Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 12:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe
-
Size
32KB
-
MD5
842edd2681b5dae1ebeaa989fb404741
-
SHA1
fecb8b5569a9a67ae3cade1daaa4456d033f07b7
-
SHA256
9833c15741f82e7e63ffa3ab295803cfc9ec650601de72e03627c24af69f307a
-
SHA512
f3474ef44bad342126d8fceaeafebe5ddec4bbabdbcd76abfc010b3cab464eea650c99edfeed662fc50da043d34a013da35b42ce47b1a2ba15564019c1279c93
-
SSDEEP
768:lCywql7JmQOsgC798kr86Hhba1P85HDS6wq3By:Lwql7JmQ9g7f6Hh+a3By
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ACLControl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ACLControl.exe" 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe -
Modifies WinLogon 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl\DllName = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ACLControl.exe" 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl\Impersonate = "0" 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl\Asynchronous = "1" 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl\Logon = "ACLLogon" 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Com\es-ES\comrepl.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\iexpress.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\fr-FR\IEChooser.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\iexpress.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\it-IT\mofcomp.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\XPSViewer\de-DE\XPSViewer.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\de-DE\comrepl.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\fr-FR\comrepl.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\fixmapi.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\eventvwr.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\sv-SE\quickassist.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Fondue.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\uk-UA\IEChooser.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\ieunatt.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\charmap.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\cmstp.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Dism.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\fixmapi.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\sk-SK\quickassist.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\es-ES\WMIC.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\dialer.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Fondue.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\csrss.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\nl-NL\quickassist.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\ru-RU\quickassist.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-GB\quickassist.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\bootcfg.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Fondue.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\cmstp.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\isoburn.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\explorer.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\el-GR\quickassist.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\de-DE\IEChooser.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\ieunatt.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\uk-UA\isoburn.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Dism.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\eudcedit.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\cmmon32.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mmc.exe.config 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\it-IT\MigRegDB.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\pt-PT\quickassist.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\XPSViewer\ja-JP\XPSViewer.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\charmap.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\tr-TR\quickassist.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\powershell.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\it-IT\IEChooser.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\fixmapi.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\charmap.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\GamePanel.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\uk-UA\charmap.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\bg-BG\quickassist.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\hh.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\dialer.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\ieunatt.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\ieunatt.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\he-IL\quickassist.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Fondue.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\at.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\eventvwr.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\hh.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\SysWOW64\uk-UA\iexpress.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\en-US\setup_wm.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\TabTip32.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\TabTip32.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\es-ES\wmpnscfg.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Windows Defender\it-IT\OfflineScannerShell.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\de-DE\ieinstal.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\telemetryrules\hxoutlook.exe_Rules.xml 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\TabTip32.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\en-US\wmplayer.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ja-JP\ieinstal.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\fr-FR\setup_wm.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\en-US\wmpnetwk.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\en-US\wmpnscfg.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe.config 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96109\javaw.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-winver.resources_31bf3856ad364e35_10.0.19041.1_de-de_27f0101638c29174\winver.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..tcmdtools.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_35a4233951b0fef5\mount.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..mmandline.resources_31bf3856ad364e35_10.0.19041.1_en-us_a468df5eaf47f134\tracerpt.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ovedevice.resources_31bf3856ad364e35_10.0.19041.1_de-de_cdcbe76da935a326\SystemSettingsRemoveDevice.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..y-webauth.resources_31bf3856ad364e35_10.0.19041.1_es-es_600ba9a741a3440a\AuthHost.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit.resources_31bf3856ad364e35_10.0.19041.1_en-us_fb569e49a9e4cc22\wininit.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.19041.1_es-es_8a83f8a2672d374c\mofcomp.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-v..skservice.resources_31bf3856ad364e35_10.0.19041.1_it-it_e4acb32056072b0a_vds.exe.mui_2268d934 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.19041.1_none_3067f23752280fbc\NetCfgNotifyObjectHost.