Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 11:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe
-
Size
20KB
-
MD5
0dd22532b5122bc60a490158b3bc43e9
-
SHA1
cd4b1b974e0591fd1cc6e60e6a876f712e010ea4
-
SHA256
7633963d6f6f20d881f467839c55481cd65f0446936da730325cc4b45410d0d3
-
SHA512
594b2c26c6c979c6b547ee492b81afcb0790317544ac053d0c9fd65fee4f5a9d8e015fab620041e90f50eacc1fc49781e039713d79489bbaacfd877a5a43ee15
-
SSDEEP
192:/TP4pgStJ91VYBdH+IgYUTGbLHF3iJsBJuQ:/TyxtnYBdeIgvwpiJsBcQ
Score
9/10
Malware Config
Signatures
-
Renames multiple (406) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\it-IT\tcpip.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\qwavedrv.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\tcpip.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\qwavedrv.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\tcpip.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\wimmount.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\scfilter.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\bfe.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\tcpip.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\bfe.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\qwavedrv.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\tcpip.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\pacer.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\qwavedrv.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\tcpip.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\tcpip.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\tcpip.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\qwavedrv.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\gmreadme.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\qwavedrv.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\wimmount.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\pacer.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\qwavedrv.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\scfilter.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\qwavedrv.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\scfilter.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\qwavedrv.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\bfe.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\bfe.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\pacer.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\pacer.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\gm.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\qwavedrv.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\pacer.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\tcpip.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\bfe.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\pacer.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\tcpip.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\pacer.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\scfilter.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\scfilter.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\bfe.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\bfe.dll.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\tcpip.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\bfe.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\pacer.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\gm.dls 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\scfilter.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\scfilter.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\bfe.dll.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\pacer.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\qwavedrv.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\qwavedrv.sys.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\qwavedrv.sys.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\bfe.dll.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe -
Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\SysWOW64\wintrust.dll 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Media\Raga\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Globalization\MCT\MCT-US\Wallpaper\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\Links\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Public\Videos\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Downloaded Program Files\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Media\Sonata\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Public\Documents\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Public\Music\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Media\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Media\Delta\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Media\Quirky\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Media\Landscape\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VY10BSW\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CM2WAJS5\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OQAMAYIL\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Public\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Media\Heritage\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Globalization\MCT\MCT-GB\Link\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Offline Web Pages\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\es-ES\rpcnsh.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ja-JP\ulib.dll.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\prnkm005.inf_loc 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\odbcconf.exe.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\it-IT\choice.exe.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ja-JP\eventvwr.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\dot3api.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnbr005.inf_amd64_neutral_9e4cc05e0d4bcb33\Amd64\BRMF290C.GPD 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\wiabr008.inf_loc 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmolic.inf_amd64_neutral_a53ac1a125d227fc\mdmolic.inf 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\C_1253.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\mmsys.cpl.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\sti.inf_loc 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SyncInfrastructure.dll 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\cs-CZ\fms.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\en-US\tpm.inf_loc 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\netbtugc.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\es-ES\SensorsCpl.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\it-IT\TSWorkspace.dll.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\notepad.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fr-FR\netstat.exe.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fr-FR\sdohlp.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky303.inf_amd64_ja-jp_b054bb0d59e0a3ad\Amd64\KYUD2560.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc00c.inf_amd64_neutral_53a58f4fd7d88575\prnrc00c.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\usbvideo.inf_amd64_neutral_836a6716cd56c692\usbvideo.PNF 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\mfc110enu.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-UIAnimation-WinIP-Package~31bf3856ad364e35~amd64~en-US~7.1.7601.16492.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnbr005.inf_amd64_neutral_9e4cc05e0d4bcb33\Amd64\BRDP167C.GPD 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\es-ES\wiaca00i.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmcpq.inf_amd64_neutral_fbc4a14a6a13d0c8\usbser.sys 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\CNBXRF4.DLL 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\dsquery.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\en-US\eappcfg.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\inetcomm.dll 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\eval\EnterpriseN\license.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\prnbr00a.inf_loc 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\it-IT\nshwfp.dll.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\megasas.inf_amd64_neutral_395276dd9b7a7448\megasas.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wiacn001.inf_amd64_neutral_b7a0b2f53d745b5a\CNHP730S.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\odbcconf.exe.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\es-ES\cfgbkend.dll.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\es-ES\encdec.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Win8IP-Microsoft-Windows-Graphics-Package~31bf3856ad364e35~amd64~fr-FR~7.1.7601.16492.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\de-DE\AuxiliaryDisplayCpl.dll.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\onex.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\hiddigi.inf_amd64_neutral_12aaf5742a9969da\hiddigi.inf 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\prnca00z.PNF 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wiaca00b.inf_amd64_neutral_1aaa057d3d52ea43\CNFRAI.ICC 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\en-US\win32spl.dll.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\StarterN\license.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\TRACERT.EXE 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_for_KB976933~31bf3856ad364e35~amd64~de-DE~6.1.7601.17514.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\de-DE\iirsp.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fr-FR\CertEnroll.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Win8IP-Microsoft-Windows-DownlevelApisets-WinIP-Package~31bf3856ad364e35~amd64~ja-JP~7.1.7601.16492.cat 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc006.inf_amd64_neutral_7e12a60cc98d3f89\Amd64\RIA810D6.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fr-FR\twext.dll.mui 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\mimefilt.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\sysdm.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wdigest.dll 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hpc4600t.vdf 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\QAgent.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\WPDSp.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DataViewIconImagesMask.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.VN.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_settings.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\settings.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\VBAJET32.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Public_Primary_CA.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-cli.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107342.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.IT.XML 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\DVD Maker\Shared\Common.fxh 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-gibbous_partly-cloudy.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152590.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Defender\ja-JP\MpEvMsg.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\gadget.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\gadget.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ONWordAddin.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewTemplate.html 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\System.ServiceModel.Resources.dll 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Journal\fr-FR\MSPVWCTL.DLL.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16Images.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Pitchbook.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-left.png 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_sun.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmkv_plugin.dll 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00494_.WMF 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OFFRHD.DLL 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02187_.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BULLETS.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\icon.png 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\msadox.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03795_.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Tags.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\en-US\iexplore.exe.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0202045.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0313896.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1036\MSO.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\ONLINE.ICO 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR46B.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdiracsys_plugin.dll 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_hail.png 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01174_.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\InactiveTabImage.jpg 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreeis.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\PLA\Rules\de-DE\Rules.System.Memory.xml 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Common-Drivers-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.mum 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\smdiagnostics.resources\3.0.0.0_it_b77a5c561934e089\SMDiagnostics.resources.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\Fonts\msyhbd.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Help\Windows\en-US\artuimedia.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\es\System.Runtime.Remoting.Resources.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\SMSvcHost\0b4d4e172e8054cb61d27f5ab9e0e445\SMSvcHost.ni.exe.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\UIAutomationTypes_x86.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.Deployment.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\de\DropSqlPersistenceProviderLogic.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\PolicyDefinitions\es-ES\WindowsMessenger.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-PlatformUpdate-Win7-SRV08R2-Package-MiniLP~31bf3856ad364e35~amd64~tr-TR~7.1.7601.16492.mum 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\Help\Windows\es-ES\print.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\web_mediumtrust.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\PolicyDefinitions\es-ES\Bits.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\PolicyDefinitions\es-ES\PeerToPeerCaching.adml 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ja-JP\ServiceModelEvents.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\servicing\Packages\Win8IP-Microsoft-Windows-DownlevelApisets-WinIP-Package~31bf3856ad364e35~amd64~th-TH~7.1.7601.16492.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\servicing\Packages\Win8IP-Microsoft-Windows-Graphics-Package~31bf3856ad364e35~amd64~bg-BG~7.1.7601.16492.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\MIGUIControls\569e273efda8306ec7e22143d5285476\MIGUIControls.ni.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\IME\IMESC5\DICTS\PINTLGIX.IMD 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\DE\System.Configuration.resources.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelInstallRC.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\servicing\Packages\Microsoft-Windows-Shell-PremiumInboxGames-Package~31bf3856ad364e35~amd64~ja-JP~6.1.7601.17514.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Cursors\help_m.cur 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\Help\mui\0410\eventviewer.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Media\Delta\Windows Notify.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe.config 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\PolicyDefinitions\tcpip.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\7f0531cbaadefd63fb9c1f7ae51fc668\Microsoft.CSharp.ni.dll.aux 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceModel.Primitives.dll 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\DefineErrorPage.aspx.it.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Remoting.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1035\SetupResources.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\JA\System.Management.Resources.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationProvider\3bfcfe12488f0a2285f5f08274cbc13f\UIAutomationProvider.ni.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Help\mui\0410\ieakmmc.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Help\Windows\fr-FR\appman.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\inf\mdmgl007.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_rc.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\Cursors\wait_i.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Help\Windows\de-DE\errmes.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\inf\mdmetech.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Http.WebRequest.dll 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.IO.FileSystem.Watcher.dll 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\it\infocard.resources.dll 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\e7904d77bcee77868d534546ed2a61b6\Microsoft.Windows.Diagnosis.SDEngine.ni.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Comp7dda8007#\4233efbee3de5f702340b1088df01439\System.ComponentModel.Composition.Registration.ni.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Help\Windows\it-IT\shgloss.h1s 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\JA\System.Runtime.Remoting.Resources.dll 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\regsvcs.exe.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\PolicyDefinitions\it-IT\LinkLayerTopologyDiscovery.adml 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Web.DynamicData\3.5.0.0__31bf3856ad364e35\System.Web.DynamicData.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\52c68307282a248618376df5db7f9cce\System.Deployment.ni.dll.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\Cursors\aero_ew_xl.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\Help\Windows\de-DE\safemodc.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File opened for modification C:\Windows\inf\adp94xx.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\Help\Windows\de-DE\sysman.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalResources\security0.aspx.exe 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2100 0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0dd22532b5122bc60a490158b3bc43e9_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops startup file
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD50dd22532b5122bc60a490158b3bc43e9
SHA1cd4b1b974e0591fd1cc6e60e6a876f712e010ea4
SHA2567633963d6f6f20d881f467839c55481cd65f0446936da730325cc4b45410d0d3
SHA512594b2c26c6c979c6b547ee492b81afcb0790317544ac053d0c9fd65fee4f5a9d8e015fab620041e90f50eacc1fc49781e039713d79489bbaacfd877a5a43ee15