Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 17:22
Static task
static1
Behavioral task
behavioral1
Sample
aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe
-
Size
955KB
-
MD5
aae3437826361e72e932c22c5f63cd4d
-
SHA1
f7369ab8c45664c463c672d39a78da3213b7cea3
-
SHA256
80b8f61fd6a9d4ef0aec1db74258b10cbf1d00ff05f7007962d2859f082a68ab
-
SHA512
6da566349f51453354301c8f1739c973d06515f00da8f44c4aad4df61d9cb8a1ff3f5ca14eb922ee72c7f38727ddebf974dea49de6e07c7c8d9656bbf947ca7e
-
SSDEEP
24576:SX48QE+Ul876dNhofAFC9KTBMt+yavz1b/yO7TTB/h7Amo:SXz+9WD4PKTBMt+yw1b/DVDo
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt svchost.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exesvchost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation svchost.exe -
Drops startup file 1 IoCs
Processes:
aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\codec.exe aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
svchost.exesvchost.exepid process 1488 svchost.exe 4372 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/4372-24-0x0000000000400000-0x000000000049B000-memory.dmp upx behavioral2/memory/4372-22-0x0000000000400000-0x000000000049B000-memory.dmp upx behavioral2/memory/4372-25-0x0000000000400000-0x000000000049B000-memory.dmp upx behavioral2/memory/4372-26-0x0000000000400000-0x000000000049B000-memory.dmp upx behavioral2/memory/4372-27-0x0000000000400000-0x000000000049B000-memory.dmp upx behavioral2/memory/4372-518-0x0000000000400000-0x000000000049B000-memory.dmp upx behavioral2/memory/4372-1457-0x0000000000400000-0x000000000049B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sopropool = "C:\\Program Files (x86)\\svchost.exe" svchost.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 54 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\OEM\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\de-DE\lipeula.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\ja-JP\lpeula.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.xls svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\Volume\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\uk-UA\Licenses\_Default\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\default.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\_Default\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\fr-FR\lpeula.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\it-IT\lpeula.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\es-ES\lpeula.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\Licenses\neutral\OEM\Professional\de-license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.ppt svchost.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc svchost.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\lcphrase.tbl svchost.exe File opened for modification C:\Windows\SysWOW64\lcptr.tbl svchost.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\Licenses\neutral\OEM\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\Licenses\neutral\_Default\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\uk-UA\Licenses\Volume\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\Volume\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\en-US\lipeula.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\en-US\lpeula.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\Volume\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\Volume\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\fr-FR\lipeula.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\default.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\Licenses\neutral\Volume\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\Volume\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\Licenses\neutral\_Default\Professional\de-license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\MailContactsCalendarSync\LiveDomainList.txt svchost.exe File opened for modification C:\Windows\SysWOW64\uk-UA\lipeula.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\OEM\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\ja-JP\lipeula.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\uk-UA\Licenses\OEM\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt svchost.exe File opened for modification C:\Windows\SysWOW64\de-DE\lpeula.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\_Default\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\uk-UA\lpeula.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\es-ES\lipeula.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\Volume\Professional\license.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\it-IT\lipeula.rtf svchost.exe File opened for modification C:\Windows\SysWOW64\WindowsCodecsRaw.txt svchost.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\desk.bmp" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
svchost.exedescription pid process target process PID 1488 set thread context of 4372 1488 svchost.exe svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\7-Zip\History.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\27.jpg svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\Welcome_Slide01.jpg svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\13.jpg svchost.exe File opened for modification C:\Program Files (x86)\DPMITJJGIT.WJH svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\8.jpg svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MotionController_Diagram.jpg svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt svchost.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\12.jpg svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\9.jpg svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_Safety_NoObjects.jpg svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\DialRotation.mp4 svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Third Party Notices.txt svchost.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AboutAdsCoreBackgroundImage.jpg svchost.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg1a.jpg svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\music_offline_demo_page1.jpg svchost.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\46.jpg svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt svchost.exe File opened for modification C:\Program Files\DisconnectLock.doc svchost.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\28.jpg svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\THANKS.txt svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Bark.jpg svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\31.jpg svchost.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AboutAdsGenericBackgroundImage.jpg svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\Unipulator.mp4 svchost.exe File opened for modification C:\Program Files\7-Zip\License.txt svchost.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\5.jpg svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\9.jpg svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Images\fre_background.jpg svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomSetupDisambig_RoomScale.jpg svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\ThankYou\GenericEnglish-3.jpg svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\video_offline_demo_page2.jpg svchost.exe File created C:\Program Files (x86)\DPMITJJGIT.WJH svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt svchost.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt svchost.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Success.jpg svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\82.jpg svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketchAppService\ReadMe.txt svchost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\1.jpg svchost.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..e.desktop.searchapp_31bf3856ad364e35_10.0.19041.1_none_43fe9f4e368e081f\5.txt svchost.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..nbackgrounds-client_31bf3856ad364e35_10.0.19041.1_none_9307d11798cf436b\img102.jpg svchost.exe File opened for modification C:\Windows\WinSxS\wow64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_fr-fr_23685c9c791653a6\Tracking_Schema.sql svchost.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-l..efault-professional_31bf3856ad364e35_10.0.19041.1288_none_b39472f9da00dbd0\f\de-license.rtf svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\es\SqlPersistenceService_Logic.sql svchost.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-h..indetails.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_e3685f97b198e2df\OOBE_HELP_Opt_in_Details.rtf svchost.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-l..se-oem-professional_31bf3856ad364e35_10.0.19041.1288_none_def92cfd289b607e\f\de-license.rtf svchost.exe File opened for modification C:\Windows\WinSxS\amd64_netfx-aspnet_installpersistsql_b03f5f7f11d50a3a_10.0.19041.1_none_963916eb1db2663c\InstallPersistSqlState.sql svchost.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_ja-jp_a561279e0f028904\SqlPersistenceService_Schema.sql svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\ja\SqlPersistenceService_Schema.sql svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceProviderLogic.sql svchost.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_fr-fr_1913b24a44b591ab\Tracking_Schema.sql svchost.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_10.0.19041.1_en-us_bccdda8b17992b69\lipeula.rtf svchost.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_bde408a455fc3ece\InstallSqlStateTemplate.sql svchost.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.746_none_1a1e8292dcf10728\MS-SecretAttributeCARs.LDF svchost.exe File opened for modification C:\Windows\WinSxS\wow64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_de-de_d7f4b3c0973f3fda\DropSqlPersistenceProviderLogic.sql svchost.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..services-adam-setup_31bf3856ad364e35_10.0.19041.1_none_f216454a1d7f48de\MS-ADAM-Upgrade-2.LDF svchost.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-h..learnmore.resources_31bf3856ad364e35_10.0.19041.1_de-de_d11b99c14f1a11a9\OOBE_HELP_Cortana_Learn_More.rtf svchost.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-l..fessional.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_27f2ee4d79d2b54d\license.rtf svchost.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1254.TXT svchost.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-l..fessional.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d8e63f91128f7dc3\license.rtf svchost.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l-wallpaper-windows_31bf3856ad364e35_10.0.19041.1_none_910333b84fcf455a\img0_2160x3840.jpg svchost.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..nbackgrounds-client_31bf3856ad364e35_10.0.19041.1_none_9307d11798cf436b\img104.jpg svchost.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-containerlicense_31bf3856ad364e35_10.0.19041.1_none_0b9d42260da91e9d\License.txt svchost.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-theme2_31bf3856ad364e35_10.0.19041.1_none_8ccaf9c8444b9274\img8.jpg svchost.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-l..fessional.resources_31bf3856ad364e35_10.0.19041.1_it-it_85cd6f4086b7a372\license.rtf svchost.exe File opened for modification C:\Windows\WinSxS\x86_netfx-uninstallsqlstate_sql_b03f5f7f11d50a3a_10.0.19041.1_none_63b93317b8f9b631\UninstallSqlState.sql svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\ja\SqlWorkflowInstanceStoreSchema.sql svchost.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.19041.746_none_e180169f2d62e633\wmpnss_color32.jpg svchost.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-wwfcorecomp.resources_31bf3856ad364e35_10.0.19041.1_it-it_a1e0902bd2b3e74f\Tracking_Logic.sql svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\fr\SqlPersistenceProviderSchema.sql svchost.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.19041.1_de-de_ceb289e251ed179c\default.help.txt svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\en\SqlWorkflowInstanceStoreSchema.sql svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\ja\DropSqlPersistenceProviderLogic.sql svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql svchost.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fax-common_31bf3856ad364e35_10.0.19041.906_none_ea293d31af4f56ea\WelcomeScan.jpg svchost.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_10.0.19041.1_de-de_13dd049228bb1fa4\lpeula.rtf svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\de\DropSqlPersistenceProviderSchema.sql svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\de\SqlWorkflowInstanceStoreLogic.sql svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\ja\SqlPersistenceProviderLogic.sql svchost.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mccs-syncutil_31bf3856ad364e35_10.0.19041.1_none_7c783da44288db57\LiveDomainList.txt svchost.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..35cdfcomp.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_a7d77402258aa796\SqlPersistenceProviderLogic.sql svchost.exe File opened for modification C:\Windows\WinSxS\wow64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_de-de_d7f4b3c0973f3fda\SqlWorkflowInstanceStoreLogic.sql svchost.exe File opened for modification C:\Windows\WinSxS\wow64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_ja-jp_afb5d1f043634aff\SqlWorkflowInstanceStoreLogic.sql svchost.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-l..fessional.resources_31bf3856ad364e35_10.0.19041.1_es-es_f8ee02fabcb3a792\license.rtf svchost.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-n..35cdfcomp.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d8064dd2377a2db9\SqlPersistenceProviderLogic.sql svchost.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-h..atement_r.resources_31bf3856ad364e35_10.0.19041.1_es-es_0cef4537345a980a\privacy.rtf svchost.exe File opened for modification C:\Windows\WinSxS\Temp\PendingDeletes\9714214736e5d7015ca100001815341f.MS-adamschemaw2k3.LDF svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\fr\SqlPersistenceService_Logic.sql svchost.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_fr-fr_1913b24a44b591ab\SqlPersistenceService_Logic.sql svchost.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-installcommon_sql_b03f5f7f11d50a3a_4.0.15805.0_none_37bb712718e5ea5e\UninstallCommon.sql svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\ja\Tracking_Logic.sql svchost.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_de-de_cda0096e62de7ddf\SqlPersistenceProviderSchema.sql svchost.exe File opened for modification C:\Windows\WinSxS\wow64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_fr-fr_23685c9c791653a6\DropSqlPersistenceProviderSchema.sql svchost.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-n..35cdfcomp.resources_31bf3856ad364e35_10.0.19041.1_de-de_00452fa28b562294\SqlPersistenceProviderSchema.sql svchost.exe File opened for modification C:\Windows\WinSxS\x86_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_10.0.19041.1_none_641cd8499a376e57\UninstallWebEventSqlProvider.sql svchost.exe File opened for modification C:\Windows\Media\Focus4_48000Hz.raw svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\de\SqlPersistenceProviderLogic.sql svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\EN\SqlPersistenceProviderSchema.sql svchost.exe File opened for modification C:\Windows\WinSxS\wow64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_ja-jp_afb5d1f043634aff\SqlPersistenceProviderLogic.sql svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\fr\DropSqlWorkflowInstanceStoreLogic.sql svchost.exe File opened for modification C:\Windows\WinSxS\amd64_netfx35cdf-cdf_sql_files_31bf3856ad364e35_10.0.19041.1_none_581e4bab70e4996b\SqlPersistenceProviderSchema.sql svchost.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-installpersonalization_sql_b03f5f7f11d50a3a_4.0.15805.0_none_e2eb247f3f1d7e31\UninstallPersonalization.sql svchost.exe File opened for modification C:\Windows\WinSxS\Temp\PendingDeletes\ae46274236e5d701199700001815341f.License.txt svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 3 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop svchost.exe Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\ svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\Desktop\TileWallpaper = "0" svchost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
svchost.exepid process 4372 svchost.exe 4372 svchost.exe 4372 svchost.exe 4372 svchost.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exesvchost.exesvchost.execmd.exedescription pid process target process PID 4888 wrote to memory of 1488 4888 aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe svchost.exe PID 4888 wrote to memory of 1488 4888 aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe svchost.exe PID 4888 wrote to memory of 1488 4888 aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe svchost.exe PID 1488 wrote to memory of 4372 1488 svchost.exe svchost.exe PID 1488 wrote to memory of 4372 1488 svchost.exe svchost.exe PID 1488 wrote to memory of 4372 1488 svchost.exe svchost.exe PID 1488 wrote to memory of 4372 1488 svchost.exe svchost.exe PID 1488 wrote to memory of 4372 1488 svchost.exe svchost.exe PID 1488 wrote to memory of 4372 1488 svchost.exe svchost.exe PID 1488 wrote to memory of 4372 1488 svchost.exe svchost.exe PID 1488 wrote to memory of 4372 1488 svchost.exe svchost.exe PID 4372 wrote to memory of 1704 4372 svchost.exe cmd.exe PID 4372 wrote to memory of 1704 4372 svchost.exe cmd.exe PID 4372 wrote to memory of 1704 4372 svchost.exe cmd.exe PID 1704 wrote to memory of 3832 1704 cmd.exe chcp.com PID 1704 wrote to memory of 3832 1704 cmd.exe chcp.com PID 1704 wrote to memory of 3832 1704 cmd.exe chcp.com
Processes
-
C:\Users\Admin\AppData\Local\Temp\aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aae3437826361e72e932c22c5f63cd4d_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XKLFV.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\chcp.comchcp 12515⤵PID:3832
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:81⤵PID:4568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
195B
MD54343077478fac5fe1568dbd16b958427
SHA1b339f72779c56d98328480f689f677bf3cc610bc
SHA256183cf19a760301864875b47d956f111b6faa1e7c5139f6881aeb1eae4ee3e5a7
SHA5120ebd55dfd92a0e0d21c0d8ed3ddde6881084793609b3a7520c2eb78b52d63cda5ccbb5e4aab50adb514ec3771503ba8880005021865d1362d9097d645c55d585
-
Filesize
421KB
MD504570aca8e3c6d50c63df19d7716fafb
SHA133dce47cbc7f76f971d64d1f3b893fac702047e6
SHA256dfd333a159c6ba2160bbda110c36f8a2b0ea03ba34b7b95743cfe7e63b066088
SHA51234793b8c20000f84e4d517b82bfde8e23e4c7da688451777dea16d174a375e71f9929a6e7d768e9d5cbf19cc64c0a606e7fc370e131bedf9ce94e36f58ed262a