Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 20:01
Behavioral task
behavioral1
Sample
05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe
-
Size
9.3MB
-
MD5
05f5f145e4315071a235573af9a440d2
-
SHA1
e720bf161b3867ad9adad4c236404827b9cf83ee
-
SHA256
94e54cadc079251ac232654c9abf29906a2cf966f4e33017d3820aa9cfee6feb
-
SHA512
f424dcb9789df4a57eebad1ddec853853ef2dd2174268d9b848596a588b604e37c92ed7b7225799a3f11afb269330be8b338b109ad877683a021a5e38638775b
-
SSDEEP
196608:da9+6Y7SOEibgRAGBfWp+qGBfWJGBfWJGBfW01qfRZPzmGP8c0maYD:dFgR5Wp+bWeWeW0QfOGnJa
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/5044-0-0x0000000000400000-0x0000000000613000-memory.dmp family_blackmoon C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe family_blackmoon -
Processes:
05f5f145e4315071a235573af9a440d2_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe -
XMRig Miner payload 17 IoCs
Processes:
resource yara_rule behavioral2/memory/5044-0-0x0000000000400000-0x0000000000613000-memory.dmp xmrig C:\Windows\svchost.exe xmrig C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe xmrig behavioral2/memory/1240-392-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1240-394-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1240-396-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1240-407-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1240-419-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1240-426-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1240-463-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1240-540-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1240-541-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1240-542-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1240-543-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1240-544-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1240-545-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/1240-546-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
Processes:
05f5f145e4315071a235573af9a440d2_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe" 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe" 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe" 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe" 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe" 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe" 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
05f5f145e4315071a235573af9a440d2_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 1240 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
05f5f145e4315071a235573af9a440d2_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe" 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe -
Processes:
05f5f145e4315071a235573af9a440d2_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
05f5f145e4315071a235573af9a440d2_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\dllhost.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\prevhost.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\reg.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\typeperf.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\net.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\verifiergui.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\bthudtask.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\dplaysvr.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\iscsicpl.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\waitfor.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\appidtel.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\ddodiag.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\esentutl.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\fixmapi.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\GamePanel.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmstp.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\grpconv.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\mtstocom.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\schtasks.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\Fondue.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\sc.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\format.com 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\fsutil.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\mobsync.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\IEChooser.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\compact.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\mfpmp.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\PATHPING.EXE 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\quickassist.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\Taskmgr.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\credwiz.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\Dism.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\RmClient.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\SyncHost.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\user.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\wlanext.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\edpnotify.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\setupugc.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\wecutil.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\chkdsk.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\net1.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\unlodctr.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\cipher.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\DpiScaling.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\SndVol.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\tracerpt.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\WerFault.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
05f5f145e4315071a235573af9a440d2_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{8AF88020-77AD-4F36-932C-90EB553F7474}\chrome_installer.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\accessibilitychecker\index.html 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseHostPage.html 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
