f15d4e50aaefacc9ef3e349de66e751e327c7b72d115b33d392a5d29a995eebd

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
Size

348KB
MD5

5eab0dffc5c17bce13d167e556b0b5da
SHA1

b0f7002e5d7ff7a65c3df353227031f18cdaa13a
SHA256

f15d4e50aaefacc9ef3e349de66e751e327c7b72d115b33d392a5d29a995eebd
SHA512

cf58f364fb646f9082de6847455f07884b9988f97492a149fe6ffdbcdc79304fbe1b57f2a23a3c142f283a697d95684951ad28c4eee8b7fe98243f760e9a2e9d
SSDEEP

6144:ppMM8EV1kmffCpJip7WDBDRTUDsDvA8X9S1:URmfaXiE1DmITA8a

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Contacts a large (1386) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ati display driver = "ÔN@"	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SystemPropertiesPerformance.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mode.com	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sort.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\nslookup.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\poqexec.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Bubbles.scr	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\SystemPropertiesComputerName.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wlanext.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\netiougc.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ntkrnlpa.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\setx.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\instnm.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msfeedssync.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\netsh.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\odbcconf.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ssText3d.scr	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\mighost.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MRINFO.EXE_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\RMActivate_isv.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Robocopy.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sethc.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\user.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\choice.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\grpconv.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\rekeywiz.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sdbinst.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\verclsid.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WerFault.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\write.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\diskcomp.com-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\perfhost.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\proquota.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\recover.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\systeminfo.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\vssadmin.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wsmprovhost.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\xpsrchvw.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drvinst.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\powercfg.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\label.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\rundll32.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Utilman.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winrs.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\charmap.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\iscsicpl.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMEJP10\IMJPDADM.EXE_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\cacls.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dvdplay.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dxdiag.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMEJP10\imjppdmg.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\_isdel.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MRINFO.EXE	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\newdev.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\colorcpl.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\driverquery.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ntprint.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\tzutil.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WPDShextAutoplay.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\chcp.com-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\finger.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\verifier.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\dpnsvr.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\RpcPing.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\chrome_installer.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Windows Mail\WinMail.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Windows Media Player\wmpenc.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\bin\ktab.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Media Player\wmpenc.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Windows Journal\Journal.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\bin\javaws.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Mail\wab.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\bin\java.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\bin\klist.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Windows Mail\wab.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.bat_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ashgabat-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\sidebar.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Media Player\wmplayer.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\bin\klist.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-taskhost_31bf3856ad364e35_6.1.7601.22172_none_86ab4a318a459fda\taskhost.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-fontview_31bf3856ad364e35_6.1.7600.16385_none_443a636317ca9b75\fontview.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-fsutil_31bf3856ad364e35_6.1.7600.16385_none_cc3a6a9c514031a2\fsutil.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-choice_31bf3856ad364e35_6.1.7601.17514_none_218cf07ba262766c\choice.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_bf4980401574a899\logman.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_6.1.7601.17514_none_42ee5aff60183c81\iscsicli.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\IMCCPHR.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_8.0.7601.17514_none_3eb101caec1acc2c\ie4uinit.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_6d6b3cfb6a5a1e5a\newdev.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-winhstb_31bf3856ad364e35_6.1.7600.16385_none_28dc647c6aba6742\winhlp32.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\tskill.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.7601.17514_none_b296f701dc00c582\ieUnatt.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_76239aafb364e805\rasautou.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..erinboxgames-spades_31bf3856ad364e35_6.1.7600.16385_none_6fa6d7361acba514\shvlzm.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.2.9600.16428_none_3bb1024f1e6bc086\mshta.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_6.1.7600.16385_none_6d0100c50efddc3c\RunLegacyCPLElevated.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\reset.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4a5d2c9ecd59afa7\dnscacheugc.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_6.1.7601.17514_none_2d3b8ff08901343f\DismHost.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\ehome\ehtray.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_6.1.7600.16385_none_94861149bb66249c\powershell_ise.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..integration-support_31bf3856ad364e35_6.1.7600.16385_none_8429bbdebd38db4a\isintsup.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-iecleanup_31bf3856ad364e35_11.2.9600.16428_none_a03d6846a99c1c87\iecleanup.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sidebar_31bf3856ad364e35_6.1.7601.17514_none_2d02b12c3d47a517\sbunattend.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sysinfo_31bf3856ad364e35_6.1.7600.16385_none_4b49a2c2123fd42c\systeminfo.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\ehome\McxTask.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7601.17514_none_dfe02de35bf41e0b\PrintBrm.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..s-regkeys-component_31bf3856ad364e35_6.1.7601.17514_none_58b4153116c17b41\RDVGHelper.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wvmic.inf_31bf3856ad364e35_6.1.7601.17514_none_6007c443630c03aa\vmicsvc.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_edmgen_b77a5c561934e089_6.1.7601.17514_none_cddf79f7120d371d\EdmGen.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ribbons_31bf3856ad364e35_6.1.7601.17514_none_8abc4ded863e0452\Ribbons.scr-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\WsatConfig\537950d9c71af966e1d8c9deb550f842\WsatConfig.ni.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-isoburn_31bf3856ad364e35_6.1.7601.17514_none_4458ac8eafdacbdd\isoburn.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ddodiag_31bf3856ad364e35_6.1.7600.16385_none_924b83b9b69fb351\ddodiag.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\print.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-scripting_31bf3856ad364e35_6.1.7600.16385_none_a45d44bd1a0af822\cscript.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-soundrecorder_31bf3856ad364e35_6.1.7601.17514_none_fd2f4b124982e400\SoundRecorder.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_6.1.7601.17514_none_4e297fab940bc0e5\ntprint.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_6.1.7600.16385_none_806f80a8aaa33dd4\sdiagnhost.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-xwizard-host-process_31bf3856ad364e35_6.1.7600.16385_none_58ca66f699d77ff1\xwizard.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_6.1.7601.17514_none_d4c5c995fb3f4a1b\audiodg.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-filtermanager-utils_31bf3856ad364e35_6.1.7600.16385_none_1964092586ab4352\fltMC.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sethc_31bf3856ad364e35_6.1.7601.17514_none_64c7a8e4d35d675c\sethc.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sethc_31bf3856ad364e35_6.1.7601.17514_none_c0e644688bbad892\sethc.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\ehome\McxTask.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_6.1.7600.16385_none_3157c24b5944e2a3\eventcreate.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_6.1.7601.17514_none_c1fead4e4bf85947\IMTCPROP.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-verclsid_31bf3856ad364e35_6.1.7600.16385_none_bbbd275974c7e191\verclsid.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\1bc1ee3c3aa45d28dcf4657bceb2fcb4\SMSvcHost.ni.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\ehome\ehmsas.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-driverquery_31bf3856ad364e35_6.1.7600.16385_none_f217bd1caebaa683\driverquery.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-securestartup-tool-exe_31bf3856ad364e35_6.1.7601.17514_none_5840c326cdf5dca9\manage-bde.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_6.1.7601.17514_none_ac02530437b71a3f\mstsc.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_6.1.7601.17514_none_4c8976380e00631f\WMPDMC.exe-	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ieinstal_31bf3856ad364e35_8.0.7601.17514_none_055d8a4166e66f09\ieinstal.exe_	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E60819F1-463E-11EF-8031-C644C3EA32BD} = "0"	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000014a11548faac1f24ded278893ce3dc9d6a041a6b0450778856d56ad89dff3b12000000000e8000000002000020000000d22ecf0ec9e810899f39bc2cc6bf7a10b5047be0e985c9639fb2aad2b62d98a120000000b4f6b4c4598494e6a2e548354b715c9cd1002b17a1b9b6b90b0832324467994a400000002a4917074660b98af9c1f6f570424da7d6636660b4aecf8a53d4e86a22f2ba1a04404a2e74d8a902595b22e934eaa5c1cb048d0955d10b5995b408ebff2589df	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000a5a0df1979db850edd31d14115ab343515ad41e61d384550b223446297103465000000000e800000000200002000000029d7a70110b2e010a0c39afa06392b16b0d9a0898d2de7d8c8bf08cb7d42743d900000006f63135b83497f63a6113880197d361de958e6c003b0c5c4e94b07152b1c670beb2e2c1d783ebf2b05642b2da1337cc5ef5948dda23603cf832df33e8bdbba1f08e4be5655e66f8c698ff49e482e163b9baa30982ecae9c0add9b6c36b49b310c75deb835e9f290b0718df394d29752a2eb6d7acf1705328c0f91e12ec5e7fda8274d0146653f704da7e1fdee76badee4000000063d0d07cb7273deae3c1f31cf36b830e2cd4218610beb2f69da8d347c5c3049938e2fad987bcb1a163a3e47971adae6673dda29bf719db1481234886527d290d	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427604011"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3009adbc4bdada01	IEXPLORE.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
828	IEXPLORE.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
828	IEXPLORE.exe
828	IEXPLORE.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 828	1068	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe	29
PID 1068 wrote to memory of 828	1068	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe	29
PID 1068 wrote to memory of 828	1068	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe	29
PID 1068 wrote to memory of 828	1068	5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe	29
PID 828 wrote to memory of 2180	828	IEXPLORE.exe	30
PID 828 wrote to memory of 2180	828	IEXPLORE.exe	30
PID 828 wrote to memory of 2180	828	IEXPLORE.exe	30
PID 828 wrote to memory of 2180	828	IEXPLORE.exe	30

C:\Users\Admin\AppData\Local\Temp\5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5eab0dffc5c17bce13d167e556b0b5da_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Program Files\Internet Explorer\IEXPLORE.exe
  "C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:828 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

Filesize
495KB

MD5
19c7af3efd777c3563bcbc0f623abab5

SHA1
53616178ef9f0dded41d8c3d471c9d9bd03a7c73

SHA256
7a475fb57d80ef8a2e4bfcbe36500effa690243d0c2e888e5e6111710a0027c6

SHA512
8c628ab543a1863408b992e0baf993882534c412fef37bfb790ea31314faf39a461ea7ca412fb5e715363321af0df3bdcea03dad1a4e058d56ab2d3b5b3f9c49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25859e0a73963233bf9617632c5d7d59

SHA1
c6077674e410f57694c3a58c68871b4355cae4cd

SHA256
0667fca28b54224d2b8159f383e0e27d287ff6b153f376b507f1f01722756d37

SHA512
7a5e2a50df1e38e571f4f1cc8b11d980d77598ac8aabc768a1a9287a8264c0ccafcc95dbae3d66b69b5e1e346e88a1de9dbf3b67342d44b19ce56cbd6a146333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
253fa576313ea7318635e6d640e46575

SHA1
a06e23ef5810ee58281ed7906c3f19deafbdf266

SHA256
549506918da00ead389210828ccd648647ad3b67c0f2e69e0e7c708d70da47f3

SHA512
c160118bf8e157e8bcc68e29b29248a4073fa3015989e871503e95896c8835a65942d497c742ca43e68f88d4eff388eb1e1e2e8a5a3606f23c0404278348394f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f6e074053c2a735c994cefeafeab224

SHA1
5f3c66fbd4edfa7907df13d16f6f548fe75392c8

SHA256
01f3d51bf539681a420ea88346f5658daeb7dd27f9baab5612427019e3c8dda4

SHA512
a0cfea27765e5253d979f3dcf48d6e7a36c3cf31a7930332a022552da56bff9b05d073ec2b744dd6e5fa675a76b9387d81416a416813896eea132953c34b777a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebc0bbff8040d2c0989f478a429dd649

SHA1
46d844a1df7a4fc408c6533e6ad50a74be17a398

SHA256
0d45b9da0fff7b2b5db1de6fbdc5f47a3ff52530ff6b535f280f2e519983b533

SHA512
e745ca9403bc95648a025ee529bd313023e072e5542495e4f1ff9d84c0d70a39d9eb439b125bfe01ed6528c42b3d7d936becc9f1735bedad32e8616f452c8a02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
053e60ad0b36491c020365dee553a00d

SHA1
ee4fdbedff47d780dfc81bf4fad2d38e8e9c4745

SHA256
1aa0e542f094fc0bfb7e66055efe5e4524f2ea4c13591adb98e4c2e8b5743027

SHA512
9e8979459ba2949dc3ea11fd0ee48ee1f4e4e3b8e975d4311d35110a16721fd30c42a89bebd79b212b755389e197d2e9cb396a1dc65c83993ed82d8296061ee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fecbea668db1741e18719151e492f66

SHA1
458f08ea257243a12b79c9a47e80ccbdeba8fbdc

SHA256
d98ccd35eb70f14fef8e156c55277e2971723f88ff45df7b9ecd6a1498c4c375

SHA512
793c84ff9a2fe0ddeaf9a38c779bdcb3d3cd7f3951390c9515935a0c78c46188c7adbbf2bd57c81f546ad40dbd99dafda7f859d0357f4c08c9ff1c2e8125df0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
044e150c9ccfd12069b153a0c6b041d2

SHA1
ddcc1d19c9b5f75596816b3e5ffcba72efb88398

SHA256
044a125ef3ebd8c8a1f7858f996327f6cf272d4bc8d8708cd2d9aa2d6e9715ac

SHA512
5685ec4b1d648724a29cec709c25d031931d469b8387d804a1641be778ebbfa2b6e5030d6dc619a027997a2b283e2d4bccca840157aa81cafe7339c8e89f825c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12680074b3d63504188876f304c89eb1

SHA1
3786d7e284e91ca881b61807c9687a20872a7290

SHA256
3d25bc26ff07533411fe331e44de890b148117cbc540cc62bb5fffd4d104e875

SHA512
d7c6e016265cf4d09aeef48b98fdac063fb8556d1ad261e1742edd31686bfa232252f005eff00088e3db5699adf83380e9ed402303e8e991d5444c9d41371358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c5b683a75a8b9b74bed60a86cd1ca16

SHA1
f891e4e9ab733eda96e2014a14f20e6e26ac9b7f

SHA256
173f71efb2f43263dbc4e863da926b1515395521d2afb70a6377e467a365cb7f

SHA512
48e7c5bcf6ea4253793529c06358e33740e8464b400afaadf0bfd31a3f707d420a7bbb6b88908dda00cf4730705c3bba5c0a23ece81828d572e914e057841970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa049f090d561fb098e8d1e800db5cc2

SHA1
8a3fa5c4f5bc2961efa015bd35838c80cbe8c9f8

SHA256
b25277bb4b662b3eaa16691e0c4191e6b6fa454c13ac95031ab74b6883f428bb

SHA512
380505ae519d410a4e721ad8ac0181ee48ff5e2821742c98247738c1d31f9341400ca64b767ff6070361ed5d6e91a0faaf906104a1a95eaa471e6648af23e522

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f6dd7d6938545e282a13754a3fdc9fa

SHA1
2c3939f9fb5ccf46a31ad88a0c008f54903befb4

SHA256
74c34f59cc124b495138e23f691ae74f5acad1059d5e5f88d269cb0c7a7be979

SHA512
5b8be3618aa54f71b3433ac25455f2309c937c7cfbd0d1ffe0032ded13046fe95839aee4707fb80d44685ffda5d7442908d80c65ae224f9bbddf764a86e7c932

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7c0cab1898bf5293d49261c9a3f6338

SHA1
73f05beb3dba80cfeaba8496cbf838ef77effe68

SHA256
8653cc297755158ed813e855aa28f4b02be89d1508db1528e3badcb5fd77f7cb

SHA512
67228f5cf089680feffa5369622ec6b1ed12424941e21b5eb25918e3dad74e12f75cd60eb06280e84145962114a355998606e77ac3f5f2db48d857cb29b4f4c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f48c76a14ffd45e2c0636a5651b8cdc

SHA1
0557e8970e6063e06150585ac10a106177c2b3b7

SHA256
ceaafdf48a835e3b7d4b0ef349b275db1726d568b10409bc4af645b88c642925

SHA512
2e0ce63fb30cd4576fc3bd7be9767f3a61690964de6afdc0d5cce0981197d7e6d27d444419875d49702e32943d6fddaf3bd62d735a0c8d83d940233d901485d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d3a5c186abca14fd2dceddc8eb5a344

SHA1
41913c520878430c376b0619d7e0dd36a258586a

SHA256
3eac45b778ac59afe98072769113f4fe3671988d27cc20288e6a32acefa624c9

SHA512
4397f661fc7d1d4b082c07fe26f17c4474acce075c1fde53975e6f544200976aad3842602c699ca41e524f3a16cc630c8a3ec9aea38ff35f505c4949c48f97cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63fb45ba238938fed4ce47f9c2da3f30

SHA1
65e81cb911b202f7ba5b7c1904d9a8b0aab00e51

SHA256
cc3dd761d650747221eab211fa875a9ecf2ab8c8ae9facb9e90d37f032d4eab4

SHA512
a83eb751d1af7a55b853abb7a45e3104dbe61bffca4fce629b81e7e5ddfb8ea351c2cd24b10360745d6a49e11262037029d4241e30a8beeaec40f0f9dff0de68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acd88d867fc3d23c3f800551161d55d0

SHA1
04113ab24554faeb1b5d7448761787cc7e286f54

SHA256
c103235f6682a0804035d4dc0d85ba1a2ac6f1ee2ade4626950348f9a2146f05

SHA512
e8713bcf12eb90bcbd9de34ba197eafdd283ad6b0f5af309173fdc6655a9fd6e7d1457d3f274f3f6554bde80421db9c41423d5cb58d2f10cb208d24d3908b7b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82226c37b7f706a2be10f66bae3f9588

SHA1
8f0ff377f86e86cfcd47a356e6b946c73169f7a5

SHA256
e065a91b4ef23c3a1677d53a4d8d53d3e00bbe8622e69134f1b648f969c3e707

SHA512
1e9bbea8674c93c05e48d44554078e5616882344ea9bc9fa157c92ec7d6d1d15ab6703918fd2df190325c88354f08223da612db0c8592e168b70452441da73bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2063389e6ecc84e17b6dad8e6005b8bb

SHA1
0c888abb314272d49e11221c9a16d9e806b4547b

SHA256
d5602888db924a6a34939f3ec5bc463cb899de795a78c5b6374700974a94afd1

SHA512
2d4508c38882633dd7031d31999c7bad8fc25fafdc1a22c42e761e976f0925d3eba86be8133a16dbe9ab91f16585357bc901a586addae255eaaad2a756c86402

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1690d53541ca8821d7cb975f970fcfd8

SHA1
9139e20b74f987ef9a19e50bef66760c491bc472

SHA256
ef9cef6e1ee4dd45f91f065895180b6231020f7d01069800a623337340f6783a

SHA512
14fb8c3cba8d8b4e62f779b46db5cafc5908349adce29f810def8762637e75c830f09277432b934122cf9439bde02fcac7073de81aa121c498e87756d93afc4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D8E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E3D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/1068-8032-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1068-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads