Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19-07-2024 03:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe
-
Size
134KB
-
MD5
5a3f73137d4f161e86bb4c9e5d64529d
-
SHA1
7e0b931bec998f385da263407c70656828f13023
-
SHA256
16e267e9d60c4fbc377c525d8c45c0116d149435fc3f16d45e3fa01579f74de6
-
SHA512
8cdaaa4eebb030025edd9f0be229b54a0f40c905e9bb9df8ac78be6ba3b1eb95c04bae48857539a81a541b35cb575472972e3f5d224b65736c1971f6e81ec26f
-
SSDEEP
3072:YAQ0n/T3dRweSmo/c9Ad+8AQdURjzT0hMgFcEEwR:RQ0n/TseQU9yAoFD
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 32 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\en-US\scannerprocesses.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\WFPLWFSOperating.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\uk-UA\scannerSoftWare.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\OperatingWFPLWFS.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\uk-UA\WindowsSystem.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\WFPLWFSOperating.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\uk-UA\WindowsSystem.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\scannerSoftWare2.4.5600.00108171148.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\NDISCAPMicrosoft10.0.19041.1.160101.0800.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\OperatingWFPLWFS.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\SystemWFPLWFS.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\scannerprocesses.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\OperatingSystem.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\processesSoftWare.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\SystemWFPLWFS.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\scannerSoftWare.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\NDISCAPMicrosoft10.0.19041.1.160101.0800.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\SystemMicrosoft10.0.19041.1110.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\WindowsWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\WindowsWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\scannerSoftWare2.4.5600.00108171148.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\uk-UA\scannerSoftWare.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\scannerSoftWare.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\scannerscanner.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\scannerscanner.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\OperatingSystem.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\SystemMicrosoft10.0.19041.1110.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\scannerprocesses.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\processesscanner.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\processesSoftWare.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\scannerprocesses.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\processesscanner.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicrosoftInstaller41 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe" 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\miniinstallerOneDrive = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe" 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Speech\Engines\SR\fr-FR\OperatingWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\et-EE\XamlOperatsioonissteem10.0.19041.1.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\amdsbs.inf_amd64_e2a1e49127fb17ef\ControllerAHCI.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_skl.inf_amd64_b68199ad84607c21\iaLPSS2iGPIO2IntelR.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Dism\de-DE\scannerSoftWare.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\xinputhid.inf_amd64_b01c6ccf7f1e23b6\SystemOperating.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\en\resourcesWindows2.4.5600.00108171148.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_8bc1bda6cf47380c\Microsoftmxdwdui.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmirmdm.inf_amd64_ba5b77b7d46bc10d\MicrosoftWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\es\CommandsSystem.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\oobe\fr-FR\scannerscanner.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\de-DE\F12Platform2F12Script.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\usb.inf_amd64_683fd853c8b8a4db\SystemOperating.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\ja\scannerscanner.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wbem\en\MicrosoftWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ehstortcgdrv.inf_amd64_5cb0c23f45dac01c\EhStorTcgDrvSystem10.0.19041.1.160101.0800.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\ExecutablePlatform.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\usbcir.inf_amd64_a19f675674962ae4\ircoinstOperating.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\en-US\processesscanner2.4.5600.0.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wudfusbcciddriver.inf_amd64_a084e687a06b255f\MicrosoftWUDFUsbccidDriver10.0.19041.1.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\it\operativoresources.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wdma_usb.inf_amd64_e879d41db6fd1ab8\WindowsMicrosoft.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\oobe\fr-FR\scannerscanner.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Sistemadtsh.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\ja-JP\scannerprocesses.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\ja-JP\wmicWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\migration\ja-JP\WindowsSystem10.0.19041.1.160101.0800.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidbth.inf_amd64_76fb27776958e530\Systemhidbth10.0.19041.423.160101.0800.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\ko-KR\scannerprocesses.