Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29-04-2024 08:46
Behavioral task
behavioral1
Sample
07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe
-
Size
6.2MB
-
MD5
07438735f75ce5d817e074a76c5e036b
-
SHA1
23daf57bcd0ceaa97721cc1b1a8dfb853974fe0c
-
SHA256
6bbfd2f46b3c14bc298960de2f1564c4b9a04c937cbbba65867a764380310fa4
-
SHA512
dfd6c0a4ebaecead1acccfe0157c7156b98d24cb03fcd5db245c739c521ff2373d66fa63e36dc67c5379c25f1c3eaf3e05597c173eafa6c135402bd27d03f78a
-
SSDEEP
98304:FlerjesRJ8YQU/IgNQ2wZPO2YOXwnS4rVjwIDQ:urj578YQXPiIruQ
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 1 IoCs
Processes:
resource yara_rule behavioral2/files/0x00070000000006cf-8.dat family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exedescription ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exedescription ioc Process File opened for modification C:\Windows\SysWOW64\iscsicpl.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Magnify.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mountvol.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\charmap.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\certreq.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\printui.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\UserAccountControlSettings.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wusa.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bootcfg.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\EhStorAuthn.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\eventcreate.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\odbcconf.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SearchProtocolHost.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\shutdown.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wscadminui.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\backgroundTaskHost.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\BackgroundTransferHost.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bthudtask.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\calc.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dllhost.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\eudcedit.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\iscsicli.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sdiagnhost.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ftp.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ieUnatt.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\hh.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\LaunchTM.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\timeout.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\colorcpl.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Fondue.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\odbcad32.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\PresentationHost.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\regini.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SecEdit.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\takeown.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\getmac.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\icacls.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\w32tm.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mtstocom.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\credwiz.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msfeedssync.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\powercfg.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RdpSaProxy.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sdchange.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setup.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\CloudNotifications.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\winver.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Com\MigRegDB.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cleanmgr.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tttracer.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WSManHTTPConfig.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\GamePanel.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\NETSTAT.EXE 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exedescription ioc Process File created C:\Program Files\Java\jdk-1.8\bin\java.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{4EF9C35E-DC0D-40E1-941D-AB9119298CDF}\chrome_installer.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exedescription ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe -
NTFS ADS 1 IoCs
Processes:
07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exedescription ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exepid Process 824 07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\07438735f75ce5d817e074a76c5e036b_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.2MB
MD507438735f75ce5d817e074a76c5e036b
SHA123daf57bcd0ceaa97721cc1b1a8dfb853974fe0c
SHA2566bbfd2f46b3c14bc298960de2f1564c4b9a04c937cbbba65867a764380310fa4
SHA512dfd6c0a4ebaecead1acccfe0157c7156b98d24cb03fcd5db245c739c521ff2373d66fa63e36dc67c5379c25f1c3eaf3e05597c173eafa6c135402bd27d03f78a