Analysis
-
max time kernel
41s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 03:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe
-
Size
113KB
-
MD5
a3a82c32cf51689050f1d4d38d81e155
-
SHA1
141822ddc25a38e1d2cabfd9acdac35caade902d
-
SHA256
14171b192cb15343a25959e1f96fe58f4a2e443209d9fb125e33abbd7970c346
-
SHA512
41688086b320fc98b74c9df52ab7b61eb522509c83bb0e50ec4240a89d49a3a182953dddfe301131b706b1ee475c8812b7b3d61cb3e481fe0d17ff135c79c510
-
SSDEEP
1536:Lwql7JmQ9g7fGqgkhB9I4BcDQX2oooD+AyxArAIVJ9bayZbScKEang5V2pL:uBjGW5I46QXMmAIX1tanUV2pL
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ACLControl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ACLControl.exe" a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe -
Modifies WinLogon 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl\DllName = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ACLControl.exe" a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl\Impersonate = "0" a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl\Asynchronous = "1" a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl\Logon = "ACLLogon" a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\de-DE\explorer.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\cmstp.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\at.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Fondue.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\uk-UA\cmdl32.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\it-IT\WinMgmt.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\powershell.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe.config a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\ja-JP\comrepl.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\ieunatt.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\CloudNotifications.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\cmdl32.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.config a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\it-IT\comrepl.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\CloudNotifications.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\explorer.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Dism.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\eudcedit.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\eventvwr.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\uk-UA\isoburn.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\ieunatt.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\isoburn.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\uk-UA\explorer.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\de-DE\WMIC.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\at.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\he-IL\quickassist.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\sk-SK\quickassist.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\it-IT\WMIC.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\GamePanel.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\eudcedit.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Fondue.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\ja-JP\mofcomp.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\XPSViewer\es-ES\XPSViewer.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\at.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\cmstp.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\csrss.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\CloudNotifications.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\dialer.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\csrss.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\hh.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\charmap.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\uk-UA\iexpress.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\ja-JP\WMIC.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\bootcfg.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\dialer.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\fr-FR\IEChooser.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\bootcfg.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\iexpress.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\fixmapi.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\hh.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\ieunatt.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\tr-TR\quickassist.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\powershell.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\XPSViewer\de-DE\XPSViewer.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\XPSViewer\it-IT\XPSViewer.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\eventvwr.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\powershell.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\zh-TW\quickassist.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\da-DK\quickassist.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\ro-RO\quickassist.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Fondue.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Dism.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\cmdl32.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\SysWOW64\hr-HR\quickassist.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\TabTip32.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\en-US\wmlaunch.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\de-DE\setup_wm.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\MicrosoftEdgeUpdateBroker.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\MicrosoftEdgeUpdateCore.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\uk-UA\wmplayer.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe.config a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\fr-FR\iexplore.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\TabTip32.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\wab.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ImagingDevices.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107921\java.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\Windows Defender\uk-UA\OfflineScannerShell.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe.config a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\TabTip32.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\it-IT\wmpnscfg.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\uk-UA\wmpnscfg.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\de-DE\wmpnetwk.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\telemetryrules\hxcalendarappimm.exe_Rules.xml a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe.config a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\it-IT\ieinstal.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\MicrosoftEdgeUpdateSetup.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\ja-JP\wmlaunch.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\dotnet.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\es-ES\wmpnscfg.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ty-client.resources_31bf3856ad364e35_10.0.19041.1_en-us_cc7274f372ed8e13\sfc.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.19041.844_none_77a5d9aafae08e77\r\MDMAppInstaller.