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\Miniportkdnic.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\en\MicrosoftOperating.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\MUI\040C\Microsoftscanner.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\fr\resourcesWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\Windowsspsreng.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\fr\Commandsresources10.0.19041.1.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\iscsi.inf_amd64_c089962740ea1f84\WindowsiSCSI.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsClient\scannerscanner.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\es\processesoperativo.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Dism\it-IT\SoftWarescanner.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\scannerMicrosoft10.0.19041.964.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sk-SK\SyncResWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\en\resourcesMicrosoft.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\MicrosoftWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\es\Sistemaoperativo.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\fr\AppVSoftWare.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\MUI\0411\scannerscanner.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppBackgroundTask\scannerOperating2.4.5600.00108171148.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshmsgWindows10.0.19041.1.160101.0800.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\nl-NL\OperatingMicrosoft.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\MUI\0407\scannerSoftWare.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\PerceptionSimulation\VirtualDisplayManagerSystem10.0.19041.1.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\uk-UA\MDMINSTdot3ui.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\es-ES\WindowsSistema.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\FirewallWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\EventingOperating.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mf.inf_amd64_e3c6d8265de5138c\Microsoftmfinf.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\res\padrs411padrs804.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\en\Microsoftresources10.0.19041.1.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Provisioning\SystemSystem.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\usbvideo.inf_amd64_b401376fd0a39c95\Systemsecureusbvideo.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\fr-FR\dexploitationSystme.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MUI\0407\scannerSoftWare.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\es\operativoresources.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\ControllerPCIE.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ietoedgestubexeietoedgebhodll.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\it-IT\Windowsoperativo.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\en-US\Windowsmsdaorar.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\WAB32Windows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\AcrobatAdobe.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AcrobatAiod19.8.20071.303822.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ja-JP\MicrosoftWAB32res.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservicemaintenanceserviceinstaller124.0.2.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleGoogle.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Internet Explorer\de-DE\iexploreExplorer.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\VisualStudioVisual10.0.60828.0.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\msadc\it-IT\msdaprsrWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\msadc\fr-FR\msdaprsrSystem.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\ExplorerInternet.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\operativoPowerShell10.0.19041.1.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\ExplorerInternet.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Internet Explorer\it-IT\iexploreieinstal.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\WindowsWordpadFilter.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\operativoPackageManagement.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\PackageManagementMicrosoft10.0.19041.1.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\BrowserControl.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleGoogle.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\AdobeHunspellPluginAdobeHunspellPlugin.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\UtilitiesFramework.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\MicrosoftMicrosoft.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\MicrosoftWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\MicrosoftWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\MicrosoftOperating.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstallerVSTOMessageProvider10.0.60828.0.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\fr-FR\iexploreieinstal11.00.19041.1.160101.0800.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\fr-FR\dexploitationWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\en-US\OperatingWAB32res10.0.19041.1.160101.0800.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\SystemOperating.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationProviderUIAutomationClient.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\WindowsOperating.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libceflibGLESv2.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_80203\Platformjava8.0.3810.9.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\msadomdmsadox10.0.19041.1.160101.0800.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\msadc\en-US\Windowsmsdaremr10.0.19041.1.160101.0800.