Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 20:20
Behavioral task
behavioral1
Sample
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe
-
Size
8.4MB
-
MD5
05feb5251283c97feb6725ba0bb3abbf
-
SHA1
69822ef1185a57d7cb77b14c86d8744fca45d022
-
SHA256
1097769a6ac38d61d642fd5cc471f983d2a0b17e3380ea9f4f07223f88066d32
-
SHA512
2b62c35e9736bd3231921fc4d6962ddb1d0695a2e49df64821892489f7ebfb78173c89ce2b35580076abc3e314c7a42e80e33823caaa1db5fe47838ac6da75f4
-
SSDEEP
196608:da9+6Y7SOEibgRavDllSGBfW+yzPpCLir2ob:dFgRavDllzW+yzPpe
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1912-0-0x0000000000400000-0x0000000000613000-memory.dmp family_blackmoon C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe family_blackmoon -
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
XMRig Miner payload 17 IoCs
Processes:
resource yara_rule behavioral2/memory/1912-0-0x0000000000400000-0x0000000000613000-memory.dmp xmrig C:\Windows\svchost.exe xmrig C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe xmrig behavioral2/memory/2284-393-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2284-394-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2284-397-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2284-406-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2284-417-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2284-427-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2284-456-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2284-541-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2284-542-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2284-543-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2284-544-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2284-545-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2284-546-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/2284-547-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2284 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\ARP.EXE 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\diskpart.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\grpconv.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\perfhost.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\quickassist.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\unregmp2.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\attrib.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\mcbuilder.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\perfmon.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\wextract.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\scrnsave.scr 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\hh.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\mmgaserver.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\psr.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\sethc.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\certreq.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\driverquery.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\eventcreate.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\icsunattend.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\rekeywiz.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\TpmInit.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\RdpSa.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\setx.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\more.com 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\esentutl.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\finger.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\regedit.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\systeminfo.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\wowreg32.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\cttunesvr.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\curl.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllhst3g.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\isoburn.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\powercfg.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\calc.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\choice.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\dxdiag.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\Fondue.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\fsutil.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\msiexec.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\WWAHost.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\ftp.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\netbtugc.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\relog.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateOnDemand.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.29\MicrosoftEdgeUpdateSetup.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\WebviewOffline.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\SaveRemove.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.19041.746_none_8443a7febb9ab03d\r\consent.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15805.0_none_9d9ad2580504a573\aspnet_compiler.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\pdferrorneedcredentials.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\proxyerror.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\unknownprotocol.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.844_none_9b62a70f9278f2cd\r\ofdeploy.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_816403dd2374fa29\dfrgui.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\dnserror.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\view\oobe-chrome-contentview-template.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\500.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1_none_efa641d58a943e71\dmcertinst.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\SecureAssessmentBrowser.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_f3a9dc0fe254a157\wmplayer.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1ab57d24625888e6\f\WWAHost.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.19041.1_none_77b40a18a99e4f02\csc.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_7dd23580df04442f\r\DWWIN.EXE 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.153_none_b4f0bd83cfc7701e\f\AxInstUI.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.19041.1_none_6b761570d2ba1947\certutil.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.84_none_027c502c6e331223\f\SppExtComObj.Exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\f\MoUsoCoreWorker.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.84_none_9b0dd648f2c31f16\f\dfrgui.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.19041.1266_none_1b79ad13f653c2a7\mfpmp.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobeFooterHost.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\wmpconfig.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_220320d2c4216035\TiWorker.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-adminservice_31bf3856ad364e35_10.0.19041.1_none_1058f7ab971a5799\WMSvc.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\f\rmttpmvscmgrsvr.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.19041.84_none_c43e71af69351575\dstokenclean.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\default-frame-template.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.1_none_51b7888297a3c04e\WindowsActionDialog.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.84_none_29cf9b86db5fb249\audit.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2b8b5a41940eac9f\prevhost.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\adamsync.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.1_none_4030851754b3e0fb\schtasks.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVShNotify.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_f15a0c837b51c5fc\gpupdate.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\SysResetErr.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.19041.1_none_8a11dbe22c9bf6e1\msfeedssync.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\pdferrorquitapplicationguard.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\pdferrorofflineaccessdenied.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\403-18.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\conhost.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-more_31bf3856ad364e35_10.0.19041.1_none_624b5deeb86c35b8\more.com 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\http_400.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1151_none_0412565dd5f26733\f\wkspbroker.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.84_none_b4499a04dddcc22e\ssh-keygen.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-fontview_31bf3856ad364e35_10.0.19041.1_none_04a9c5158a354e7a\fontview.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\dnserror.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.1_none_e190f18a08ed1a44\FlashUtil_ActiveX.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1266_none_7e2b6be969016c27\r\licensingdiag.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\SyncAppvPublishingServer.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.844_none_64d33f8fb364398c\f\net1.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\forbidframingedge.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.19041.1_none_f35caf2131abed9a\lsass.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\rwinsta.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.19041.1202_none_e17f082b30dd9027\f\wifitask.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\ErrorPages\pdferrorrenewrentallicense.html 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\500-18.htm 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4478665ed379a3fc\r\AtBroker.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.84_none_dd81fb99bc3b1e53\NgcIso.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.153_none_c0c4ee134c2535a0\DTUHandler.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.19041.1_none_7a6e62f3d1012ed4\vssadmin.exe 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exesvchost.exedescription pid process Token: SeDebugPrivilege 1912 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Token: 33 1912 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1912 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2284 svchost.exe Token: SeLockMemoryPrivilege 2284 svchost.exe Token: SeLockMemoryPrivilege 2284 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exepid process 1912 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription pid process target process PID 1912 wrote to memory of 2284 1912 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe svchost.exe PID 1912 wrote to memory of 2284 1912 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05feb5251283c97feb6725ba0bb3abbf_JaffaCakes118.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeFilesize
10.5MB
MD54539ed326513c347d541f4844fe64096
SHA1b1bf66abc7c387601b8c848a0f5d18144a191ada
SHA256929c8bbc62b83d3da87297b17e1bb86d4569a9b71ac5d5021e053e572cab2b8a
SHA512b4960d366a032c873b5a9228d7da2bc44a45f74847f92b29a457544b3b1b2be038c303856bf2ab748c3ae4836746db40b34d1647ca502b4054b4d86fc0033e43
-
C:\Windows\config.jsonFilesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
C:\vcredist2010_x86.log.htmlFilesize
80KB
MD5a63b8a76a6441373ecbb5154c970c5ed
SHA1f97c060672cae415e139b1e98c4ff626916b3719
SHA25643c2c577b09b5ce4eb20a543246b277b319f16d08d6af2893a5550c37db80427
SHA51236c878b03f4b4a4a622e154f97e4c37486a2fc259f9742f70c348ec9fb568b1bc08c41d1bab0eeb80a225a637bd7e24a7929962dd20174433542b782f674f97b
-
memory/1912-0-0x0000000000400000-0x0000000000613000-memory.dmpFilesize
2.1MB
-
memory/2284-417-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2284-541-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2284-406-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2284-394-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2284-427-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2284-456-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2284-393-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2284-397-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2284-542-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2284-543-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2284-544-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2284-545-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2284-546-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/2284-547-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB