neshta | d8e35bebda7d6e36a75fddd67dc1f471f0cbe7dbd49f0020a6f3f057b95dd9f1

General

Target

3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
Size

4.5MB
MD5

3c023fe3610175309e314dce46858a49
SHA1

b581f1d07deae9622dfff5c956f5b0741d92c46a
SHA256

d8e35bebda7d6e36a75fddd67dc1f471f0cbe7dbd49f0020a6f3f057b95dd9f1
SHA512

46d7d1d8c51b48e55aa7f7af04b81e6217b1f1eb2d80d8c8d712105618fc0d91e2136f4b545508820416cf19c74542dfdc25865eeef7dc2f877f72307e9fe262
SSDEEP

49152:Fl/ijN5j2Xsl3RJ3LHobUQDgok30f51qkyHIVaqeZkYce4OyCPOQm9F8v:FlerjesRJ8YQU/e51q0V8ZdPOQW8v

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 1 IoCs

Processes:

resource	yara_rule
C:\905c0769f9a06c95a24ddf945\patcher.exe$	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

3c023fe3610175309e314dce46858a49_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

3c023fe3610175309e314dce46858a49_JaffaCakes118.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 3c023fe3610175309e314dce46858a49_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

Processes:

3c023fe3610175309e314dce46858a49_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\IME\IMEJP10\IMJPDCT.EXE	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\autochk.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Dism.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\help.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rdrleakdiag.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rundll32.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\tcmsetup.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\timeout.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\w32tm.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\cliconfg.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\netsh.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Robocopy.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\waitfor.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wevtutil.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\PresentationHost.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SearchProtocolHost.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\cttune.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mcbuilder.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ndadmin.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drvinst.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\PATHPING.EXE	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dnscacheugc.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DpiScaling.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\EhStorAuthn.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sdbinst.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SetIEInstalledDate.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wlanext.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\net.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xcopy.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\newdev.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\notepad.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\printui.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\shutdown.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\logman.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wscript.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wbem\WinMgmt.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dllhost.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fltMC.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\OptionalFeatures.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\pcaui.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\typeperf.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\winrs.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dpapimig.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\iexpress.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MigAutoPlay.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mobsync.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\regini.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wuapp.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\at.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ctfmon.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mountvol.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\print.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wiaacmgr.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ktmutil.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\reg.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\TCPSVCS.EXE	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\cttunesvr.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\efsui.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\hdwwiz.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\secinit.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SystemPropertiesHardware.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

Processes:

3c023fe3610175309e314dce46858a49_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jabswitch.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Defender\MSASCui.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

Processes:

3c023fe3610175309e314dce46858a49_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\winsxs\amd64_netfx-dw_b03f5f7f11d50a3a_6.1.7600.16385_none_5a768666c3091014\dw20.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_64\SMSvcHost\0b4d4e172e8054cb61d27f5ab9e0e445\SMSvcHost.ni.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-fax-service_31bf3856ad364e35_6.1.7601.17514_none_0b499f2c96e8f6b2\FXSSVC.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-write_31bf3856ad364e35_6.1.7600.16385_none_bb77c3d6f6c8e3f6\write.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\1bc1ee3c3aa45d28dcf4657bceb2fcb4\SMSvcHost.ni.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_6.1.7600.16385_none_74b76d3fa1757c6f\chkntfs.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_6.1.7601.17514_none_fa8534ab236134c4\rrinstaller.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-mountvol_31bf3856ad364e35_6.1.7600.16385_none_0e4e6b146b2452a9\mountvol.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\dfsvc\261c09179eae03d67c9b6f3e70b603bd\dfsvc.ni.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ie-pdm_31bf3856ad364e35_8.0.7600.16385_none_6425238b793ee910\PDMSetup.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedt32.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_netfx35linq-edmgen_31bf3856ad364e35_6.1.7601.17514_none_0ca1fd81527e1e9a\EdmGen.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\ComSvcConfig\9a69a26417a09c2d9d7f67bf7592bd74\ComSvcConfig.ni.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ConvertInkStore.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_177a088436382a34\WmiApSrv.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ehome-mcspad_31bf3856ad364e35_6.1.7600.16385_none_bd8c328b84ea0fba\mcspad.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..inboxgames-shanghai_31bf3856ad364e35_6.1.7600.16385_none_1c98ed5d08db04ce\Mahjong.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\MRINFO.EXE	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\replace.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_6.1.7601.17514_none_fed8c13f0d90a8cf\WinMgmt.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..xing-service-server_31bf3856ad364e35_6.1.7601.17514_none_0db5e5844ed6ffe9\CISVC.EXE	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\cagicon.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-deployment_31bf3856ad364e35_6.1.7600.16385_none_57e3e87206ff08ca\setupugc.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_6.1.7600.16385_none_a9b5c1d91f03e0b4\RelPost.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\Narrator.ni.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gettingstarted_31bf3856ad364e35_6.1.7600.16385_none_dc7256ed0ded6c12\GettingStarted.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..inboxgames-freecell_31bf3856ad364e35_6.1.7600.16385_none_b466b741b68bd29a\FreeCell.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_6.1.7600.16385_none_8733bee404f7386c\sfc.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_6.1.7600.16385_none_851e6308c5b62529\quser.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\mcupdate\f30beba36940b5a2b55a32ea7f42d694\mcupdate.ni.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost\e88db1688b08fbb889b0b9d4b1a51493\SMSvcHost.ni.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..g-xpsdocumentwriter_31bf3856ad364e35_6.1.7601.17514_none_80fea45979a5d3f2\MxdwGc.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\dfsvc\261c09179eae03d67c9b6f3e70b603bd\dfsvc.ni.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\ehome\mcGlidHost.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-control_31bf3856ad364e35_6.1.7600.16385_none_f560eae4c42edb14\control.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_6.1.7600.16385_none_3157c24b5944e2a3\eventcreate.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_6.1.7600.16385_none_2874ea220a5507fd\wiawow64.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\ehexthost32.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-setup-component_31bf3856ad364e35_6.1.7601.17514_none_905283bdc3e1d2d8\windeploy.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\ehome\ehtray.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_aspnet_regsql_b03f5f7f11d50a3a_6.1.7600.16385_none_dcb42ec76404494f\aspnet_regsql.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-corruptedfilerecovery_31bf3856ad364e35_6.1.7600.16385_none_e3aea9874278550c\cofire.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\c899de3549784161aa66610d5735e4f0\ehExtHost32.ni.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe$	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\chgport.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_6.1.7601.17514_none_fa2fc39ab7937a51\perfmon.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104\sdbinst.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.5.7601.17514_none_1f3413afc64d10c5\wuauclt.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_6.1.7601.17514_none_b5ac5cc3a1b7e9ef\BitLockerWizard.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_6.1.7600.16385_none_3142c61b8ada510f\ReAgentc.exe	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe

NTFS ADS 1 IoCs

Processes:

3c023fe3610175309e314dce46858a49_JaffaCakes118.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3c023fe3610175309e314dce46858a49_JaffaCakes118.exe

pid process

1628 3c023fe3610175309e314dce46858a49_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe

pid	process
1628	3c023fe3610175309e314dce46858a49_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3c023fe3610175309e314dce46858a49_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c023fe3610175309e314dce46858a49_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1628

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\905c0769f9a06c95a24ddf945\patcher.exe$
Filesize
4.5MB

MD5
3c023fe3610175309e314dce46858a49

SHA1
b581f1d07deae9622dfff5c956f5b0741d92c46a

SHA256
d8e35bebda7d6e36a75fddd67dc1f471f0cbe7dbd49f0020a6f3f057b95dd9f1

SHA512
46d7d1d8c51b48e55aa7f7af04b81e6217b1f1eb2d80d8c8d712105618fc0d91e2136f4b545508820416cf19c74542dfdc25865eeef7dc2f877f72307e9fe262

Download Submit
memory/1628-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads