Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 15:51
Behavioral task
behavioral1
Sample
78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
4 signatures
150 seconds
General
-
Target
78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe
-
Size
4.7MB
-
MD5
78ae820a6d0e8682028b4a410d4c4ad6
-
SHA1
26d0e7e97afc95945404adc290f3a428ec9669c1
-
SHA256
8136564a9583a3e712a60e7c15c324c165905fd8553fba104b19e2871f126e83
-
SHA512
fdde1022a6ce9335f42e8585f321556b60652fa6deada36ed05175cb525580c394c1d0b5590b6cfa439e9707ab4051d778a3cbdf9e526d19cce72c76fbb821b0
-
SSDEEP
49152:NGhNAiorWgMK19i7gHWA1r+6luCgtD8aPugvVDYiw0rFYicKub64torDZg30AiSf:NML01y6luCg9pLuxttZiSELtebmaT
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4588-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x0009000000023419-5.dat upx behavioral2/memory/4588-2781-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4588-4261-0x0000000000400000-0x000000000040F000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\mtstocom.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\autochk.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\dxdiag.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\getmac.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\regini.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\chkdsk.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\icacls.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\raserver.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\mavinject.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\net1.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\sxstrace.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\tasklist.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\wermgr.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\DWWIN.EXE 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\isoburn.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\RmClient.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\schtasks.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\edpnotify.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\Netplwiz.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\ReAgentc.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\eventcreate.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\Fondue.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\mmgaserver.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\raserver.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\appidtel.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\TpmTool.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\wlanext.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\convert.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\tcmsetup.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\Dism.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\fixmapi.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\mstsc.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\PATHPING.EXE 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\autochk.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\takeown.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\findstr.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\nslookup.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\proquota.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\shutdown.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\auditpol.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\comp.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\credwiz.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\unregmp2.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\reg.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\verclsid.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\SysWOW64\dialer.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.106\chrome_installer.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.41\MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7z.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{1FAB8CFE-9860-415C-A6CA-AA7D12021940}\2.0.0.34\BGAUpdate.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.1266_none_ab5bdb26141e0be5\r\vmms.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_5163f0069562aff6\r\powershell.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_9e094af3987dca57\svchost.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.746_none_ff52abd5cb47bbe1\f\lpremove.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_inspectvhddialog_31bf3856ad364e35_10.0.19041.1_none_cc14df174755d4a1\InspectVhdDialog.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.1052_none_323c9a9ad543e3a3\f\smartscreen.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\r\vdsldr.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\sdchange.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.19041.1_none_6568d39003c9a6d5\TieringEngineService.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.19041.985_none_4a26c2c5164ad5c7\r\CIDiag.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\wmplayer.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\f\FXSUNATD.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_9fa94241ef63ceb4\r\wermgr.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\winrm.cmd- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_220320d2c4216035\TiFileFetcher.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\f\windeploy.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_fefa067e67e7af8b\r\UserAccountBroker.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.1_none_d0a876615f23523d\WmiPrvSE.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1202_none_a391067a6b9b433c\r\appidtel.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\f\audiodg.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.19041.1023_none_374973298940e35c\f\FilePicker.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_64cb20c6329bf2bd\r\ntprint.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\PrintBrmEngine.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.928_none_1d29b4735b607954\f\services.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_db09942beaf4fdfa\Microsoft.ECApp.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.19041.1266_none_b5fa73367bbd2f91\f\klist.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.19041.1_none_7c2bba0f7ddd8c61\Windows.Media.BackgroundPlayback.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_8a469514405342ff\f\PasswordOnWakeSettingFlyout.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.19041.746_none_e180169f2d62e633\wmpnetwk.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_c5675ea732c2eaa0\f\LockApp.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1266_none_e40ca34e5de298c9\rasdial.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-takeown_31bf3856ad364e35_10.0.19041.1_none_ba311d9fe95c6271\takeown.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.19041.928_none_0b17415ae0dd0379\r\hvc.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1_none_fb337fa99fb8bc2f\BioIso.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.19041.1_none_f8d6d7787573666b\powershell_ise.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.423_none_df344b9fe5390f25\f\AppResolverUX.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.1266_none_d375b5361b806b32\r\WpcTok.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\r\logman.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\f\SenseIR.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1_none_bf56a5e7532d9c79\licensingdiag.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_cdf422107d2779cf\r\cttunesvr.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.19041.1_none_4c13d8f934672657\driverquery.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.423_none_c3eac275ecdf7e0a\NgcIso.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\f\EaseOfAccessDialog.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_cdf422107d2779cf\cttunesvr.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.19041.1_none_bddbb800ab3565d0\rekeywiz.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\FXSSVC.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.423_none_6c3451a09cba3850\r\AccountsControlHost.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.19041.746_none_e540b68b09558f5a\LockScreenContentServer.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1_none_8aab2d3580c614cb\wsmprovhost.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\sysmon.exe 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1151_none_0412565dd5f26733\f\wkspbroker.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.19041.746_none_18cbe45e21fb4fcb\sessionmsg.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.264_none_e85c49c0793f9f24\Win32WebViewHost.exe- 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\78ae820a6d0e8682028b4a410d4c4ad6_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57e61b8b0e97e9b4e1d73f762cdc241bd
SHA1526cf99b71698b4c0a02f8afca175b3c0ef4d4fe
SHA256a0c835bc8957df6e7fe8399669e33ec02e0a2d6e091cfb2498ea8ee385a2eb37
SHA512d189b8a14258a48a882a1498432aa3b0eb0e7084b9c92ca219808d242fc25cf857163916e73a8b1fef6f0e1b8cacc9ba21da397c8b7b05dba9eb42a5b1d3bcbf