05f5f145e4315071a235573af9a440d2_JaffaCakes118.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.19041.746_none_11e04cec24452336\r\dwm.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_e95531bdadf3df5c\wmpshare.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timezone-sync_31bf3856ad364e35_10.0.19041.1_none_4521fd67bfb25b6a\tzsync.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1_none_62f19f00b7fa61a7\wusa.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.19041.746_none_9ebd3ef9f0c794b5\r\WmsSvc.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\ssh-add.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.19041.746_none_45062eb997366a7f\RemoteAppLifetimeManager.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.19041.1288_none_f26bd0dcdf662cc9\r\AgentService.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.1_none_8c3bd3e771e9a0d5\mmgaserver.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\f\SysResetErr.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..l.desktop.searchapp_31bf3856ad364e35_10.0.19041.1_none_37a8fc596f462cbc\2.html 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_9d61200c734f61dd\LockApp.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\subst.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\r\scp.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\r\WerFaultSecure.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.1266_none_1abb9653828c3f41\SecurityHealthService.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15805.0_none_8e3bba60c5867c39\aspnet_regbrowsers.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\proxyerror.htm 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_presentationcore_31bf3856ad364e35_4.0.15805.110_none_a78a1aa4c54fe308\GlobalMonospace.CompositeFont 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\PhishSite_Iframe.htm 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\404-4.htm 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\print.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.264_none_9b436d497f039d6d\f\smartscreen.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.19041.746_none_24d91ab4120e42ee\rstrui.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1_none_f53b118699fc22cb\wowreg32.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\Backup\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.19041.1_none_d3e3ad84b24cfdfe_nissrv.exe_f967cd63 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-findstr_31bf3856ad364e35_10.0.19041.1_none_e77543382d72effa\findstr.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.19041.1_none_861f5c69fbf3d066\AppLaunch.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\500.htm 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1237_none_7578510aa0f564fa\f\vfpctrl.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.19041.1_none_9064b8c1b47576c0\iscsicli.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_c939d70420d81ce4\logagent.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.19041.746_none_eb2cdd2a40f60c45\r\MsSpellCheckingHost.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\retailDemoMsaInclusive.html 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\404-6.htm 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.19041.1023_none_d3d892f3280079d7\f\MdmDiagnosticsTool.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.746_none_2c2bcd67e9d4665c\r\FileHistory.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\pdferrordisabledforregion.html 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\r\SearchProtocolHost.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3fb851095cc978d4\f\wmprph.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\PhishSite_Iframe.htm 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\hololensDiagnostics.html 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\http_400.htm 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\404.htm 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File opened for modification C:\Windows\config.json 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.19041.264_none_c765d8a6c76ec25f\f\DataExchangeHost.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_6c7de5b30e8f6071\f\BackgroundTransferHost.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\PhishSite_Iframe.htm 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\http_400.htm 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_ffd303094ff1fe66\auditpol.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\startfresh.html 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.19041.1266_none_e6ebbe2a02425392\autopilotespprogress-main.html 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\500-13.htm 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.746_none_c291aefd01a5d6d6\r\EoAExperiences.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\r\sftp.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.1_none_f53047daaa565a5e\dllhost.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\retailDemoAdmin.html 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_ec5eb439471de957\r\cleanmgr.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.746_none_eaf7a50dc46d5592\f\Utilman.exe 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\navcancl.htm 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\413-1.htm 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
05f5f145e4315071a235573af9a440d2_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
05f5f145e4315071a235573af9a440d2_JaffaCakes118.exesvchost.exedescription pid process Token: SeDebugPrivilege 5044 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe Token: 33 5044 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 5044 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1240 svchost.exe Token: SeLockMemoryPrivilege 1240 svchost.exe Token: SeLockMemoryPrivilege 1240 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
05f5f145e4315071a235573af9a440d2_JaffaCakes118.exepid process 5044 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
05f5f145e4315071a235573af9a440d2_JaffaCakes118.exedescription pid process target process PID 5044 wrote to memory of 1240 5044 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe svchost.exe PID 5044 wrote to memory of 1240 5044 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
05f5f145e4315071a235573af9a440d2_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05f5f145e4315071a235573af9a440d2_JaffaCakes118.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeFilesize
11.5MB
MD53cd387992f5baf05c7a5cedb21695b97
SHA17c7157c2350607fa35f36f94b5d7bb86fe2ae571
SHA25622fde318eb09b5b3709b2660508e58834de17af83711fa77abf5155e42a53e06
SHA51260b636bcd3932b8912b76b0b95e0ced1d4509d863a2e82731965aeb00d08000bdf5d7573124c8bb6c19a4bbc60a15ad7f38b2d80fc30d36b6dd8ef55d8e04dad
-
C:\Windows\config.jsonFilesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
C:\vcredist2010_x86.log.htmlFilesize
81KB
MD57627a61b867b4d2da0e79bad2b282352
SHA191d1993d7ded2455d42354a0103a8af19124138b
SHA2564bc895e0f1b367200833217226968606339d153d5f2664e1f41f9c8aac130231
SHA5123c1c8000a54038c94604fb64a5038f4b0edb10e5d76fe59e2fd1673dba837f627a586b5790ae32047db143e9ca3fc50ce2b79a8cde17dd4db030f5f7270f3a4f
-
memory/1240-419-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1240-542-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1240-396-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1240-407-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1240-546-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1240-426-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1240-463-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1240-392-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1240-540-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1240-541-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1240-394-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1240-543-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1240-544-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/1240-545-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/5044-0-0x0000000000400000-0x0000000000613000-memory.dmpFilesize
2.1MB