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\r\CallingShellApp.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..baaupdate.resources_31bf3856ad364e35_10.0.19041.1_it-it_e5073b6f46b97c73\baaupdate.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wininit.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_9dd9712c9cddd429_wininit.exe.mui_997435f5 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sysinfo.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_536d5b68b2f1f47a\systeminfo.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..madvanced.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_8f3f9d5d59793b47\SystemPropertiesAdvanced.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1266_none_622873cfbda33994\f\convertvhd.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ipconfig_31bf3856ad364e35_10.0.19041.1_none_0c7fa8d5ebaceac7\ipconfig.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.19041.264_none_863c21753674f968\f\IESettingSync.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\Boot\PCAT\uk-UA\bootmgr.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.19041.1_none_ab07dd0c9dcc66c0\RMActivate_ssp_isv.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_1d38815769c81e5a\r\dllhost.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..vercommon.resources_31bf3856ad364e35_10.0.19041.1_de-de_ea7e3fb4d909aaad\appcmd.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-label_31bf3856ad364e35_10.0.19041.1_none_1774c39d9e06c822\label.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\f\cmproxyd.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_c42bf1ebf80a8661\f\isoburn.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\f\notepad.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.84_none_29cf9b86db5fb249\audit.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..c-runtime.resources_31bf3856ad364e35_10.0.19041.1_de-de_06d4a365fe667601\msdtc.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..roperties.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_1f3d7cd7fc4eea0c\DeviceProperties.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup.resources_31bf3856ad364e35_10.0.19041.1_de-de_e2f428dca02006db\lpksetup.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash.resources_31bf3856ad364e35_10.0.19041.1_it-it_f54922025c81fcb0\bash.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-client.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_07e673a7245a9663\wpnpinst.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.1266_none_d92abf553d8a282c\r\MusNotification.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.867_none_b4e9fc09cfcbdd7c\r\AxInstUI.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-choice.resources_31bf3856ad364e35_10.0.19041.1_it-it_b3afdd6972f9a7f6\choice.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.746_none_122a74c9827fe81a\r\IEChooser.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tionuxexe.resources_31bf3856ad364e35_10.0.19041.1266_en-us_b944c74b65f5f06b\f\MusNotificationUx.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_a8b46aaa6c07ca3d\f\CredentialUIBroker.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..evservice.resources_31bf3856ad364e35_10.0.19041.1_de-de_4e883e7a8d06ba1b\AgentService.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_10.0.19041.1_es-es_2c55246d83884e93\winresume.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.19041.1_none_3e188ad1a12f1c4d\dpapimig.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-dsdbutil.resources_31bf3856ad364e35_10.0.19041.1_it-it_2681145cb5e4882b\dsdbutil.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-o..component.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_a68984d9b3ff96df\windeploy.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup.resources_31bf3856ad364e35_10.0.19041.906_en-us_ca7e56b472110487\r\PktMon.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..m-manager.resources_31bf3856ad364e35_10.0.19041.1_it-it_7b8f6464f330b20d\tpmvscmgr.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f636ac58ca25b3b4\sysprep.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil.resources_31bf3856ad364e35_10.0.19041.1_es-es_d6ebe9723f92df7d\ktmutil.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..es-fondue.resources_31bf3856ad364e35_10.0.19041.1_en-us_c8135710b9469ba5\Fondue.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\f\BitLockerWizard.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_sk-sk_6190581d530ffdab\bootmgr.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\fr-FR\winhlp32.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_0f44a2d7a5e3a37a\f\ChtIME.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ingfaults.resources_31bf3856ad364e35_10.0.19041.1_es-es_2c48ca32ce41c13e\WerFault.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_a89196e695076787\r\InputSwitchToastHandler.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.19041.1_none_49c7a9c019150ac4\MdSched.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_15114cf4ffe3136a\cmstp.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artup-cpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_87a37679cdac9330\BitLockerWizard.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_94cfabd8a89f0b96\f\runonce.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.19041.423_none_0b0196a3d38fda4e\f\OOBENetworkConnectionFlow.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..lfeatures.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_8b15aff4a3b8949a\OptionalFeatures.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.1266_none_3e00d223332897b8\r\SearchApp.exe 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minsnapin.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_60a99fb029cbe14d\TpmInit.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..lsmonitor.resources_31bf3856ad364e35_10.0.19041.1_en-us_a8d1f1a3e490e6df\WpcMon.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..tance-exe.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_71004e570d84a935\sdchange.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..-binaries.resources_31bf3856ad364e35_10.0.19041.1_ro-ro_f5b5b3a5a14427e6\ro-RO_BitLockerToGo.exe.mui 842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\842edd2681b5dae1ebeaa989fb404741_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3176
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD53501e1143afdfac59c9659876e6fe961
SHA169d496bd5bf3623f335dcfcfdbfc185e386bd62a
SHA256019960a09d2d72980e86634d8c8e319b07442bd5b5b5cfff2d51394bab43a431
SHA512fd553053195eae99b1face910ab5855e35002aef352e9b4c6b68cf098c7625bdf658066eb2a60129b4fbd69e4562f8984f1857bb024c123b73b2388045070850
-
Filesize
13KB
MD5cb4095ccce236d3e9a20908159471a98
SHA175f50132bd7711a05f56ec720932b1fa9649a5d4
SHA256a9805f19cd8783745a139ed6641cf0da730160bf404eb82e17b0adfa05085de4
SHA512b29554b7f3ea58e812eb281c8064f0447b20fe0bc04836bb8e9e3f7a5e9660581458041e5a4cb3a28656374dd2221fb2fabe66cdbe0d3b3423d4eeafe8a39023