Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 08:08
Behavioral task
behavioral1
Sample
733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
4 signatures
150 seconds
General
-
Target
733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe
-
Size
55KB
-
MD5
733bc298334eff734ad5f53c6f718304
-
SHA1
1eb1a5461189e8ef8f20cc424143c660d8347fd9
-
SHA256
92a82ea78a9afb6c129438156cd186899bf00c1701ce02a41264b377219aeb16
-
SHA512
1075de003648ca579ac66884f034310900ad4380765a86c63b3d1858e021c1d57a42bc48e233195c963f5b6a3740e5ea3715c9eb75154a15d57a2685aa9a054b
-
SSDEEP
1536:Wjl+2lHKITkBXkHbo/8kv+lrbV9P3N1JUi787VKzLvwQEnKXhS:O5HKITkBXkHbo/8kv+lrbV9/N1JUi78f
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1564-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x00090000000233ce-5.dat upx behavioral2/memory/1564-1347-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1564-2410-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1564-3658-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1564-4250-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1564-4251-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1564-4252-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1564-4253-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1564-4254-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1564-4255-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1564-4260-0x0000000000400000-0x000000000040F000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\autoconv.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\PresentationHost.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrs.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrshost.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\diskpart.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\finger.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\Magnify.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\setupugc.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\prevhost.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\setup16.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\w32tm.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\auditpol.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\bootcfg.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\sxstrace.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\ttdinject.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrs.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\wowreg32.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\wscript.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\cttune.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\logagent.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\typeperf.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\cipher.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\timeout.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\winver.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\wowreg32.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\regedit.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\clip.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\eventvwr.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\hdwwiz.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\ipconfig.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\waitfor.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\auditpol.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\autofmt.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\doskey.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\regsvr32.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmdl32.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\makecab.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\setx.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\Dism.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\edpnotify.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\netiougc.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\srdelayed.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SysWOW64\net.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.41\MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\7-Zip\7zG.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\r\uwfux.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.19041.1151_none_7233d7a171b1272a\pnputil.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2136afef5fadeaa4\f\prevhost.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.1052_none_323c9a9ad543e3a3\smartscreen.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\f\msinfo32.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_f827f008f8832bd5\rasautou.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\r\user.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.1_none_a13199bb61665e9a\logagent.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_f3a9dc0fe254a157\wmpshare.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_be3404fb0dff5d84\f\TSTheme.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\WerFault.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\f\PrintBrmUi.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\AuditShD.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.1_none_313898283cd914f7\backgroundTaskHost.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.19041.423_none_12ca604b48f8d3fb\r\CapturePicker.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.264_none_91c1d6c40350b1b6\appcmd.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.19041.746_none_0119299746221375\f\XBox.TCUI.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.1266_none_adfc223229a335a6\f\MusNotifyIcon.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1151_none_ae854961a06058b2\f\dmcertinst.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\hvsimgr.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.1_none_04930b2bd1f9871f\Microsoft.AsyncTextService.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.19041.1_none_83b794e5516730a0\AddSuggestedFoldersToLibraryDialog.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.19041.1_none_58793261dd0b5f7a\grpconv.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_aee92417063babbe\f\WinRTNetMUAHostServer.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_ae5ec9e59abc05e6\f\SndVol.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_f3894559140c31d7\imjpuexc.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.1_none_8b021141ec175d3e\sdbinst.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.264_none_2f9647f4d89dc6f5\explorer.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.19041.1288_none_ff9a0c377d92f65b\wpnpinst.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15805.0_none_a89f46f8bfac0a1e\AppLaunch.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.1_none_255ef7c1a8ec5bf0\bthudtask.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.19041.1_none_9470ed79dcf5eade\help.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1_none_805682e34c6552d0\wsmprovhost.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.84_none_f9792ddb393f9467\f\rdpclip.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_ef39acce2648e404\WerFaultSecure.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.19041.1_none_92d880487c3589c8\cmdkey.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\r\InputApp\TextInputHost.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx-jsc_b03f5f7f11d50a3a_10.0.19041.1_none_014838ef8bea39e9\jsc.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.19041.1266_none_90436a82b05bca89\WPDShextAutoplay.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.19041.746_none_492c8c53f3547077\r\PerceptionSimulationInput.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.84_none_51ae5c25baf813ff\SgrmBroker.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_5940d1a4fc4ad8f3\f\backgroundTaskHost.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.746_none_49d38afb2289b178\netiougc.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\iisreset.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1151_none_0412565dd5f26733\f\wkspbroker.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-diagnostic-results_31bf3856ad364e35_10.0.19041.1_none_ded7404f8608d19f\MdRes.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.19041.746_none_b7a67ddd8bcc7470\f\ApplicationFrameHost.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.264_none_2649f3f85f3b49b1\wscript.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_93b4a0a1641d085c\f\svchost.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\r\MoUsoCoreWorker.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.19041.1_none_5d525a67aae579a5\dpnsvr.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_10.0.19041.1_none_7b261299a50c8282\DFDWiz.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_f15a0c837b51c5fc\gpupdate.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_2c2550df02273de3\wusa.exe- 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\733bc298334eff734ad5f53c6f718304_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
600KB
MD592eb2eb0a0142f19849f71e408a9ab42
SHA11d0d573646d010b2c2e57a73ebed774b3b8ae7cc
SHA25642037e51761fe896fc347d5f06dc286984852d260b183258172b75ea9f81b217
SHA5121784b007baedb292dd83822c3e25e0ca1761e64f79f5008d3b469b188d3e8240feb5ce61d753c4df5b8d0a64bdb8b97a9ea5f231d0429d201f300f139d0f7e0a