253ed82cd534713a8393692075c3c28f525dd43712671b3c42e43b20d66a3dda

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Size

322KB
MD5

438865e77cbdc54d8a00c57a64f1b5a1
SHA1

a2a6af25ee28a9a0ade46734701bcebf15a7e4ab
SHA256

253ed82cd534713a8393692075c3c28f525dd43712671b3c42e43b20d66a3dda
SHA512

f490bc06a6801ff2a4f94fdc48d09239215d10a6a12141c71d3b71a58d9afc49ada318b3718bb6c035464a5bd5df3a851d05e77d105f831c9ae9a17a7eaf990c
SSDEEP

3072:XD2hT7lKbvfldRMtyyYyOTXsF5XN10A8oPcnDArqeFndYP0qz9X/0ljywg:XDe7lKbnlMg/yO7aNkAyeNFnUHZUWP

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2212	ctxmon.exe

Loads dropped DLL 1 IoCs

pid	Process
2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\atitool = "C:\\Users\\Admin\\AppData\\Roaming\\pwrwin.exe"	ctxmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\atitool = "C:\\Users\\Admin\\AppData\\Roaming\\pwrwin.exe"	ctxmon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yazzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctxmon.exe"	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\recover.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SyncHost.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\tracerpt.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\odbcconf.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\raserver.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\odbcad32.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ComputerDefaults.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\net1.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\replace.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sdbinst.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\setupSNK.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\InfDefaultInstall.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mtstocom.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wowreg32.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\esentutl.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\RMActivate_isv.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\prevhost.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\reg.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SearchIndexer.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wsmprovhost.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\forfiles.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gpupdate.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dpapimig.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mfpmp.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\cmdkey.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\com\comrepl.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\gpscript.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mobsync.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rasdial.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wscript.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\chkdsk.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\eventvwr.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msfeedssync.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\regini.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\setx.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wbem\WinMgmt.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\getmac.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ktmutil.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wvmic.inf_amd64_neutral_b94eb92e8150fa35\vmicsvc.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msra.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mstsc.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\netsh.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\PkgMgr.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\unlodctr.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\credwiz.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\doskey.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\netbtugc.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\TSTheme.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wextract.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\bootcfg.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\certutil.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\efsui.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mcbuilder.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ntkrnlpa.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ntoskrnl.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\sdiagnhost.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\compact.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DevicePairingWizard.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\tasklist.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WSManHTTPConfig.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fontview.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jabswitch.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Journal\Journal.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Journal\PDIALOG.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\Chess.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\sidebar.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\klist.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Mail\WinMail.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\keytool.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\WMPDMC.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{25A399C8-ED60-41E8-9A07-9F291B0E4835}\chrome_installer.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\WMPSideShowGadget.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.2.9600.16428_none_dea50217efd0356b\msfeedssync.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_6.1.7601.17514_none_6e88c3faa2049408\WmiPrvSE.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_21ceb2d66a98ec2f\WMIADAP.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-cleanmgr_31bf3856ad364e35_6.1.7600.16385_none_6d1a8c84bedf66a4\cleanmgr.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_64\WsatConfig\9683999d889dc0b8782c782e2fc1aee5\WsatConfig.ni.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-where_31bf3856ad364e35_6.1.7600.16385_none_5da98f433f7e2878\where.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_6.1.7601.17514_none_c910d80f114e267a\vds.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_22f5c6aadf559287\MigAutoPlay.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_6.1.7600.16385_none_304988749d91936f\SystemPropertiesComputerName.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\msil_addinutil_b77a5c561934e089_6.1.7601.17514_none_1a816bc7556b71eb\AddInUtil.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_6e30004a126a8db7\ntoskrnl.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\poqexec.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..restartup-baaupdate_31bf3856ad364e35_6.1.7600.16385_none_9243b833ecd918df\baaupdate.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-taskscheduler-engine_31bf3856ad364e35_6.1.7601.17514_none_43d2529dd579f798\taskeng.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_6.1.7600.16385_none_851e6308c5b62529\qwinsta.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ConvertInkStore.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.17932_none_d088def7226177d5\setup16.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-csrss_31bf3856ad364e35_6.1.7600.16385_none_b4d8d57efdc6b4f3\csrss.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-d..pwindowmanager-core_31bf3856ad364e35_6.1.7601.17514_none_ebc99983d3d18578\dwm.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-directshow-dvdupgrd_31bf3856ad364e35_6.1.7600.16385_none_7d9cbcec3df8da86\dvdupgrd.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_11.2.9600.16428_none_ae214da780801b0f\RegisterIEPKEYs.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.17514_none_b57215bac8c6d647\appidcertstorecheck.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-findstr_31bf3856ad364e35_6.1.7601.17514_none_855590d1705431c5\findstr.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_6.1.7600.16385_none_ca61f601a4548b8e\setup.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-mspaint_31bf3856ad364e35_6.1.7600.16385_none_8df3dcc84fe54e8b\mspaint.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\loadmxf.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_6.1.7601.17514_none_4afdc98b09e3cfe8\PkgMgr.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_6.1.7600.16385_none_c09aa5b3bec88beb\BdeUISrv.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad\lodctr.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-d..ervicing-management_31bf3856ad364e35_6.1.7600.16385_none_5e7ff93b6f0000b7\Dism.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-diantz_31bf3856ad364e35_6.1.7600.16385_none_a69c6a8f23f521f3\diantz.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_netfx-dw_b03f5f7f11d50a3a_6.1.7600.16385_none_a223bd3dd785391a\dw20.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281#\df459c0a2762c33e0699703f186b1751\Microsoft.Workflow.Compiler.ni.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_6.1.7600.16385_none_5cbb962a4f0d58c1\comp.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_6.1.7601.17514_none_0a026c46104dd379\msinfo32.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-rpc-locator_31bf3856ad364e35_6.1.7600.16385_none_2b2984d40648fbe7\Locator.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_6.1.7601.17514_none_b5ac5cc3a1b7e9ef\BitLockerWizard.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\reset.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.2.9600.16428_none_eab4546b9b62b250\wextract.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.17514_none_b57215bac8c6d647\appidpolicyconverter.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.17932_none_d26a33ec18cb49c4\conhost.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_6.1.7600.16385_none_c10c2a29895d4994\gpscript.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_6.1.7601.17514_none_ce2d22115368db7a\WerFault.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-robocopy_31bf3856ad364e35_6.1.7601.17514_none_c90e996c4aa655c4\Robocopy.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\dfsvc\261c09179eae03d67c9b6f3e70b603bd\dfsvc.ni.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1196a9003b674a92\iexplore.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7601.17514_none_a0cf62efee3228a3\wab.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_6.1.7600.16385_none_9cef76e6ecab612f\SystemPropertiesHardware.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-com-complus-setup_31bf3856ad364e35_6.1.7600.16385_none_e97e2f6c50a1c3c0\mtstocom.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\print.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_6.1.7601.17514_none_884c69064922f75b\msinfo32.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7601.17514_none_352b5454878cd498\AxInstUI.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_698fc88e65b943d6\wmpconfig.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-synchost_31bf3856ad364e35_6.1.7600.16385_none_c575fec016436d8a\SyncHost.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-nslookup_31bf3856ad364e35_6.1.7601.17514_none_cd87dddbc4b4a790\nslookup.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-autofmt_31bf3856ad364e35_6.1.7601.17514_none_441a424cd5cda219\autofmt.exe	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2212	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2212	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2212	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2212	2292	438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\ctxmon.exe
  C:\Users\Admin\AppData\Local\Temp\ctxmon.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\pwrwin.exe

