dharma | 97689f3967844dd326e7a2b68e7da5b6b3967eea7748d1e3313910a16cacdf16

Processes:

MsiExec.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{A6EADE66-0000-0000-484E-7E8A45000000}	MsiExec.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	msiexec.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

Processes:

7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe

Executes dropped EXE 3 IoCs

Processes:

OfficeClickToRun.exeMSI60F4.tmpMSI7AF8.tmp

pid process

2008 OfficeClickToRun.exe
4528 MSI60F4.tmp
5552 MSI7AF8.tmp

pid	process
2008	OfficeClickToRun.exe
4528	MSI60F4.tmp
5552	MSI7AF8.tmp

Loads dropped DLL 58 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exe

pid	process
3324
576	MsiExec.exe
576	MsiExec.exe
5492	MsiExec.exe
5668	MsiExec.exe
8068	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
4860	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
6756	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
3324
668	MsiExec.exe
668	MsiExec.exe
668	MsiExec.exe
668	MsiExec.exe
668	MsiExec.exe
668	MsiExec.exe
668	MsiExec.exe
668	MsiExec.exe
668	MsiExec.exe
668	MsiExec.exe
668	MsiExec.exe
668	MsiExec.exe
668	MsiExec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe = "C:\\Windows\\System32\\7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe"	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Public\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-118640398-3063844760-4281400433-1000\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-118640398-3063844760-4281400433-1000\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 12 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

Processes:

MsiExec.exemsiexec.exe

description	ioc	process
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\MitigationOptions	MsiExec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe\MitigationOptions	MsiExec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\DisableExceptionChainValidation	msiexec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe\DisableExceptionChainValidation	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	msiexec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\MitigationOptions	MsiExec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe\MitigationOptions	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	msiexec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe\DisableExceptionChainValidation	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	msiexec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\DisableExceptionChainValidation	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	msiexec.exe

Drops file in System32 directory 19 IoCs

Processes:

msiexec.exeMsiExec.exe7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe

description	ioc	process
File opened for modification	\??\c:\Windows\system32\mfc100rus.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe
File opened for modification	\??\c:\Windows\system32\mfcm100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100cht.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100chs.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100deu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100esn.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100ita.dll	msiexec.exe
File created	C:\Windows\System32\Info.hta	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	\??\c:\Windows\system32\atl100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfcm100u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100enu.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100kor.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\vcomp100.dll	msiexec.exe
File created	C:\Windows\System32\7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	\??\c:\Windows\system32\mfc100jpn.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100u.dll	msiexec.exe
File opened for modification	\??\c:\Windows\system32\mfc100fra.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exeMsiExec.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\ui-strings.js.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_uk.dll	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsNotepad_10.2102.13.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\NotepadAppList.scale-125.png	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\PeopleAppList.targetsize-256.png	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_gridview.svg.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\hr-hr\Resources.resw	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-BoldOblique.otf	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon.png.id-535D73CE.[[email protected]].ROGER	MsiExec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-30.png	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-200_contrast-black.png	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\spectrum_spinner.svg.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\THANKS.txt.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hu-hu\ui-strings.js.id-535D73CE.[[email protected]].ROGER	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\ui-strings.js.id-535D73CE.[[email protected]].ROGER	MsiExec.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_cs_135x40.svg.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-400.png	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.resources.dll.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\tool-view.css	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.ThreadPool.dll.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\PlayStore_icon.svg.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\BOLDSTRI.INF.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.id-535D73CE.[[email protected]].ROGER	msiexec.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\Classic\FreeCell.Large.png	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-400_contrast-white.png	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-80_altform-unplated_contrast-white.png	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\GlobalSettings.js	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\export.svg.id-535D73CE.[[email protected]].ROGER	MsiExec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\osmmui.msi.16.en-us.tree.dat.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Facepile.js	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-hover_32.svg	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fi-fi\ui-strings.js.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-private-l1-1-0.dll	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosSplashScreen.contrast-black_scale-100.png	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-oob.xrm-ms.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\msedgeupdateres_lo.dll	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\StudentReport.dotx	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-100.png	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\ui-strings.js.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-hover_32.svg.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt.id-535D73CE.[[email protected]].ROGER	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeXMP.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ReadOutLoud.api	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D14.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrocef.exe.15EE1C08_ED51_465D_B6F3_FB152B1CC435	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AXE8SharedExpat.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB024.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfcm100_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7AF8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\prcr.x3d	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100u_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Edit_R_RHP.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\icudt40.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\libcef.dll.15EE1C08_ED51_465D_B6F3_FB152B1CC435	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\SendMail.api	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CROATIAN.TXT	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\DataMatrix.pmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Edit_R_Full.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\SYMBOL.TXT	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CENTEURO.TXT	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF85.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100cht_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Onix32.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SecStoreFile.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroPDF.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CYRILLIC.TXT	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D49.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A2A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ccme_ecc.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\info.plist	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logsession.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\FDFFile_8.ico	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100esn_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI328E.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_msvcr100_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrosup64.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AGM.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\drvSOFT.x3d	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8D13.tmp	msiexec.exe
File created	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7250.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\nppdf32.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_d.x3d	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100rus_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_vccorlib120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ICELAND.TXT	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_msvcp100_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\fillsign.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1250.TXT2	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\EPDF_RHP.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adoberfp.dll	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100chs_x64	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB18C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7B09.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AXSLE.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\QuickTime.mpp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\rt3d.dll	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100fra_x64	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100ita_x64	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100jpn_x64	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exeDllHost.exeDllHost.exeMsiExec.exeMsiExec.exeMSI7AF8.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI7AF8.tmp

