157d5842a181171bc5e19d52b47ab721b8c6aba7938810fc87698a5a8a4
SHA5120cc203f634d5cafc5010c02b6fad9fb429371ef2fe45ec7a17b4855e9d3a9a5fd725506119e63d1a7ad6755d869773ff83853cab3ef607b59b947631a9998ddc
-
memory/4344-0-0x0000000000400000-0x0000000000613000-memory.dmpFilesize
2.1MB
-
memory/5064-396-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/5064-427-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/5064-395-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/5064-391-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/5064-399-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/5064-417-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/5064-418-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/5064-393-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/5064-428-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/5064-298-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/5064-531-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/5064-532-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/5064-533-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/5064-534-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB