Malware Analysis Report

2025-03-15 05:51

Sample ID 240627-vy2pna1grf
Target 16db0521936097054ae735a93c60942d_JaffaCakes118
SHA256 18d9788c03f98f7906c8612fac92841fb9289ff006bf0fe6b36f42c8e616f603
Tags
vmprotect
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

18d9788c03f98f7906c8612fac92841fb9289ff006bf0fe6b36f42c8e616f603

Threat Level: Likely malicious

The file 16db0521936097054ae735a93c60942d_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

vmprotect

Drops file in Drivers directory

VMProtect packed file

Drops file in System32 directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-27 17:24

Signatures

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-27 17:24

Reported

2024-06-27 17:27

Platform

win7-20240221-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\Drivers\Beep.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\errdev.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\DRIVERS\ipfltdrv.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\VMBusHID.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\mshidkmdf.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\sffdisk.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\sisraid4.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\DRIVERS\smb.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\vhdmp.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\volmgrx.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\mpsdrv.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\pciide.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\usbohci.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\usbprint.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DRIVERS\netbt.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\bthmodem.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\viaide.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\wmiacpi.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\msiscsi.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\MSKSSRV.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\qwavedrv.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\SiSRaid2.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\usbcir.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\mountmgr.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\appid.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\gagp30kx.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\pcmcia.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\vms3cap.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\uliagpkx.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\Drivers\Null.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\processr.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\DRIVERS\lltdio.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\tdpipe.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\rdvgkmd.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\amdsbs.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\Drivers\Brserid.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\mpio.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\msdsm.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\serial.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\sffp_mmc.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\arc.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\isapnp.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\ql2300.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\sfloppy.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\DRIVERS\nwifi.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\sermouse.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\terminpt.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\vwifibus.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\hwpolicy.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\rdpencdd.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\arcsas.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\iaStorV.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\tsusbhub.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\HidBatt.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\modem.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\tdtcp.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\USBSTOR.SYS C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\tcpipreg.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\discache.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\adpu320.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\bxvbda.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\drmkaud.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\nv_agp.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\ohci1394.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe"

Network

N/A

Files

memory/1888-0-0x0000000000400000-0x000000000052B000-memory.dmp

memory/1888-1-0x0000000000400000-0x000000000052B000-memory.dmp

memory/1888-4-0x0000000000400000-0x000000000052B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-27 17:24

Reported

2024-06-27 17:27

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

52s

Command Line

"C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\cht4vx64.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\lsi_sss.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\Drivers\UcmCx.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DRIVERS\wanarp.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\amdsata.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\Drivers\mshwnclx.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\MSKSSRV.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\nvraid.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\uaspstor.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\MTConfig.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\ndiswan.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\sisraid4.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\ipnat.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\lsi_sas3i.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DRIVERS\ndiswan.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\sdstor.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\circlass.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\lsi_sas2i.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\megasas35i.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\SpatialGraphFilter.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\ufxsynopsys.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\iaLPSSi_I2C.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\pciide.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\dam.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\IndirectKmd.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\WudfPf.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\AcpiDev.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\ipt.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\Microsoft.Bluetooth.AvrcpTransport.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\stexstor.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\DRIVERS\wdiwifi.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\MegaSas2i.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\processr.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\amdk8.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\spaceparser.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\applockerfltr.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\tsusbflt.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\bttflt.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\mshidumdf.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\ucx01000.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\acpipagr.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\amdgpio2.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\bcmfn2.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\iaLPSS2i_I2C_CNL.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\vpci.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\3ware.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\Acx01000.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\lsi_sas.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DRIVERS\rasacd.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\iaLPSS2i_I2C_BXT_P.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\mvumis.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\winverbs.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\acpitime.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\usbser.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\xboxgip.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\bxvbda.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\bthhfenum.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\netvsc.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\usbprint.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\system32\drivers\speeder.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\amdi2c.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\drmkaud.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\hidi2c.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\drivers\iaLPSS2i_I2C.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\urschipidea.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\urssynopsys.inf_amd64_057fa37902020500\urssynopsys.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\genericusbfn.inf_amd64_53931f0ae21d6d2c\genericusbfn.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\uefi.inf_amd64_c1628ffa62c8e54c\UEFI.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\ufxchipidea.inf_amd64_1c78775fffab6a0a\UfxChipidea.sys C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\16db0521936097054ae735a93c60942d_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

memory/3256-0-0x0000000000400000-0x000000000052B000-memory.dmp

memory/3256-1-0x0000000000400000-0x000000000052B000-memory.dmp

memory/3256-2-0x0000000000400000-0x000000000052B000-memory.dmp