796f6164a7e8c17565f7f76c6c06bc4b4e3544a5a414ab3efb1811671ad51125

General

Target

63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Size

405KB
MD5

63ab52937c3c1c9393181ef4ae32a1e9
SHA1

22a397899a23ab43227ef5ca89141065b26e251c
SHA256

796f6164a7e8c17565f7f76c6c06bc4b4e3544a5a414ab3efb1811671ad51125
SHA512

e58fe5f2ee6bc59eaa295856e3a13c425e6ba1a35a42685872c26a4d6aec525179bcaf55a92f3eaa356792cc276eda7ae50b1376b2283043a2d0eb158e124a76
SSDEEP

6144:NHajM693leP42YvYLo+naiSVBQddhOihH30XidU0DCzncwF0Q7JY+7:Nmp9V4CA1IBOoidU0DCovQ7JD7

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

pid process

2744 63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
2928 63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

pid	process
2744	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
2928	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

Loads dropped DLL 4 IoCs

Processes:

63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

pid	process
3056	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
3056	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
2744	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
2744	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

Processes:

63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\App\CurVer	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\App\CurVer\ = "App.1"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\TypeLib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\0\win32	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\LocalServer32	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\Version\ = "1.0"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\TypeLib\ = "{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\TypeLib\ = "{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\TypeLib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\LocalServer32	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\LocalServer32	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\TypeLib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\App	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\Programmable	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\App.1\CLSID	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\HELPDIR	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\App.1	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\App\CurVer\ = "App.1"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\VersionIndependentProgID	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe:typelib"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\TypeLib\ = "{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\FLAGS	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\FLAGS\ = "0"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\VersionIndependentProgID	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\0\win32	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\FLAGS	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\ProgID\ = "App.1"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\ = "InstallerLib"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\TypeLib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\App\CurVer\ = "App.1"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\TypeLib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\0\win32	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\HELPDIR	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\App.1\ = "Inst Class"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\VersionIndependentProgID	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\VersionIndependentProgID\ = "App"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\App.1\CLSID	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\TypeLib\ = "{fad27121-f3ee-42c7-8b77-7d72e4c385e3}"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\TypeLib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\App	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\App	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\0	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\TypeLib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\App\ = "Inst Class"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\Programmable	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\ProgID	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\TypeLib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\Programmable	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\ = "IBoot"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

NTFS ADS 3 IoCs

Processes:

63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe:typelib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe:typelib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe:typelib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

pid	process
3056	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
2744	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
2928	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

pid	process
3056	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
3056	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
2744	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
2744	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
2928	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
2928	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

description	pid	process	target process
PID 3056 wrote to memory of 2744	3056	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 3056 wrote to memory of 2744	3056	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 3056 wrote to memory of 2744	3056	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 3056 wrote to memory of 2744	3056	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 3056 wrote to memory of 2744	3056	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 3056 wrote to memory of 2744	3056	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 3056 wrote to memory of 2744	3056	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 2744 wrote to memory of 2928	2744	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 2744 wrote to memory of 2928	2744	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 2744 wrote to memory of 2928	2744	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 2744 wrote to memory of 2928	2744	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 2744 wrote to memory of 2928	2744	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 2744 wrote to memory of 2928	2744	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 2744 wrote to memory of 2928	2744	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe" /retrynav 1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe" /retrynav 2
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - NTFS ADS
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe:typelib

Filesize
8KB

MD5
8f77ee287c7cccd7d478207fa260d963

SHA1
032bb96722ca145e8cf9d12990b12aa53c587b03

SHA256
2a27352e668ff707e086a401f7880248337845138749bfcbb1961562459d23f4

SHA512
ed8b33f406bde2a1e85d713b5ed195529bfb0eadd72974a7c5a78c1a5ea6f02824bd99beda66e118262596cf4688a73625ce301f5e038509b72f89eee2ec9d01

Download Submit
\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

Filesize
405KB

MD5
63ab52937c3c1c9393181ef4ae32a1e9

SHA1
22a397899a23ab43227ef5ca89141065b26e251c

SHA256
796f6164a7e8c17565f7f76c6c06bc4b4e3544a5a414ab3efb1811671ad51125

SHA512
e58fe5f2ee6bc59eaa295856e3a13c425e6ba1a35a42685872c26a4d6aec525179bcaf55a92f3eaa356792cc276eda7ae50b1376b2283043a2d0eb158e124a76

Download Submit
memory/2744-72-0x0000000000850000-0x0000000000923000-memory.dmp

Filesize
844KB

Download
memory/2744-64-0x0000000000850000-0x0000000000923000-memory.dmp

Filesize
844KB

Download
memory/2744-41-0x0000000000850000-0x0000000000923000-memory.dmp

Filesize
844KB

Download
memory/2744-54-0x0000000000850000-0x0000000000923000-memory.dmp

Filesize
844KB

Download
memory/2744-42-0x0000000000850000-0x0000000000923000-memory.dmp

Filesize
844KB

Download
memory/2744-53-0x0000000000850000-0x0000000000923000-memory.dmp

Filesize
844KB

Download
memory/2744-68-0x0000000000850000-0x0000000000923000-memory.dmp

Filesize
844KB

Download
memory/2744-45-0x0000000000850000-0x0000000000923000-memory.dmp

Filesize
844KB

Download
memory/2744-35-0x0000000000850000-0x0000000000923000-memory.dmp

Filesize
844KB

Download
memory/2928-76-0x0000000000890000-0x0000000000963000-memory.dmp

Filesize
844KB

Download
memory/2928-78-0x0000000000890000-0x0000000000963000-memory.dmp

Filesize
844KB

Download
memory/2928-80-0x0000000000890000-0x0000000000963000-memory.dmp

Filesize
844KB

Download
memory/2928-93-0x0000000000890000-0x0000000000963000-memory.dmp

Filesize
844KB

Download
memory/2928-91-0x0000000000890000-0x0000000000963000-memory.dmp

Filesize
844KB

Download
memory/2928-89-0x0000000000890000-0x0000000000963000-memory.dmp

Filesize
844KB

Download
memory/2928-88-0x0000000000890000-0x0000000000963000-memory.dmp

Filesize
844KB

Download
memory/2928-90-0x0000000000890000-0x0000000000963000-memory.dmp

Filesize
844KB

Download
memory/3056-1-0x0000000000580000-0x0000000000653000-memory.dmp

Filesize
844KB

Download
memory/3056-37-0x0000000000580000-0x0000000000653000-memory.dmp

Filesize
844KB

Download
memory/3056-0-0x0000000000580000-0x0000000000653000-memory.dmp

Filesize
844KB

Download
memory/3056-31-0x0000000000580000-0x0000000000653000-memory.dmp

Filesize
844KB

Download
memory/3056-27-0x0000000000580000-0x0000000000653000-memory.dmp

Filesize
844KB

Download
memory/3056-7-0x0000000000580000-0x0000000000653000-memory.dmp

Filesize
844KB

Download
memory/3056-18-0x0000000000580000-0x0000000000653000-memory.dmp

Filesize
844KB

Download
memory/3056-17-0x0000000000580000-0x0000000000653000-memory.dmp

Filesize
844KB

Download
memory/3056-11-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/3056-4-0x0000000000580000-0x0000000000653000-memory.dmp

Filesize
844KB

Download
memory/3056-5-0x0000000000580000-0x0000000000653000-memory.dmp

Filesize
844KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads