neshta | d72f1acfba1f393e29a4ac30efd9695fb8745e3a0daf79a5576315fe51e320ae

General

Target

3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
Size

6.9MB
MD5

3e444cae2920f0c4791ea7784535a81b
SHA1

e98a03b13a139dea0eaa7d27748d117fddcef05c
SHA256

d72f1acfba1f393e29a4ac30efd9695fb8745e3a0daf79a5576315fe51e320ae
SHA512

3a5e68e8722ad2db86d4f1230233653bbfa077f4c7948ac7691e72cb9b4a6eaa76bb5b0925d8d80f48c72e332809cbacbcbd3ef1ab849d042ad4bf7dd5e0fef1
SSDEEP

98304:FlerjesRJ8YQU/e51qXot5nPOY5wAstsFeZ8ocNND5qz5:urj578YQP1qXotFPzKmFeL/z

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 1 IoCs

Processes:

resource	yara_rule
C:\905c0769f9a06c95a24ddf945\patcher.exe$	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

Processes:

3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\IME\IMEJP10\IMJPUEX.EXE	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\autochk.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\userinit.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\convert.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\doskey.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ftp.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\OptionalFeatures.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\typeperf.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\certutil.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\newdev.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\psr.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DevicePairingWizard.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\hdwwiz.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SystemPropertiesProtection.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\migwiz.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ComputerDefaults.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DWWIN.EXE	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\expand.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fsutil.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\netiougc.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\prevhost.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\taskkill.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\cttune.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\relog.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\shutdown.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\winrs.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\bootcfg.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\calc.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\compact.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\iscsicli.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\RpcPing.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\setupSNK.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\cmmon32.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\logagent.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ntprint.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\TpmInit.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\user.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\AdapterTroubleshooter.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\InfDefaultInstall.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SyncHost.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\mighost.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sethc.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\xwizard.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\IME\IMEJP10\IMJPMGR.EXE	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\label.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\powercfg.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rundll32.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\autofmt.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dplaysvr.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dxdiag.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\schtasks.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\setup16.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\winver.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\charmap.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WerFaultSecure.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ktmutil.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mcbuilder.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dllhst3g.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\RMActivate.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sdchange.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sort.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ARP.EXE	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\grpconv.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

Processes:

3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\bin\jp2launcher.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\unpack200.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\WMPSideShowGadget.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jabswitch.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\keytool.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

Processes:

3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..eoptionalcomponents_31bf3856ad364e35_11.2.9600.16428_none_e410f56f6c4ee930\ConfigureIEOptionalComponents.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\aspnetca.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_18a11c58aaf4d08c\MigAutoPlay.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_6.1.7600.16385_none_1cc9274696810e2f\wevtutil.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_c79aef32ab85d92b\cmdl32.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-convert_31bf3856ad364e35_6.1.7601.17514_none_9edcb4a706944d0a\convert.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_6.1.7601.17514_none_1202940e4711971e\plasrv.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_bd4644e077251730\cmstp.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24_newdev.exe_7eb73dcd	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281#\df459c0a2762c33e0699703f186b1751\Microsoft.Workflow.Compiler.ni.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_6.1.7601.17514_none_9757fd443892abe7\inetinfo.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\SvcIni.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_6.1.7601.17514_none_df46d976c8a5880b\InetMgr6.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..executionprevention_31bf3856ad364e35_6.1.7600.16385_none_25d85b4a3e4a7709\SystemPropertiesDataExecutionPrevention.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_6.1.7601.17514_none_c910d80f114e267a_vdsldr.exe_20c491b3	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\ehexthost32.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_6.1.7600.16385_none_2370c162e00680c3\Defrag.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-cipher_31bf3856ad364e35_6.1.7600.16385_none_090b7101bec9a9e2\cipher.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-networkprojection_31bf3856ad364e35_6.1.7600.16385_none_3fbc74d90a6e33f8\NetProj.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_netfx-jsc_b03f5f7f11d50a3a_6.1.7600.16385_none_14e6e9dab736481d\jsc.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_6.1.7600.16385_none_9edabb9befc6e697\powershell_ise.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_6.1.7601.17514_none_8375605f8afb0c19\wmlaunch.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\dfsvc.ni.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_ef38a8d0d05cc2c7\IMJPUEX.EXE	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..erinboxgames-spades_31bf3856ad364e35_6.1.7600.16385_none_6fa6d7361acba514\shvlzm.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..otservicing-utility_31bf3856ad364e35_6.1.7600.16385_none_d139a2cea567ce3f\fveupdate.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_6.1.7601.17514_none_7d0125c85cc31d2a\rdpinit.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-international-core_31bf3856ad364e35_6.1.7601.17514_none_ebb1ce7438031941_muiunattend.exe_1e11bb40	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad\perfhost.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_6.1.7601.17514_none_cb4d60191a09a7b0\PresentationSettings.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..-downlevel.binaries_31bf3856ad364e35_6.3.9600.16428_none_5faf8886ff3d65d0\MsSpellCheckingFacility.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ehome-wtvconverter_31bf3856ad364e35_6.1.7600.16385_none_a8464accb5a91f59\WTVConverter.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7601.17514_none_dfe02de35bf41e0b\PrintBrmEngine.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.1.7600.16385_none_f9257e7aaa4290ce\ctfmon.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-certutil_31bf3856ad364e35_6.1.7600.16385_none_b55b5e1094b0283d\certutil.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_6.1.7600.16385_none_1ddb4b87a6618437\chkdsk.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-d..s-ime-japanese-core_31bf3856ad364e35_6.1.7600.16385_none_d5b4f96cdbb9a8b1\IMJPDSVR.EXE	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_6.1.7601.17514_none_a7a77a3b9cb96ce6\msiexec.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_6.1.7601.17514_none_a505d556c9de886a_rstrui.exe_dfa7225b	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-time-tool_31bf3856ad364e35_6.1.7600.16385_none_48fe0cfd559f80ad\w32tm.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ehome-devices-mcrmgr_31bf3856ad364e35_6.1.7600.16385_none_901eda10f3ab38d2\McrMgr.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_6bcef05d7f04260a\rasautou.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_caspol_b03f5f7f11d50a3a_6.1.7601.17514_none_f885d1129806720d\CasPol.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_18a11c58aaf4d08c\PostMig.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\ehexthost\6.1.0.0__31bf3856ad364e35\ehexthost.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe$	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe

NTFS ADS 1 IoCs

Processes:

3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe

pid process

2080 3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe

pid	process
2080	3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e444cae2920f0c4791ea7784535a81b_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2080

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\905c0769f9a06c95a24ddf945\patcher.exe$
Filesize
6.9MB

MD5
3e444cae2920f0c4791ea7784535a81b

SHA1
e98a03b13a139dea0eaa7d27748d117fddcef05c

SHA256
d72f1acfba1f393e29a4ac30efd9695fb8745e3a0daf79a5576315fe51e320ae

SHA512
3a5e68e8722ad2db86d4f1230233653bbfa077f4c7948ac7691e72cb9b4a6eaa76bb5b0925d8d80f48c72e332809cbacbcbd3ef1ab849d042ad4bf7dd5e0fef1

Download Submit
memory/2080-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads