Analysis
-
max time kernel
142s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 20:20
Behavioral task
behavioral1
Sample
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe
-
Size
8.4MB
-
MD5
05feb5251283c97feb6725ba0bb3abbf
-
SHA1
69822ef1185a57d7cb77b14c86d8744fca45d022
-
SHA256
1097769a6ac38d61d642fd5cc471f983d2a0b17e3380ea9f4f07223f88066d32
-
SHA512
2b62c35e9736bd3231921fc4d6962ddb1d0695a2e49df64821892489f7ebfb78173c89ce2b35580076abc3e314c7a42e80e33823caaa1db5fe47838ac6da75f4
-
SSDEEP
196608:da9+6Y7SOEibgRavDllSGBfW+yzPpCLir2ob:dFgRavDllzW+yzPpe
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1684-0-0x0000000000400000-0x0000000000613000-memory.dmp family_blackmoon C:\Program Files\7-Zip\7z.exe family_blackmoon -
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
XMRig Miner payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/1684-0-0x0000000000400000-0x0000000000613000-memory.dmp xmrig C:\Windows\svchost.exe xmrig C:\Program Files\7-Zip\7z.exe xmrig behavioral1/memory/2260-340-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2260-363-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2260-364-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2260-385-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2260-495-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2260-748-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2260-749-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2260-750-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2260-751-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2260-752-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2260-753-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2260-754-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2260-755-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2260-756-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2260 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\chkdsk.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\dccw.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\wimserv.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\com\comrepl.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\fltMC.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\icacls.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\ieUnatt.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\autoconv.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\ipconfig.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\proquota.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\sort.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\raserver.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\rrinstaller.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\wermgr.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\diskcomp.com 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmdl32.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\dialer.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\OptionalFeatures.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\psr.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\mode.com 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllhst3g.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\svchost.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\fsutil.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\gpscript.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasautou.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasphone.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\cliconfg.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\diantz.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\drvinst.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\dvdplay.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\winver.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_neutral_e54666f6a3e5af91\fsquirt.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmic.inf_amd64_neutral_b94eb92e8150fa35\vmicsvc.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\credwiz.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\hdwwiz.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\mcbuilder.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\sfc.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\migwiz.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\AtBroker.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\bootcfg.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\Robocopy.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\tracerpt.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP10\imjppdmg.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\chkntfs.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmstp.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\gpresult.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\odbcad32.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\SyncHost.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\powercfg.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\TpmInit.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\diskraid.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\dnscacheugc.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\icardagt.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\ktmutil.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\label.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\lodctr.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\user.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\wecutil.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\upnpcont.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\netbtugc.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\RSSFeeds.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\flyout.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\RSSFeeds.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\cpu.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\settings.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Defender\MSASCui.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePage.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\currency.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\clock.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\settings.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\currency.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\settings.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\clock.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\settings.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPreviewTemplate.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\WMPDMC.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\settings.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\slideShow.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process File created C:\Windows\ehome\wow\ehexthost32.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7601.17514_none_352b5454878cd498\AxInstUI.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\404-3.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_6.1.7601.17514_none_696354579779eadf\imjpuexc.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-srdelayed_31bf3856ad364e35_6.1.7600.16385_none_b252497a75d8a174\srdelayed.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_6.1.7601.17514_none_3d9977977190cdc4\MultiDigiMon.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\500-15.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_6.1.7600.16385_none_5a9496fc0f35b80b\DWWIN.EXE 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\replace.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_6.1.7600.16385_none_3df12febe293ce5d\tcmsetup.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_8fbf4b0735f59a32\ilasm.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-nslookup_31bf3856ad364e35_6.1.7601.17514_none_cd87dddbc4b4a790\nslookup.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-installer-executable_31bf3856ad364e35_6.1.7601.17514_none_4b88deb7e45bfbb0\msiexec.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_34ce5d95ad203bbe\NETSTAT.EXE 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\401-2.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad_unlodctr.exe_69df45bb 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\attrib.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_aeae15a0d7fc043a\clock.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\405.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..up-drivepreparation_31bf3856ad364e35_6.1.7601.17514_none_ff178cca7f9d03eb\BdeHdCfg.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-international-core_31bf3856ad364e35_6.1.7601.17514_none_ebb1ce7438031941_muiunattend.exe_1e11bb40 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\404-5.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\ehome\McxTask.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\500-13.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_6.1.7600.16385_none_c5e81c6ab4db0c88\TapiUnattend.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-mobsyncexe_31bf3856ad364e35_6.1.7601.17514_none_f1584379b2973708\mobsync.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\500-19.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7601.17514_none_dfe02de35bf41e0b\PrintBrmUi.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\x86_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_6.1.7601.17514_none_f59e20ddece8f922_certenrollctrl.exe_9495aa75 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\404-14.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\500-15.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedt32.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_6.1.7600.16385_none_a9b5c1d91f03e0b4\RelPost.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-cipher_31bf3856ad364e35_6.1.7600.16385_none_acecd57e066c38ac\cipher.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4a5d2c9ecd59afa7_dnscacheugc.exe_aa32623e 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_6.1.7601.17514_none_ef3338f363c6403c\TrustedInstaller.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-scrnsave_31bf3856ad364e35_6.1.7600.16385_none_e115f7273bb86d58\scrnsave.scr 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\404-2.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7e7f3bd0c60c7e17\settings.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e9ea273bf74e2d7d\settings.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-3.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sigverif_31bf3856ad364e35_6.1.7600.16385_none_178e7604150fa952\sigverif.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_22f5c6aadf559287\MigSetup.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_it-it_0c889693e4e0f25f\settings.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\401-4.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_6.1.7601.17514_none_832fc1bb7d681e0d\sdclt.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-computerdefaults_31bf3856ad364e35_6.1.7600.16385_none_064cf7cf249d0026\ComputerDefaults.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-ie-setup-support_31bf3856ad364e35_8.0.7601.17514_none_e292664733bd5af6\ie4uinit.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\loadmxf.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.17514_none_d281ccc018b94ff4\conhost.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_aeae15a0d7fc043a\settings.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systray_31bf3856ad364e35_6.1.7600.16385_none_4f466e7a0fbb1a04\systray.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winver_31bf3856ad364e35_6.1.7600.16385_none_12466fe3b629e036\winver.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-extrac32_31bf3856ad364e35_6.1.7600.16385_none_dafff0c26538f91f\extrac32.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-convert_31bf3856ad364e35_6.1.7601.17514_none_fafb502abef1be40\convert.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exesvchost.exedescription pid process Token: SeDebugPrivilege 1684 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Token: 33 1684 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1684 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2260 svchost.exe Token: SeLockMemoryPrivilege 2260 svchost.exe Token: SeLockMemoryPrivilege 2260 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exepid process 1684 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription pid process target process PID 1684 wrote to memory of 2260 1684 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe svchost.exe PID 1684 wrote to memory of 2260 1684 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe svchost.exe PID 1684 wrote to memory of 2260 1684 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe svchost.exe PID 1684 wrote to memory of 2260 1684 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\7z.exeFilesize
8.9MB
MD5d8aacf09b355a7d6e29e65193c47352c
SHA12f5bab1d136a23a292f5252c11a2ff05896dddac
SHA256f9ea17fbf75ce41830942581fab0886a3783f45e20de21c744a45115321de18b
SHA51245c5902922ae67565468b07bc6af6401f0aacf5915d03f26c5b87d99050679188e73688219000fa6207d0328d2453081811ac2505b9f16fda1cd4afd1180d508
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.htmlFilesize
16KB
MD5ed1191da9c4f74a60d695a25686f374e
SHA13a427657c16a716be332587425101653c25221d0
SHA256ab8cafd1958c27d70adc747259495e35592f8a06ae00969964f5f34f72896f3f
SHA51268098c1342f87939b3f57cd3e3a799ff316d2f1eb5c52f8d9c0c9e7c214281bff68a1260a91527b7175ad031798f42125cf9ee2e0d49772eb03b5836b67d9fbf
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.htmlFilesize
6KB
MD5657eb3527d651515f97b960a67d19fda
SHA127404b587183bc2f3b3b6919fbb91892f505b60d
SHA256f301745232a72d84f277980ad53b65d94b02479369e8b73fe0e6717adcf11a35
SHA5121085550a8844de081a216bd864990e56fbe91498fb6186cce435173ab73e29932e7b8182078cd2876039addbdb7e3c9769d7d7923f7ed2a5422e6a2a36321b70
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.htmlFilesize
12KB
MD5cdea5d1cccee27144519c75bcf3015bd
SHA1c36862abb1ada006b3dd4c28adc8b393a92fd325
SHA2561184f2316c36648a2d457b602c713d5d5eb980e86e5e8ed388e94a47f8573dbd
SHA5125d0ea1cef2af7111098c19578c42bfdfd7bb00ec3259fe026df6dd867a24f9a94f3299b035235e3cb87b1c9010f0d1be434a08318dae0412e03ecfdb439edfe9
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.htmlFilesize
9KB
MD5bc3e199345ad8ba54e2fe4acad95433d
SHA1c93cb69c27e1c03069de3c952534a52f391e3fb9
SHA256462c197c83ee3d677b07fe000b2c4e64ac4be4ceaaea80c1c77a5e67d832edd8
SHA512c1941c9106ff0d665dfee1888afcdc3c54e4db8fdb11e3313cd92a147a1084264dba8f1f9cbac5216d3c5ce1f97ff7f8d7d7493826ec3538d5db57a933fe32e4
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.htmlFilesize
14KB
MD559e4add1732aef6b8e228ecfb880c299
SHA131a6380e878f89ec9d2c83716fe42faafdd828db
SHA256089aaccbf4c17d2a0163f13820e926f8ce3122c9ed87e7e040a77439795b8fc4
SHA512461240638f98f92a0df94a6a76470d7ed3a9bf45f845b545ff37355efd4fb3efdbe592e563b6624d2e42374a3bf7682a572c3bfd96c21be87fc96ec3b3bcfbaf
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.htmlFilesize
16KB
MD526986f79440b7a706b65724e509f009f
SHA19d8ff0beef1c19fbecd28e3f632101acf3d02599
SHA256e59b7fa34b947d5ada478ff17543204251955052fdace284e5a285bd2abec5d1
SHA5122c240c4f7b8912bd5049bef22c2507c7c1af15432c860549d0f1ea35f03183270eb7315607fdf35be86703a61ec0ed7801e9e6ea627a026dbf93d98ff11d2ed6
-
C:\Windows\config.jsonFilesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
C:\vcredist2010_x86.log.htmlFilesize
81KB
MD5a79acb14c9a875cb55b71dda3da29336
SHA1920d824765bdcc454ce6dc3f4b96873db994c729
SHA256a49f389ea264ae53fb7361c5c473935b9b7bc17cbc56b6fdbb4e38497ae5c156
SHA5122ee83740eb394da41efbd4eb400944c19877dc8c8a39946ba09fab4cc29f91075c8884e7fbb62c2cac0267b3785509bd65613a218eb5e9fa0c568dde8c875307
-
memory/1684-0-0x0000000000400000-0x0000000000613000-memory.dmpFilesize
2.1MB
-
memory/2260-364-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2260-750-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2260-385-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2260-363-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2260-340-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2260-748-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2260-749-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2260-495-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2260-751-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2260-752-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2260-753-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2260-754-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2260-755-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2260-756-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB