Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 22:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe
-
Size
322KB
-
MD5
438865e77cbdc54d8a00c57a64f1b5a1
-
SHA1
a2a6af25ee28a9a0ade46734701bcebf15a7e4ab
-
SHA256
253ed82cd534713a8393692075c3c28f525dd43712671b3c42e43b20d66a3dda
-
SHA512
f490bc06a6801ff2a4f94fdc48d09239215d10a6a12141c71d3b71a58d9afc49ada318b3718bb6c035464a5bd5df3a851d05e77d105f831c9ae9a17a7eaf990c
-
SSDEEP
3072:XD2hT7lKbvfldRMtyyYyOTXsF5XN10A8oPcnDArqeFndYP0qz9X/0ljywg:XDe7lKbnlMg/yO7aNkAyeNFnUHZUWP
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2212 ctxmon.exe -
Loads dropped DLL 1 IoCs
pid Process 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\atitool = "C:\\Users\\Admin\\AppData\\Roaming\\pwrwin.exe" ctxmon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\atitool = "C:\\Users\\Admin\\AppData\\Roaming\\pwrwin.exe" ctxmon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yazzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctxmon.exe" 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\recover.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SyncHost.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\odbcconf.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\raserver.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\odbcad32.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\net1.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\replace.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sdbinst.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\setupSNK.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\InfDefaultInstall.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mtstocom.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wowreg32.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\esentutl.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RMActivate_isv.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\prevhost.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\reg.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wsmprovhost.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gpupdate.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dpapimig.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mfpmp.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cmdkey.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\com\comrepl.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gpscript.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mobsync.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rasdial.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wscript.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\chkdsk.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msfeedssync.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\regini.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\setx.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wbem\WinMgmt.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\getmac.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ktmutil.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wvmic.inf_amd64_neutral_b94eb92e8150fa35\vmicsvc.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msra.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mstsc.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\netsh.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\PkgMgr.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\unlodctr.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\credwiz.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\doskey.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\netbtugc.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wextract.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bootcfg.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\certutil.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\efsui.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\mcbuilder.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ntkrnlpa.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ntoskrnl.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sdiagnhost.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\compact.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DevicePairingWizard.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tasklist.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WSManHTTPConfig.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fontview.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7z.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Media Player\WMPDMC.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{25A399C8-ED60-41E8-9A07-9F291B0E4835}\chrome_installer.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Media Player\WMPSideShowGadget.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.2.9600.16428_none_dea50217efd0356b\msfeedssync.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_6.1.7601.17514_none_6e88c3faa2049408\WmiPrvSE.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_6.1.7601.17514_none_21ceb2d66a98ec2f\WMIADAP.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-cleanmgr_31bf3856ad364e35_6.1.7600.16385_none_6d1a8c84bedf66a4\cleanmgr.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\WsatConfig\9683999d889dc0b8782c782e2fc1aee5\WsatConfig.ni.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-where_31bf3856ad364e35_6.1.7600.16385_none_5da98f433f7e2878\where.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_6.1.7601.17514_none_c910d80f114e267a\vds.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_22f5c6aadf559287\MigAutoPlay.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_6.1.7600.16385_none_304988749d91936f\SystemPropertiesComputerName.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\msil_addinutil_b77a5c561934e089_6.1.7601.17514_none_1a816bc7556b71eb\AddInUtil.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17727_none_6e30004a126a8db7\ntoskrnl.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\poqexec.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..restartup-baaupdate_31bf3856ad364e35_6.1.7600.16385_none_9243b833ecd918df\baaupdate.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-taskscheduler-engine_31bf3856ad364e35_6.1.7601.17514_none_43d2529dd579f798\taskeng.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_6.1.7600.16385_none_851e6308c5b62529\qwinsta.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ConvertInkStore.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.17932_none_d088def7226177d5\setup16.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-csrss_31bf3856ad364e35_6.1.7600.16385_none_b4d8d57efdc6b4f3\csrss.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..pwindowmanager-core_31bf3856ad364e35_6.1.7601.17514_none_ebc99983d3d18578\dwm.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-directshow-dvdupgrd_31bf3856ad364e35_6.1.7600.16385_none_7d9cbcec3df8da86\dvdupgrd.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_11.2.9600.16428_none_ae214da780801b0f\RegisterIEPKEYs.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.17514_none_b57215bac8c6d647\appidcertstorecheck.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-findstr_31bf3856ad364e35_6.1.7601.17514_none_855590d1705431c5\findstr.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_6.1.7600.16385_none_ca61f601a4548b8e\setup.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-mspaint_31bf3856ad364e35_6.1.7600.16385_none_8df3dcc84fe54e8b\mspaint.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\loadmxf.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_6.1.7601.17514_none_4afdc98b09e3cfe8\PkgMgr.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_6.1.7600.16385_none_c09aa5b3bec88beb\BdeUISrv.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad\lodctr.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-d..ervicing-management_31bf3856ad364e35_6.1.7600.16385_none_5e7ff93b6f0000b7\Dism.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-diantz_31bf3856ad364e35_6.1.7600.16385_none_a69c6a8f23f521f3\diantz.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_netfx-dw_b03f5f7f11d50a3a_6.1.7600.16385_none_a223bd3dd785391a\dw20.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281#\df459c0a2762c33e0699703f186b1751\Microsoft.Workflow.Compiler.ni.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_6.1.7600.16385_none_5cbb962a4f0d58c1\comp.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_6.1.7601.17514_none_0a026c46104dd379\msinfo32.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-rpc-locator_31bf3856ad364e35_6.1.7600.16385_none_2b2984d40648fbe7\Locator.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_6.1.7601.17514_none_b5ac5cc3a1b7e9ef\BitLockerWizard.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\reset.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.2.9600.16428_none_eab4546b9b62b250\wextract.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.17514_none_b57215bac8c6d647\appidpolicyconverter.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.17932_none_d26a33ec18cb49c4\conhost.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_6.1.7600.16385_none_c10c2a29895d4994\gpscript.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_6.1.7601.17514_none_ce2d22115368db7a\WerFault.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-robocopy_31bf3856ad364e35_6.1.7601.17514_none_c90e996c4aa655c4\Robocopy.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\dfsvc\261c09179eae03d67c9b6f3e70b603bd\dfsvc.ni.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1196a9003b674a92\iexplore.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7601.17514_none_a0cf62efee3228a3\wab.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_6.1.7600.16385_none_9cef76e6ecab612f\SystemPropertiesHardware.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-com-complus-setup_31bf3856ad364e35_6.1.7600.16385_none_e97e2f6c50a1c3c0\mtstocom.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\print.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_6.1.7601.17514_none_884c69064922f75b\msinfo32.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7601.17514_none_352b5454878cd498\AxInstUI.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_698fc88e65b943d6\wmpconfig.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-synchost_31bf3856ad364e35_6.1.7600.16385_none_c575fec016436d8a\SyncHost.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-nslookup_31bf3856ad364e35_6.1.7601.17514_none_cd87dddbc4b4a790\nslookup.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-autofmt_31bf3856ad364e35_6.1.7601.17514_none_441a424cd5cda219\autofmt.exe 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2212 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe 30 PID 2292 wrote to memory of 2212 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe 30 PID 2292 wrote to memory of 2212 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe 30 PID 2292 wrote to memory of 2212 2292 438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\438865e77cbdc54d8a00c57a64f1b5a1_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\ctxmon.exeC:\Users\Admin\AppData\Local\Temp\ctxmon.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
239KB
MD5c6684504d881a42aedf492c7ce76403b
SHA1e189b4d471ae2401d566d339ee2882d71a96d1c8
SHA256b05f84c33df2974f481ad29b254cbfda0f7ae6b5f3f89a8598eea543b6f0b901
SHA5126753febce42a22368966ccbe138fad3d6cc22337ec5f658625d7e71f789552e6ce82067aa2f94176a0d1ba92b7ab30f2ce4bf17417ee6bebc1455d63895ada3c
-
Filesize
115KB
MD5b41dd2240b072ec09744353fc20b7f83
SHA133ffb4d4d4cb3e38b674d71abef6e9946b0cf9a8
SHA2562b8614f538c2d60ff88db94992fd42f938e444d0074308f8a02f3e7d7e38c3d3
SHA5128fcc0366f7ea38b474205a6f9e1a0e7ca41dfc16be59e5c06b72eed32b83fb1936bbe1a2b9d77231dcff06d615347e51e9d0e7ec3f8fad31f42d1b4829adedd1