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\de-DE\WindowsWAB32res10.0.19041.1.160101.0800.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\WAB32Windows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\it-IT\msader15msader15.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\Install\{B0092916-300D-42A1-8132-6122DFFE037F}\GoogleInstaller.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\SystemBuild.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\wmplayeroperativo.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedgeproxymsedge.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCoreReachFramework.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\it-IT\iexploreieinstal.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32Microsoft10.0.19041.1.160101.0800.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\Registrationjaureg2.8.381.9.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\TipResSystem10.0.19041.1.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.106\Chromeminiinstaller.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\NPPDF32Adobe.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ja-JP\ieinstalieinstal.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\mshwLatinTabTip3210.0.19041.1.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\MicrosoftVisual.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\WABMIGSystem10.0.19041.1.160101.0800.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\es-ES\operativooperativo.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Edgemsedgeupdate.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\es-ES\Windowswmplayer.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\OperatingSystem.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexploreSystem11.00.19041.1.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\en-US\WindowsSystem.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.41\EdgeMicrosoftEdgeUpdateSetup.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-m..rsist-rll.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4b131c6926a5c261\OperatingWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-peopleband.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_65f37b2fbde46355\dexploitationdexploitation.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-o..p-raschap.resources_31bf3856ad364e35_10.0.19041.1_de-de_28f21e2f8e6db492\raschapMicrosoft10.0.19041.1.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\system.data.sqlxml.resources\v4.0_4.0.0.0_it_b77a5c561934e089\systemsystem.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_system.servicemodel.web.resources_31bf3856ad364e35_4.0.15805.0_es-es_170b4c1b943349e2\resourcesSystem.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_fundisc.resources_31bf3856ad364e35_10.0.19041.1_en-us_9428811a5c16a435\FunDiscMicrosoft.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cmisetup_31bf3856ad364e35_10.0.19041.964_none_f895b4edb7317563\WindowsSystem.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..ty-client.resources_31bf3856ad364e35_10.0.19041.1_it-it_8d463f1f468dfb25\Sistemamstask.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalersFramework.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_multipoint-wms.eventlogmsg.resources_31bf3856ad364e35_10.0.19041.1_de-de_207ff52424ef90f8\MicrosoftWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..shell-mui.resources_31bf3856ad364e35_10.0.19041.1_it-it_8dd9e6841418d9ff\SistemaPOWERSHELL.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pnpdevicemanager_31bf3856ad364e35_10.0.19041.1_none_d41c5247f33f0123\MicrosoftSystem.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.19041.1_none_2b5d9ada52bb3bfe\InternetOCCACHE.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..orkclient.resources_31bf3856ad364e35_10.0.19041.1_en-us_6f7e2100560daf0e\win32splOperating.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nese-core-essential_31bf3856ad364e35_10.0.19041.1_none_5fb83c6969e4c59f\ImTcCoreWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..r-library.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_69e57eaf8cbcbfb6\SystmeMicrosoft.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..utilities.resources_31bf3856ad364e35_11.0.19041.1_uk-ua_de8d9a4ef83eda77\IeRtUtilInternet.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-defender-events.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c7b55c8a31812a56\MicrosoftOperating4.18.1907.16384.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\1036\mscorsecrFramework.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ja\bridgeservicemodelreg.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_00d7ad6537414f31\StudioMicrosoft8.0.50727.9149.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-o..ap-rastls.resources_31bf3856ad364e35_10.0.19041.1_en-us_3498f60021fb6a92\rastlsSystem.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ne-dsacls.resources_31bf3856ad364e35_10.0.19041.1_it-it_2215fb0c0907e8e8\operativoDSACLS.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Utility.Activities.Resources\v4.0_3.0.0.0_it_31bf3856ad364e35\PowerShellWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nwifi.resources_31bf3856ad364e35_10.0.19041.1202_en-us_86d6239ab7fe61ed\OperatingSystem.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directmanipulation_31bf3856ad364e35_10.0.19041.84_none_44bf3519cfab87ee\directmanipulationMicrosoft.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..orkcenter.resources_31bf3856ad364e35_10.0.19041.1_es-es_733a5c86dfd1217b\NETCENTERoperativo.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-main.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_8d9e6ed5af39e4d4\Windowsmain.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting-jscript9_31bf3856ad364e35_11.0.19041.1266_none_fca774289c5764c8\Explorerjscript911.00.19041.1266.160101.0800.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wwanhc.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_13e36a069156ad7d\Windowswwanhc.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_multipoint-wmsmanager.resources_31bf3856ad364e35_10.0.19041.1_es-es_b4bf1b713d506059\Windowsresources.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx-mscorsecr_dll_b03f5f7f11d50a3a_10.0.19041.1_none_667e17497f867867\mscorsecrFramework.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-lmprofile_31bf3856ad364e35_10.0.19041.1_none_08a5e5282a943190\imjplmpOperating.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-pku2u_31bf3856ad364e35_10.0.19041.1266_none_fd8a521e8809d8ec\Operatingpku2u.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.19041.1_es-mx_6ad0630b96d5eea6\SistemaMicrosoft.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_reachframework_31bf3856ad364e35_4.0.15805.0_none_9f7d844a8be440e6\ReachFrameworkFramework.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_system.runtime.serialization.resources_b77a5c561934e089_4.0.15805.0_ja-jp_f919913f83fa849b\Frameworkresources.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\OperatingMicrosoftAccount.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\MicrosoftServiceModel.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_74b1fbe62ef618a1\USERINITuserinit10.0.19041.1.160101.0800.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..-core-cpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_2c7a8cf74511b280\OperatingMicrosoft10.0.19041.1.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..m-library.resources_31bf3856ad364e35_10.0.19041.1_de-de_0019a4d75a4e4d49\wpncoreMicrosoft.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfc-class-extension_31bf3856ad364e35_10.0.19041.1_none_72eb68bb21c6646b\MicrosoftOperating.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..s-manager.resources_31bf3856ad364e35_10.0.19041.1_es-es_d6dbd5a0c6752567\SistemaCapability.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechengine-onecore_31bf3856ad364e35_10.0.19041.746_none_bc3036e3312c41cb\spsrxRecognizer.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..iamanager.resources_31bf3856ad364e35_10.0.19041.1_it-it_50e78fe9bf7a2626\SistemaMicrosoft.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..utils-dll.resources_31bf3856ad364e35_10.0.19041.1_en-us_dd46cf5fa0b19af2\miutilsOperating.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_microsoft.web.management.ftp.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3e3835d16b3a75c\MicrosoftManagement10.0.19041.1.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_uiautomationprovider.resources_31bf3856ad364e35_10.0.19041.1_de-de_7a03e7099e4787ef\resourcesUIAutomationProvider285.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\v4.0_10.0.19041.1__31bf3856ad364e35\SystemSecurity.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_windows-application..nd-timebroker-winrt_31bf3856ad364e35_10.0.19041.1_none_b57b0938aa63653d\MicrosoftWindows10.0.19041.1.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ncywizard.resources_31bf3856ad364e35_10.0.19041.1_de-de_71db99c2f3fbef73\BetriebssystemMicrosoft.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..etoolsgui.resources_31bf3856ad364e35_10.0.19041.1_de-de_6289c974f43a3931\perfmonSYSMON10.00.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-o..euapcommonproxystub_31bf3856ad364e35_10.0.19041.1_none_53037e1e54080c56\SystemMicrosoft.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-cleanup.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_74bf24378d4600d4\Microsoftscavengeui.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_fdwsd_31bf3856ad364e35_10.0.19041.746_none_5ba1ce4020f51d5a\WindowsWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\TransactionsHttp.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..es-fondue.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6a9629f3ac3fa3ac\WindowsMicrosoft.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..ofile-cim.resources_31bf3856ad364e35_10.0.19041.1_en-us_b521981ec130863b\WindowsMicrosoft.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host-api_31bf3856ad364e35_10.0.19041.264_none_4280a67eab38aa04\OperatingWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ole-automation_31bf3856ad364e35_10.0.19041.985_none_9acd392c5a6ac8a8\WindowsWindows.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-v..lient-wmiv2provider_31bf3856ad364e35_10.0.19041.1_none_b6e04df4280ebfac\MicrosoftVpnClientPsProvider.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..vider-rll.resources_31bf3856ad364e35_10.0.19041.1_it-it_65746b8a557730de\msdaorarSystem.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.19041.1_none_0b4e711bdf4c1580\WindowsMicrosoft.exe 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4996 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe 4996 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe 4996 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe 4996 5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a3f73137d4f161e86bb4c9e5d64529d_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD5d7e8908b0ef69040b68720dd2262aaee
SHA179f173d0074357607df8506697857b2eaf29a9f9
SHA25655bd8cf1354af1f97b868b849168fff6b8eea8a4ebc65e7836e479a1da943f22
SHA512bde3ceec3882c1b1f2059fc2bc84ce25bd5396f45d5f6c29d20696464dfce1cbb5773e5b84661d485c20b16e5a729258e301ef9250876a997e4d5fd6ca728c1b
-
Filesize
134KB
MD55a3f73137d4f161e86bb4c9e5d64529d
SHA17e0b931bec998f385da263407c70656828f13023
SHA25616e267e9d60c4fbc377c525d8c45c0116d149435fc3f16d45e3fa01579f74de6
SHA5128cdaaa4eebb030025edd9f0be229b54a0f40c905e9bb9df8ac78be6ba3b1eb95c04bae48857539a81a541b35cb575472972e3f5d224b65736c1971f6e81ec26f