Filesize
239KB

MD5
c6684504d881a42aedf492c7ce76403b

SHA1
e189b4d471ae2401d566d339ee2882d71a96d1c8

SHA256
b05f84c33df2974f481ad29b254cbfda0f7ae6b5f3f89a8598eea543b6f0b901

SHA512
6753febce42a22368966ccbe138fad3d6cc22337ec5f658625d7e71f789552e6ce82067aa2f94176a0d1ba92b7ab30f2ce4bf17417ee6bebc1455d63895ada3c

Download Submit
\Users\Admin\AppData\Local\Temp\ctxmon.exe

Filesize
115KB

MD5
b41dd2240b072ec09744353fc20b7f83

SHA1
33ffb4d4d4cb3e38b674d71abef6e9946b0cf9a8

SHA256
2b8614f538c2d60ff88db94992fd42f938e444d0074308f8a02f3e7d7e38c3d3

SHA512
8fcc0366f7ea38b474205a6f9e1a0e7ca41dfc16be59e5c06b72eed32b83fb1936bbe1a2b9d77231dcff06d615347e51e9d0e7ec3f8fad31f42d1b4829adedd1

Download Submit
memory/2292-4-0x0000000000170000-0x00000000001A5000-memory.dmp

Filesize
212KB

Download
memory/2292-2-0x0000000001000000-0x0000000001054000-memory.dmp

Filesize
336KB

Download
memory/2292-11-0x0000000001006000-0x0000000001008000-memory.dmp

Filesize
8KB

Download
memory/2292-9-0x0000000000170000-0x00000000001A5000-memory.dmp

Filesize
212KB

Download
memory/2292-10-0x0000000000170000-0x00000000001A5000-memory.dmp

Filesize
212KB

Download
memory/2292-13-0x0000000000170000-0x00000000001A5000-memory.dmp

Filesize
212KB

Download
memory/2292-14-0x0000000000170000-0x00000000001A5000-memory.dmp

Filesize
212KB

Download
memory/2292-15-0x0000000001000000-0x0000000001054000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads