87e912e727efe85d6af075b1373ef70a12eb01dc9dd1636471e351d77e8adb25

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe
Size

119KB
MD5

0742ef3ef5e2f41e66afeabe34ff2797
SHA1

8292da8173a2b1fd4b5fc7a0d50a3ce85d7c2fd3
SHA256

87e912e727efe85d6af075b1373ef70a12eb01dc9dd1636471e351d77e8adb25
SHA512

54d3b6a4ad4af064247764c2b5479b5cafb6fd85b593e5576a0a917c8734abd1dae31604306161aaf567c9ffbeeaeeb551b7c7b61be1f79934b70b170b1ba119
SSDEEP

3072:/jTUQw3CZuD2roImWlNz9xotq9fsTEXL3:/XNbcImWR9xtVjr

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
932	urdvxc.exe

Executes dropped EXE 5 IoCs

pid	Process
3252	urdvxc.exe
4852	urdvxc.exe
2124	urdvxc.exe
932	urdvxc.exe
1828	urdvxc.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\urdvxc.exe	0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe

Drops file in Program Files directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\EnterUnblock.htm	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files\EnterUnblock.htm	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\nxqsxhql.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "kvvkcxkqzttlwcce"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "lhbkhzeheejsjcth"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\nxqsxhql.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "brqejhbjsbclwbrj"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\ = "szttwbtlnlwksrlz"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "tnjbbjhxlvszwrsr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\ = "lnnkjtcqvthzrrbq"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "heskkljxwbrxbnbl"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "shbsjlslxczklhqt"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{591F3BEC-119C-483F-12DA-BD9F3EF11A14}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe"	0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "ljhnbczeqrzbsjbz"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "sbbbhjrllrhbbqqn"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "nresjlwxrcxqsqrb"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\ = "reblltvjkljksehz"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{591F3BEC-119C-483F-12DA-BD9F3EF11A14}\LocalServer32	0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\hrbhlxhb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\ = "jxhnwcjbqqkewjjt"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\kznjrtew.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{591F3BEC-119C-483F-12DA-BD9F3EF11A14}	0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "jqrcjhevvhqjllhe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "tzbwwsvbstbqhkjh"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\vlbvwvhv.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{591F3BEC-119C-483F-12DA-BD9F3EF11A14}\ = "bjxnhjnsbrkjrbjl"	0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3252	urdvxc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 3252	1168	0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe	95
PID 1168 wrote to memory of 3252	1168	0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe	95
PID 1168 wrote to memory of 3252	1168	0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe	95
PID 1168 wrote to memory of 4852	1168	0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe	96
PID 1168 wrote to memory of 4852	1168	0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe	96
PID 1168 wrote to memory of 4852	1168	0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe	96
PID 1168 wrote to memory of 932	1168	0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe	100
PID 1168 wrote to memory of 932	1168	0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe	100
PID 1168 wrote to memory of 932	1168	0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe	100

C:\Users\Admin\AppData\Local\Temp\0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3252
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:4852
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\0742ef3ef5e2f41e66afeabe34ff2797_JaffaCakes118.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:932

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:2124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4344,i,11049150160560877369,2866371920339304689,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
1⤵
PID:1720

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:1828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk-1.8\README.html

Filesize
263B

MD5
8e0789ff750b413c70a9b109432cf0ba

SHA1
84c429f3b741a44bced2a137ee62254348e89da6

SHA256
f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1

SHA512
36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899

Download Submit
C:\Program Files\Java\jdk-1.8\jre\Welcome.html

Filesize
1KB

MD5
2fe21944034eb6b2b24f4bed8b1bee2c

SHA1
b53bb2babe0c2fe682a2e1c05d79dcf4fedf15a1

SHA256
6ffa2002e97816536eb55bef0ba11402fda791a3c4e7fa42f15f64967cdf1e9e

SHA512
4ac42b5d64d2f98e652a269a78bc012caf340fe43e7ef97fae58a1437b7360b05b949637c061d1ce818a2ca789c6db09d9c432efbe5dd8f7ee938f81976725eb

Download Submit
C:\Program Files\Java\jre-1.8\Welcome.html

Filesize
1KB

MD5
bc7c57b483916c6260cf0467bd8f0817

SHA1
80d1f7095e14da4ba8e73252d998f2979b5038d3

SHA256
17199b56ed55902544a9c13f4f263cd0ce15ed1bc63ab1f49df634c732b5a48c

SHA512
f2bc75c0fc8b02751db4ff98fe3fe36d9117dd1d748bdf03d78f72a6b7fada03e6832d5123a5c3e9aadf2bf92a266cd76ca9beb3914efc09ccbc99cc24467ced

Download Submit
C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html

Filesize
1KB

MD5
75887f366667b2254dfd35014d4eb318

SHA1
03127bc21514e315f8c370a9ac5dbd1cd9e766e7

SHA256
fcd66e8e56164804b031e01cf09f3da3338eb9d92b9bf4eb23097ce32018b9a9

SHA512
953e558d01d43f252870db5ecce7e347f69b3e553ecfadb106be203745492636d95dbcfc7446d31b138691e5e833b8f1a77d08995b7fb8ade5ae44af7fe48979

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
119KB

MD5
0742ef3ef5e2f41e66afeabe34ff2797

SHA1
8292da8173a2b1fd4b5fc7a0d50a3ce85d7c2fd3

SHA256
87e912e727efe85d6af075b1373ef70a12eb01dc9dd1636471e351d77e8adb25

SHA512
54d3b6a4ad4af064247764c2b5479b5cafb6fd85b593e5576a0a917c8734abd1dae31604306161aaf567c9ffbeeaeeb551b7c7b61be1f79934b70b170b1ba119

Download Submit
memory/932-68-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/932-39-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/1168-37-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/1168-0-0x0000000000400000-0x0000000000434642-memory.dmp

Filesize
209KB

Download
memory/1168-1-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/1828-4364-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/1828-3013-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/2124-48-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-56-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-23-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-24-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-25-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-26-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-27-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-28-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-29-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-30-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-31-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-32-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-33-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-34-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-35-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-20-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-38-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-19-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-40-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-41-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-42-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-43-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-44-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-45-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-46-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-47-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-17-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-49-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-50-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-51-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-52-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-53-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-54-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-22-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-57-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-58-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-59-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-60-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-61-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-62-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-63-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-64-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-65-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-66-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-67-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-18-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-69-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-70-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-71-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-72-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-73-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-74-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-75-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-76-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-77-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-78-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-79-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-1138-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-3011-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-16-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-13-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2124-11-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/3252-6-0x0000000000400000-0x0000000000434642-memory.dmp

Filesize
209KB

Download
memory/3252-7-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4852-9-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download