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_22b99d078bbc3016\r\setup_wm.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.746_none_a9ff72b1a43fd663\f\DeviceCredentialDeployment.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..rkmanager.resources_31bf3856ad364e35_10.0.19041.1_es-es_2ca5efd2072b4025\WiFiTask.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adobearmhelper.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.19041.1_none_98fad53f878bc04c\mqbkup.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.1_none_37ab35f7e4b21a45\PrintBrm.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.264_none_e85c49c0793f9f24\f\Win32WebViewHost.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..omponents.resources_31bf3856ad364e35_10.0.19041.1_de-de_42622feda71ac479\wiaacmgr.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.1_none_d7cac98c90803a6a\auditpol.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\f\hvsirpcd.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..rtmanager.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_84b5a1946ada9333\RmClient.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..vercommandlinetools_31bf3856ad364e35_10.0.19041.1_none_70349c6644208282\flattemp.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ols-klist.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_120f50a133cf0076\klist.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.572_none_3e399e76562f6053\f\netbtugc.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..lfeatures.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_8b15aff4a3b8949a\OptionalFeatures.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.19041.1052_none_073e2a212d1697e6\r\ApproveChildRequest.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.1_none_4e633e7ac2500190\mspaint.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua.resources_31bf3856ad364e35_10.0.19041.1_en-us_a47bd7860bac9950\consent.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.19041.1_none_67326312c2487423\EduPrintProv.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1202_none_5b834788c0d17953\f\iexplore.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.1052_none_323c9a9ad543e3a3\f\smartscreen.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..egistration-cmdline_31bf3856ad364e35_10.0.19041.1202_none_b3f538f2c4a648b2\f\dsregcmd.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\f\SearchFilterHost.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.19041.546_none_36dd2ad842e4f8c3\csrss.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..vercommon.resources_31bf3856ad364e35_10.0.19041.1_de-de_e0299562a4a8e8b2\iissetup.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recover.resources_31bf3856ad364e35_10.0.19041.1_es-es_18ff78bc4986c4e9\recover.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.19041.746_none_72f50b15ab3c2aeb\f\ProximityUxHost.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host.resources_31bf3856ad364e35_10.0.19041.1_pl-pl_4d86e24f74ad0670\WWAHost.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winver.resources_31bf3856ad364e35_10.0.19041.1_es-es_db00ed455c2850d9\winver.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.153_none_3c9b504ec5293ad0\r\WpcTok.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-svchost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_a9bcd14039d031f2\svchost.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_b3df5aa8d99e9b89\f\TSTheme.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\f\rdpshell.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1240cd13c584c1c\XGpuEjectDialog.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_610e6b21ab533b13\f\autochk.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_smsvchost_b03f5f7f11d50a3a_10.0.19041.1_none_d342644de571beb4\SMSvcHost.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..-migregdb.resources_31bf3856ad364e35_10.0.19041.1_es-es_80c330e1f59a4103\MigRegDB.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sxs.resources_31bf3856ad364e35_10.0.19041.1_en-us_4ba39ff76cce58da\sxstrace.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15805.0_none_be984aad4cfbc2f3\csc.exe.config a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.15805.0_none_51acbceed0728359\cvtres.exe.config a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client.resources_31bf3856ad364e35_10.0.19041.1_de-de_e01cdfb89efcdab4\sihclient.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_pl-pl_789c879c7b1b7995_bootmgr.exe.mui_c434701f a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.153_none_c0c4ee134c2535a0\DTUHandler.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_af1474f55f209109\r\raserver.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_disposableclientvm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ed7290ade07a431b\WindowsSandboxClient.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_94cfabd8a89f0b96\r\runonce.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_f2bc4eeca2f84338\f\LaunchWinApp.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.1_none_c55149b3997ff9cd\SystemUWPLauncher.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_d38e81565538dedf\r\logagent.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\Boot\PCAT\qps-plocm\bootmgr.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..comserver.resources_31bf3856ad364e35_10.0.19041.1_es-es_8faff179bfce3762\raserver.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1151_none_0412565dd5f26733\r\wkspbroker.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.1_none_9fbebf8222c20a6d\uwfux.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgesh_31bf3856ad364e35_10.0.19041.1_none_7e963f23aba941dd\MicrosoftEdgeSH.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.153_none_c283d2cf01b0b7d8\f\EoAExperiences.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.19041.1_none_112f38db81e24102\csvde.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_9204c42a031e28cf\appcmd.exe a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-dsdbutil.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c8a69369a8ff9a06\dsdbutil.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil.resources_31bf3856ad364e35_10.0.19041.1_en-us_929eb5cc557f5194\pnputil.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_2dfb957904ed7b47\spectrum.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssys..ore-tasks.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5afabbc32aa51a31\SrTasks.exe.mui a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a3a82c32cf51689050f1d4d38d81e155_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD53501e1143afdfac59c9659876e6fe961
SHA169d496bd5bf3623f335dcfcfdbfc185e386bd62a
SHA256019960a09d2d72980e86634d8c8e319b07442bd5b5b5cfff2d51394bab43a431
SHA512fd553053195eae99b1face910ab5855e35002aef352e9b4c6b68cf098c7625bdf658066eb2a60129b4fbd69e4562f8984f1857bb024c123b73b2388045070850
-
Filesize
94KB
MD5aa705edf5a22ebfe61d872c90deac7ba
SHA192df5ef14e265739653f80a8385c8ce16871a868
SHA2567b7fca061479afa5ea0fbf6abb287da40569f2586ffa4b83656084eff29e8d3e
SHA51218ef926d6a2ae50eb2c54a93c51b783e359ea5314c50c54bb1bca91fc765a388c26d868a8bb14a05e1acacac124b78c01570ba8fa708f4102637b985069ea530