Analysis
-
max time kernel
127s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 11:53
Behavioral task
behavioral1
Sample
29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe
-
Size
23.0MB
-
MD5
29d9c97457e3431b6153e11761aef0f1
-
SHA1
358cffe25d2808a2acf4c6e0eb7d63fb914bfcab
-
SHA256
847ed67674022766fce058d4a17692f53e18d96aca7989a3797689b77a6f17b9
-
SHA512
30ba141c34d20c4209740d4768dc769bf5cd406fc4e6c6dcb76f16840c5b128adc1223f6738d1a3353dbc55365ed84b2c88c2a3219df5e0896539d693e92440e
-
SSDEEP
393216:TFgRYBzyzPpe1vDll/yzPpeb1wFgRYBzyzPpe1vDll/yzPpeb1mRu:dzyT6vDll/yTFzyT6vDll/yTs
Malware Config
Signatures
-
Detect Blackmoon payload 4 IoCs
resource yara_rule behavioral2/memory/4356-0-0x0000000000400000-0x0000000000619000-memory.dmp family_blackmoon behavioral2/files/0x0001000000021575-67.dat family_blackmoon behavioral2/memory/4356-391-0x0000000000400000-0x0000000000619000-memory.dmp family_blackmoon behavioral2/memory/4356-528-0x0000000000400000-0x0000000000619000-memory.dmp family_blackmoon -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe -
XMRig Miner payload 19 IoCs
resource yara_rule behavioral2/memory/4356-0-0x0000000000400000-0x0000000000619000-memory.dmp xmrig behavioral2/files/0x000a00000002339c-7.dat xmrig behavioral2/files/0x0001000000021575-67.dat xmrig behavioral2/memory/4848-263-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4848-387-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4356-391-0x0000000000400000-0x0000000000619000-memory.dmp xmrig behavioral2/memory/4848-392-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4848-394-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4848-395-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4848-398-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4848-400-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4848-418-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4848-419-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4848-420-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4848-429-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4848-461-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4848-527-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4356-528-0x0000000000400000-0x0000000000619000-memory.dmp xmrig behavioral2/memory/4848-529-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe" 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe" 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe" 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe" 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe" 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe" 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4848 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/4356-0-0x0000000000400000-0x0000000000619000-memory.dmp upx behavioral2/files/0x0001000000021575-67.dat upx behavioral2/memory/4356-391-0x0000000000400000-0x0000000000619000-memory.dmp upx behavioral2/memory/4356-528-0x0000000000400000-0x0000000000619000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe" 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\OposHost.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrs.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\xwizard.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\ddodiag.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\fixmapi.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\gpupdate.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\secinit.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\wscript.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\bitsadmin.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\comp.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\dfrgui.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\RpcPing.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\sdchange.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\IEChooser.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\TpmInit.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\getmac.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\Magnify.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasdial.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\setup16.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\RmClient.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\wowreg32.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\cacls.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\edpnotify.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\net.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\prevhost.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\shutdown.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\mode.com 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\PATHPING.EXE 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\rekeywiz.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\auditpol.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\DpiScaling.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\find.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\GamePanel.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\reg.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\TpmTool.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\chkntfs.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\convert.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllhst3g.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\help.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\instnm.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\cttunesvr.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\sxstrace.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\TRACERT.EXE 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\sort.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\ttdinject.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\verclsid.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\DWWIN.EXE 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\finger.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\fsutil.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\mountvol.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\relog.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\wevtutil.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\doskey.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\mmc.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SysWOW64\pcaui.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\index.html 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.html 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\msapp-error.html 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_fefa067e67e7af8b\f\UserAccountBroker.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\pdferrorrenewrentallicense.html 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.746_none_ff52abd5cb47bbe1\lpksetup.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\r\NarratorQuickStart.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.19041.906_none_066336a1b904a848\f\taskhostw.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.15805.0_none_9959f3c5e4eeac5f\cvtres.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskraid_31bf3856ad364e35_10.0.19041.1_none_1b7ab1943757b81e\diskraid.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1266_none_ba0845abb58c8bdd\r\BioIso.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1151_none_71aa7fdbb41824a0\ShellExperienceHost.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\f\ScreenClipping\ScreenClippingHost.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.19041.1_none_cd1cbc8db3875f47\csc.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.746_none_bd9bc99304595128\r\ReAgentc.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\pdferrorofflineaccessdenied.html 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\pdferrorunknownerror.html 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_9e3e509d4c4881e1\MuiUnattend.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.19041.1202_none_fd57358454385601\CustomShellHost.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.19041.746_none_3ed4d566b640ef5b\r\WmsUserAgent.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVShNotify.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_1befc89391e44c23\r\autoconv.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\test.html 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\needhvsi.html 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.19041.746_none_c7a124154e1d7314\mtstocom.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.19041.1_none_1f29a4ae2c282494\winresume.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\AppVStreamingUX.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.19041.1_none_2e482ad4cee11ead\regsvr32.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.19041.1_none_d1fafd8eeb2a2637\SpeechUXWiz.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.19041.1_none_b6ba7fd85b54c477\efsui.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\pdferrormfnotfound.html 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\startfresh.html 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.84_none_2d21e26a18d595c7\f\directxdatabaseupdater.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.1_none_544850fb795d0a4f\phoneactivate.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_ef39acce2648e404\f\WerFaultSecure.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\msra.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\pdferrorrepurchasecontent.html 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_8636783e05df6f4e\r\ndadmin.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-adminservice_31bf3856ad364e35_10.0.19041.1_none_1058f7ab971a5799\WMSvc.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_7d1b4a535854fe42\r\quickassist.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\mode.com 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\r\explorer.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.19041.1_none_9f98e6cc8eabb4ca\mtstocom.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.19041.1151_none_21b291c4f7bdb6e0\nfsclnt.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\OfflineTabs.html 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\r\conhost.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1202_none_5b834788c0d17953\r\iexplore.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_presentationcore_31bf3856ad364e35_4.0.15805.110_none_d15861be869a7825\GlobalSansSerif.CompositeFont 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.746_none_3d198a3dbf54d1b4\cmstp.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_4.0.15805.0_none_c6dc1994db088235\CasPol.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\f\sdclt.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx4-machine_config_b03f5f7f11d50a3a_4.0.15805.0_none_8415fc268fb7cbd1\machine.config.comments 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_9202844cd514ab44\aspnet_compiler.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.264_none_62496caeba2daa52\nvspinfo.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\r\Microsoft.Uev.CscUnpinTool.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.746_none_3d198a3dbf54d1b4\cmmon32.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_908b22903a403149\f\ndadmin.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15805.0_none_be984aad4cfbc2f3\csc.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\r\phoneactivate.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\f\aspnetca.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.84_none_65d0f4a4c6cd4975\Magnify.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.264_none_b435e08254cda322\f\printui.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7a559100246cff2b\r\CloudNotifications.exe 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4356 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe Token: 33 4356 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4356 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4848 svchost.exe Token: SeLockMemoryPrivilege 4848 svchost.exe Token: SeLockMemoryPrivilege 4848 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4356 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4356 wrote to memory of 4848 4356 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe 84 PID 4356 wrote to memory of 4848 4356 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe 84 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\29d9c97457e3431b6153e11761aef0f1_JaffaCakes118.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4356 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4848
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25.2MB
MD586d9248bb7c669715ebac8783fd214ca
SHA104c13f3f6912bcdc0979f135b96f9529f47a2da1
SHA256ce39df4a76d2c770c848255457767dba05f1946bbf9e932da7de724d6b1debed
SHA512c2ca3ce63423aa9a794e3c3549f407d009521cf4eab2f6e6d18b019bdd1991a373446654a81c8a23c5536414981dad8ed23a8c7350f244b2deca033727fd8601
-
Filesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
Filesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
Filesize
81KB
MD529e845998d831249efa8959de1b9794c
SHA10c48b1b345857d50ddcada539e7d87cbe54d193f
SHA25686f61339177964ec40e2fca8ffb35582a26c51375d1451345b3b11ba6c8bb8be
SHA512b75ec808f27cbe0c9c5db226500f87511206b9a4dadd69b1ddaf8221ed36dc81aa89924e5457f2df01009da93d6257b1dff6a4c43d920190d3791fd1876b9bf8