796f6164a7e8c17565f7f76c6c06bc4b4e3544a5a414ab3efb1811671ad51125

General

Target

63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Size

405KB
MD5

63ab52937c3c1c9393181ef4ae32a1e9
SHA1

22a397899a23ab43227ef5ca89141065b26e251c
SHA256

796f6164a7e8c17565f7f76c6c06bc4b4e3544a5a414ab3efb1811671ad51125
SHA512

e58fe5f2ee6bc59eaa295856e3a13c425e6ba1a35a42685872c26a4d6aec525179bcaf55a92f3eaa356792cc276eda7ae50b1376b2283043a2d0eb158e124a76
SSDEEP

6144:NHajM693leP42YvYLo+naiSVBQddhOihH30XidU0DCzncwF0Q7JY+7:Nmp9V4CA1IBOoidU0DCovQ7JD7

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

pid process

1520 63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
3540 63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1520	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
3540	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

Modifies registry class 64 IoCs

Processes:

63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe\""	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\TypeLib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\TypeLib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\FLAGS	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\App\CurVer\ = "App.1"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\App	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\ = "Inst Class"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\ProgID	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\TypeLib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\ProgID	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\TypeLib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\App.1	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\FLAGS	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\Version\ = "1.0"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\TypeLib\Version = "1.0"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\TypeLib\ = "{fad27121-f3ee-42c7-8b77-7d72e4c385e3}"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\ = "InstallerLib"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\App.1\CLSID	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\App	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\App\CurVer	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\TypeLib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\ = "Inst Class"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\0\win32	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\ = "IBoot"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe:typelib"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\TypeLib\Version = "1.0"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\ = "IBoot"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\TypeLib\Version = "1.0"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\0\win32	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\ProxyStubClsid32	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\ProxyStubClsid32	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\ProgID	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\ = "InstallerLib"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\ProgID\ = "App.1"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\App\CurVer\ = "App.1"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\FLAGS\ = "0"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\TypeLib\ = "{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\TypeLib\Version = "1.0"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\TypeLib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\TypeLib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\0	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\ = "InstallerLib"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\ProgID	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\App	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\TypeLib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\HELPDIR	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\VersionIndependentProgID	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\App.1\CLSID	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E8734BB5-FFD7-464D-A4C3-FD9E1659AEA1}\1.0\0	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F86EF831-4042-41D3-937F-960DC8A0A474}\TypeLib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\Programmable	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a8209e29-7b58-4221-b286-c4e149014119}\LocalServer32	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

NTFS ADS 3 IoCs

Processes:

63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe:typelib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe:typelib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe:typelib	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

pid	process
5112	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
1520	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
3540	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

pid	process
5112	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
5112	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
1520	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
1520	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
3540	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
3540	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

description	pid	process	target process
PID 5112 wrote to memory of 1520	5112	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 5112 wrote to memory of 1520	5112	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 5112 wrote to memory of 1520	5112	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 1520 wrote to memory of 3540	1520	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 1520 wrote to memory of 3540	1520	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
PID 1520 wrote to memory of 3540	1520	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe	63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe" /retrynav 1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe" /retrynav 2
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - NTFS ADS
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe

Filesize
405KB

MD5
63ab52937c3c1c9393181ef4ae32a1e9

SHA1
22a397899a23ab43227ef5ca89141065b26e251c

SHA256
796f6164a7e8c17565f7f76c6c06bc4b4e3544a5a414ab3efb1811671ad51125

SHA512
e58fe5f2ee6bc59eaa295856e3a13c425e6ba1a35a42685872c26a4d6aec525179bcaf55a92f3eaa356792cc276eda7ae50b1376b2283043a2d0eb158e124a76

Download Submit
C:\Users\Admin\AppData\Local\Temp\63ab52937c3c1c9393181ef4ae32a1e9_JaffaCakes118.exe:typelib

Filesize
8KB

MD5
8f77ee287c7cccd7d478207fa260d963

SHA1
032bb96722ca145e8cf9d12990b12aa53c587b03

SHA256
2a27352e668ff707e086a401f7880248337845138749bfcbb1961562459d23f4

SHA512
ed8b33f406bde2a1e85d713b5ed195529bfb0eadd72974a7c5a78c1a5ea6f02824bd99beda66e118262596cf4688a73625ce301f5e038509b72f89eee2ec9d01

Download Submit
memory/1520-65-0x0000000001850000-0x0000000001923000-memory.dmp

Filesize
844KB

Download
memory/1520-31-0x0000000001850000-0x0000000001923000-memory.dmp

Filesize
844KB

Download
memory/1520-38-0x0000000001850000-0x0000000001923000-memory.dmp

Filesize
844KB

Download
memory/1520-40-0x0000000001850000-0x0000000001923000-memory.dmp

Filesize
844KB

Download
memory/1520-50-0x0000000001850000-0x0000000001923000-memory.dmp

Filesize
844KB

Download
memory/1520-56-0x0000000001850000-0x0000000001923000-memory.dmp

Filesize
844KB

Download
memory/1520-49-0x0000000001850000-0x0000000001923000-memory.dmp

Filesize
844KB

Download
memory/1520-60-0x0000000001850000-0x0000000001923000-memory.dmp

Filesize
844KB

Download
memory/1520-43-0x0000000003490000-0x0000000003491000-memory.dmp

Filesize
4KB

Download
memory/1520-36-0x0000000001850000-0x0000000001923000-memory.dmp

Filesize
844KB

Download
memory/3540-82-0x0000000001D40000-0x0000000001E13000-memory.dmp

Filesize
844KB

Download
memory/3540-70-0x0000000001D40000-0x0000000001E13000-memory.dmp

Filesize
844KB

Download
memory/3540-68-0x0000000001D40000-0x0000000001E13000-memory.dmp

Filesize
844KB

Download
memory/3540-72-0x0000000001D40000-0x0000000001E13000-memory.dmp

Filesize
844KB

Download
memory/3540-64-0x0000000001D40000-0x0000000001E13000-memory.dmp

Filesize
844KB

Download
memory/3540-89-0x0000000001D40000-0x0000000001E13000-memory.dmp

Filesize
844KB

Download
memory/3540-81-0x0000000001D40000-0x0000000001E13000-memory.dmp

Filesize
844KB

Download
memory/3540-80-0x0000000001D40000-0x0000000001E13000-memory.dmp

Filesize
844KB

Download
memory/3540-85-0x0000000001D40000-0x0000000001E13000-memory.dmp

Filesize
844KB

Download
memory/5112-1-0x0000000001690000-0x0000000001763000-memory.dmp

Filesize
844KB

Download
memory/5112-6-0x0000000001690000-0x0000000001763000-memory.dmp

Filesize
844KB

Download
memory/5112-7-0x0000000001690000-0x0000000001763000-memory.dmp

Filesize
844KB

Download
memory/5112-0-0x0000000001690000-0x0000000001763000-memory.dmp

Filesize
844KB

Download
memory/5112-33-0x0000000001690000-0x0000000001763000-memory.dmp

Filesize
844KB

Download
memory/5112-29-0x0000000001690000-0x0000000001763000-memory.dmp

Filesize
844KB

Download
memory/5112-25-0x0000000001690000-0x0000000001763000-memory.dmp

Filesize
844KB

Download
memory/5112-18-0x0000000001690000-0x0000000001763000-memory.dmp

Filesize
844KB

Download
memory/5112-17-0x0000000001690000-0x0000000001763000-memory.dmp

Filesize
844KB

Download
memory/5112-11-0x0000000003660000-0x0000000003661000-memory.dmp

Filesize
4KB

Download
memory/5112-4-0x0000000001690000-0x0000000001763000-memory.dmp

Filesize
844KB

Download
memory/5112-8-0x0000000001690000-0x0000000001763000-memory.dmp

Filesize
844KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads