ecce415d0974cd67ac46a51c84e22dd81e1151798cd68559cc7da4b225d35050

Analysis

max time kernel
140s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
Size

350KB
MD5

0d8c7dcb38a6c7acd68888068affea4c
SHA1

e98a1da677454fcbbfc4dd03f1fc2b9554b6c692
SHA256

ecce415d0974cd67ac46a51c84e22dd81e1151798cd68559cc7da4b225d35050
SHA512

74473b1cd96919e2899d54f84d2fca08f6e46476cdcb6fa36034b3e614a7abdfc8a09cfce18fc067ee7e04b420429d23e7a50b5066758689328b8ea18995cf5a
SSDEEP

6144:HR2J0LS6Vymc0FWOp+NtumIjekkvhF1UpK3usidA9pVie:HRm0Oqy/6VIryjekkyYziS9ie

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe:*:enabled:@shell32.dll,-1"	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3484	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118mgr.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1904	3484	WerFault.exe	90
3728	5076	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3484	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	90
PID 5076 wrote to memory of 3484	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	90
PID 5076 wrote to memory of 3484	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	90
PID 5076 wrote to memory of 628	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	5
PID 5076 wrote to memory of 628	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	5
PID 5076 wrote to memory of 628	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	5
PID 5076 wrote to memory of 628	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	5
PID 5076 wrote to memory of 628	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	5
PID 5076 wrote to memory of 628	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	5
PID 5076 wrote to memory of 692	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	7
PID 5076 wrote to memory of 692	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	7
PID 5076 wrote to memory of 692	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	7
PID 5076 wrote to memory of 692	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	7
PID 5076 wrote to memory of 692	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	7
PID 5076 wrote to memory of 692	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	7
PID 5076 wrote to memory of 792	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	8
PID 5076 wrote to memory of 792	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	8
PID 5076 wrote to memory of 792	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	8
PID 5076 wrote to memory of 792	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	8
PID 5076 wrote to memory of 792	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	8
PID 5076 wrote to memory of 792	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	8
PID 5076 wrote to memory of 800	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	9
PID 5076 wrote to memory of 800	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	9
PID 5076 wrote to memory of 800	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	9
PID 5076 wrote to memory of 800	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	9
PID 5076 wrote to memory of 800	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	9
PID 5076 wrote to memory of 800	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	9
PID 5076 wrote to memory of 804	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	10
PID 5076 wrote to memory of 804	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	10
PID 5076 wrote to memory of 804	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	10
PID 5076 wrote to memory of 804	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	10
PID 5076 wrote to memory of 804	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	10
PID 5076 wrote to memory of 804	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	10
PID 5076 wrote to memory of 904	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	11
PID 5076 wrote to memory of 904	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	11
PID 5076 wrote to memory of 904	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	11
PID 5076 wrote to memory of 904	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	11
PID 5076 wrote to memory of 904	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	11
PID 5076 wrote to memory of 904	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	11
PID 5076 wrote to memory of 956	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	12
PID 5076 wrote to memory of 956	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	12
PID 5076 wrote to memory of 956	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	12
PID 5076 wrote to memory of 956	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	12
PID 5076 wrote to memory of 956	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	12
PID 5076 wrote to memory of 956	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	12
PID 5076 wrote to memory of 336	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	13
PID 5076 wrote to memory of 336	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	13
PID 5076 wrote to memory of 336	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	13
PID 5076 wrote to memory of 336	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	13
PID 5076 wrote to memory of 336	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	13
PID 5076 wrote to memory of 336	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	13
PID 5076 wrote to memory of 524	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	14
PID 5076 wrote to memory of 524	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	14
PID 5076 wrote to memory of 524	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	14
PID 5076 wrote to memory of 524	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	14
PID 5076 wrote to memory of 524	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	14
PID 5076 wrote to memory of 524	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	14
PID 5076 wrote to memory of 828	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	15
PID 5076 wrote to memory of 828	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	15
PID 5076 wrote to memory of 828	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	15
PID 5076 wrote to memory of 828	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	15
PID 5076 wrote to memory of 828	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	15
PID 5076 wrote to memory of 828	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	15
PID 5076 wrote to memory of 1044	5076	0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe	16

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:628
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:800
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:336

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:792
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2472
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3708
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3844
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3928
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:4012
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4112
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:492
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:3540
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4756
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:4660
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:3496

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1192
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1468
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2036

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2440

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3176

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3336
- C:\Users\Admin\AppData\Local\Temp\0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Users\Admin\AppData\Local\Temp\0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118mgr.exe
    C:\Users\Admin\AppData\Local\Temp\0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118mgr.exe
    3⤵
    - Executes dropped EXE
    PID:3484
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 480
      4⤵
      Program crash
      PID:1904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 464
    3⤵
    - Program crash
    PID:3728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4848

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:3600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffa2d402e98,0x7ffa2d402ea4,0x7ffa2d402eb0
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3056 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3144 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3264 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5484 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5620 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3484 -ip 3484
1⤵
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5076 -ip 5076
1⤵
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3484 -ip 3484
1⤵
PID:2680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5076 -ip 5076
1⤵
PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0d8c7dcb38a6c7acd68888068affea4c_JaffaCakes118mgr.exe

Filesize
174KB

MD5
8779e16628d36aa1e10bba1bab317b91

SHA1
64828826d7b3732146859fb4ce59fedc9f2afd46

SHA256
e6def756bcb57ce2924031f2470b7f7dc221154be65942951e4f9abc29702e66

SHA512
9fe00af2f4ef24d3cf4e5343f79806763265bb734bcd19c4f514b573eb86eb291b4690ce5613dac06976be0b6d24af7da5ee2045a6c0530e2faa85a4df31a7aa

Download Submit
memory/3484-4-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3484-6-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/3484-10-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5076-0-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/5076-7-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/5076-8-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/5076-9-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/5076-11-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/5076-12-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download