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

vssvc.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000575fc739231626340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000575fc7390000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900575fc739000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d575fc739000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000575fc73900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

msiexec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe

Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exevssadmin.exe

pid process

5536 vssadmin.exe
6352 vssadmin.exe

pid	process
5536	vssadmin.exe
6352	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeexplorer.exemsiexec.exeiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "528066962"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31122308"	iexplore.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}	msiexec.exe

Modifies data under HKEY_USERS 28 IoCs

Processes:

msiexec.exeMsiExec.exeMSI60F4.tmp

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\EUDC	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Console	MSI60F4.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Environment	MSI60F4.tmp
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers	MSI60F4.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software	MSI60F4.tmp
Key created	\REGISTRY\USER\.DEFAULT\EUDC	MSI60F4.tmp
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Environment	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\System	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Console	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout	MSI60F4.tmp
Key created	\REGISTRY\USER\.DEFAULT\System	MSI60F4.tmp
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel	MSI60F4.tmp

Modifies registry class 64 IoCs

Processes:

explorer.exemsiexec.exeOpenWith.exeMsiExec.exeMsiExec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\6C5ADB75C34456D42B33823269140800	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.xdp+xml	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5007373A-20D7-458F-9FFB-ABC900E3A831}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1E6C7A4-6B15-4C06-B1EF-88A4F2A886CB}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CD069A0-50AA-11D1-B8F0-00A0C9259304}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\ProgID	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml.1\shell\Read	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.FDFDoc\shell\Read\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6236FF8C-E747-4173-86D3-99F511B61DF3}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EA-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81F9B44F-BA3A-4F5D-9B51-090C74A9B3A4}\ProxyStubClsid	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F6D3808-7974-4B1A-94C2-3200767EACE8}\1.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\InprocHandler32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F6D3808-7974-4B1A-94C2-3200767EACE8}\1.0\FLAGS	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\AuxUserType	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A894040-247E-4AFF-BB08-3489E9905235}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat2018\shell\open\ddeexec\application	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.fdf	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XFDFDoc\shell\Open	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.pdfxml	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\7	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9F2FE81-F764-4BD0-AFA5-5DE841DDB625}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24DA047B-40C0-4018-841B-6B7409F730FC}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17F2E344-8227-4AA7-A25A-E89424566BBA}\NumMethods	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdfxml\OpenWithList\Acrobat.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD069A1-50AA-11D1-B8F0-00A0C9259304}\ProgID	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat2018\shell\open	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08A9E040-9A9C-4F42-B5F5-2029B8F17E1D}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\InprocServer32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}\VersionIndependentProgID	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\Verb\0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\VersionIndependentProgID	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\8	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5007373A-20D7-458F-9FFB-ABC900E3A831}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81F9B44F-BA3A-4F5D-9B51-090C74A9B3A4}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml.1\shell\Printto	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat\shell\open\ddeexec\topic	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EE-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36DE898D-AD48-40A5-B4B2-123F916BFBAB}\ProxyStubClsid	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroBroker.Broker.1	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\AcroBroker.EXE	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000_Classes\Local Settings	OpenWith.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EB-4981-101B-9CA8-9240CE2738AE}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2DEA7885-1846-411F-A41E-017A8FD778FF}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9F2FE81-F764-4BD0-AFA5-5DE841DDB625}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{673E8452-7646-11D1-B90B-00A0C9259304}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24DA047B-40C0-4018-841B-6B7409F730FC}\VersionIndependentProgID	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml.1\Insertable	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-118640398-3063844760-4281400433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\java.exe	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\MiscStatus	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46B89F5A-769D-4792-AD9A-E3755915CBC3}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat\shell\open\command	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings.1\DefaultIcon	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{673E8454-7646-11D1-B90B-00A0C9259304}\ProxyStubClsid	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid process

7192 explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe

pid	process
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

7192 explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeexplorer.exemsiexec.exevssvc.exe

description	pid	process
Token: SeBackupPrivilege	4108	vssvc.exe
Token: SeRestorePrivilege	4108	vssvc.exe
Token: SeAuditPrivilege	4108	vssvc.exe
Token: SeShutdownPrivilege	7192	explorer.exe
Token: SeIncreaseQuotaPrivilege	7192	explorer.exe
Token: SeSecurityPrivilege	2284	msiexec.exe
Token: SeCreateTokenPrivilege	7192	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	7192	explorer.exe
Token: SeLockMemoryPrivilege	7192	explorer.exe
Token: SeIncreaseQuotaPrivilege	7192	explorer.exe
Token: SeMachineAccountPrivilege	7192	explorer.exe
Token: SeTcbPrivilege	7192	explorer.exe
Token: SeSecurityPrivilege	7192	explorer.exe
Token: SeTakeOwnershipPrivilege	7192	explorer.exe
Token: SeLoadDriverPrivilege	7192	explorer.exe
Token: SeSystemProfilePrivilege	7192	explorer.exe
Token: SeSystemtimePrivilege	7192	explorer.exe
Token: SeProfSingleProcessPrivilege	7192	explorer.exe
Token: SeIncBasePriorityPrivilege	7192	explorer.exe
Token: SeCreatePagefilePrivilege	7192	explorer.exe
Token: SeCreatePermanentPrivilege	7192	explorer.exe
Token: SeBackupPrivilege	7192	explorer.exe
Token: SeRestorePrivilege	7192	explorer.exe
Token: SeShutdownPrivilege	7192	explorer.exe
Token: SeDebugPrivilege	7192	explorer.exe
Token: SeAuditPrivilege	7192	explorer.exe
Token: SeSystemEnvironmentPrivilege	7192	explorer.exe
Token: SeChangeNotifyPrivilege	7192	explorer.exe
Token: SeRemoteShutdownPrivilege	7192	explorer.exe
Token: SeUndockPrivilege	7192	explorer.exe
Token: SeSyncAgentPrivilege	7192	explorer.exe
Token: SeEnableDelegationPrivilege	7192	explorer.exe
Token: SeManageVolumePrivilege	7192	explorer.exe
Token: SeImpersonatePrivilege	7192	explorer.exe
Token: SeCreateGlobalPrivilege	7192	explorer.exe
Token: SeBackupPrivilege	5376	vssvc.exe
Token: SeRestorePrivilege	5376	vssvc.exe
Token: SeAuditPrivilege	5376	vssvc.exe
Token: SeBackupPrivilege	2284	msiexec.exe
Token: SeRestorePrivilege	2284	msiexec.exe
Token: SeRestorePrivilege	2284	msiexec.exe
Token: SeTakeOwnershipPrivilege	2284	msiexec.exe
Token: SeRestorePrivilege	2284	msiexec.exe
Token: SeTakeOwnershipPrivilege	2284	msiexec.exe
Token: SeRestorePrivilege	2284	msiexec.exe
Token: SeTakeOwnershipPrivilege	2284	msiexec.exe
Token: SeRestorePrivilege	2284	msiexec.exe
Token: SeTakeOwnershipPrivilege	2284	msiexec.exe
Token: SeRestorePrivilege	2284	msiexec.exe
Token: SeTakeOwnershipPrivilege	2284	msiexec.exe
Token: SeRestorePrivilege	2284	msiexec.exe
Token: SeTakeOwnershipPrivilege	2284	msiexec.exe
Token: SeRestorePrivilege	2284	msiexec.exe
Token: SeTakeOwnershipPrivilege	2284	msiexec.exe
Token: SeRestorePrivilege	2284	msiexec.exe
Token: SeTakeOwnershipPrivilege	2284	msiexec.exe
Token: SeRestorePrivilege	2284	msiexec.exe
Token: SeTakeOwnershipPrivilege	2284	msiexec.exe
Token: SeRestorePrivilege	2284	msiexec.exe
Token: SeTakeOwnershipPrivilege	2284	msiexec.exe
Token: SeRestorePrivilege	2284	msiexec.exe
Token: SeTakeOwnershipPrivilege	2284	msiexec.exe
Token: SeRestorePrivilege	2284	msiexec.exe
Token: SeTakeOwnershipPrivilege	2284	msiexec.exe

Suspicious use of FindShellTrayWindow 9 IoCs

Processes:

explorer.exe

pid	process
7192	explorer.exe
7192	explorer.exe
7192	explorer.exe
7192	explorer.exe
7192	explorer.exe
7192	explorer.exe
7192	explorer.exe
7192	explorer.exe
7192	explorer.exe

Suspicious use of SetWindowsHookEx 15 IoCs

Processes:

OpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exeMiniSearchHost.exeOfficeClickToRun.exeOpenWith.exeOpenWith.exe

pid	process
7576	OpenWith.exe
5772	OpenWith.exe
6740	OpenWith.exe
1548	OpenWith.exe
8116	OpenWith.exe
8116	OpenWith.exe
8116	OpenWith.exe
8116	OpenWith.exe
8116	OpenWith.exe
8116	OpenWith.exe
436	MiniSearchHost.exe
2008	OfficeClickToRun.exe
2008	OfficeClickToRun.exe
3872	OpenWith.exe
6712	OpenWith.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.execmd.execmd.exemsiexec.exe

description	pid	process	target process
PID 488 wrote to memory of 1120	488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe	cmd.exe
PID 488 wrote to memory of 1120	488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe	cmd.exe
PID 1120 wrote to memory of 1460	1120	cmd.exe	mode.com
PID 1120 wrote to memory of 1460	1120	cmd.exe	mode.com
PID 1120 wrote to memory of 5536	1120	cmd.exe	vssadmin.exe
PID 1120 wrote to memory of 5536	1120	cmd.exe	vssadmin.exe
PID 488 wrote to memory of 8076	488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe	cmd.exe
PID 488 wrote to memory of 8076	488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe	cmd.exe
PID 8076 wrote to memory of 5152	8076	cmd.exe	mode.com
PID 8076 wrote to memory of 5152	8076	cmd.exe	mode.com
PID 8076 wrote to memory of 6352	8076	cmd.exe	vssadmin.exe
PID 8076 wrote to memory of 6352	8076	cmd.exe	vssadmin.exe
PID 488 wrote to memory of 7968	488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe	mshta.exe
PID 488 wrote to memory of 7968	488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe	mshta.exe
PID 488 wrote to memory of 7632	488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe	mshta.exe
PID 488 wrote to memory of 7632	488	7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe	mshta.exe
PID 2284 wrote to memory of 3984	2284	msiexec.exe	srtasks.exe
PID 2284 wrote to memory of 3984	2284	msiexec.exe	srtasks.exe
PID 2284 wrote to memory of 576	2284	msiexec.exe	MsiExec.exe
PID 2284 wrote to memory of 576	2284	msiexec.exe	MsiExec.exe
PID 2284 wrote to memory of 5492	2284	msiexec.exe	MsiExec.exe
PID 2284 wrote to memory of 5492	2284	msiexec.exe	MsiExec.exe
PID 2284 wrote to memory of 4528	2284	msiexec.exe	MSI60F4.tmp
PID 2284 wrote to memory of 4528	2284	msiexec.exe	MSI60F4.tmp
PID 2284 wrote to memory of 5668	2284	msiexec.exe	MsiExec.exe
PID 2284 wrote to memory of 5668	2284	msiexec.exe	MsiExec.exe
PID 2284 wrote to memory of 8068	2284	msiexec.exe	MsiExec.exe
PID 2284 wrote to memory of 8068	2284	msiexec.exe	MsiExec.exe
PID 2284 wrote to memory of 4860	2284	msiexec.exe	MsiExec.exe
PID 2284 wrote to memory of 4860	2284	msiexec.exe	MsiExec.exe
PID 2284 wrote to memory of 4860	2284	msiexec.exe	MsiExec.exe
PID 2284 wrote to memory of 6756	2284	msiexec.exe	MsiExec.exe
PID 2284 wrote to memory of 6756	2284	msiexec.exe	MsiExec.exe
PID 2284 wrote to memory of 6756	2284	msiexec.exe	MsiExec.exe
PID 2284 wrote to memory of 5552	2284	msiexec.exe	MSI7AF8.tmp
PID 2284 wrote to memory of 5552	2284	msiexec.exe	MSI7AF8.tmp
PID 2284 wrote to memory of 5552	2284	msiexec.exe	MSI7AF8.tmp
PID 2284 wrote to memory of 668	2284	msiexec.exe	MsiExec.exe
PID 2284 wrote to memory of 668	2284	msiexec.exe	MsiExec.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7cb12c7eac83f0bc7f581f4b28a041c5_JaffaCakes118.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:488

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:1460

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:5536

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:8076

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:5152

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:6352

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
2⤵
PID:7968

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
2⤵
PID:7632

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\23c7aa7985464b329c5fb5c04ea9214a /t 7672 /p 7968
1⤵
PID:6572

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\62cf1f5d6ccd4aeb9dc83dece3fd578a /t 5124 /p 7632
1⤵
PID:7112

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:7576

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\FILES ENCRYPTED.txt
1⤵
PID:7592

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7784

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5772

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6740

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1548

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8116

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
1⤵
PID:7948

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\FILES ENCRYPTED.txt
1⤵
PID:8084

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
PID:6956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:7176

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
PID:5800

C:\Windows\system32\CompMgmtLauncher.exe
"C:\Windows\system32\CompMgmtLauncher.exe"
1⤵
PID:5676

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
PID:5868

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:436

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:6708

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,
1⤵
PID:5680

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:3760

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:7192

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Enumerates connected drives
- Indicator Removal: Clear Persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:3984

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 57DD048F9EBAA0A613CF5763486AF25C
2⤵
- Loads dropped DLL
PID:576

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 3C93D06E6E10A349BF26BFCD87FC08BB E Global\MSI0000
2⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
PID:5492

C:\Windows\Installer\MSI60F4.tmp
"C:\Windows\Installer\MSI60F4.tmp" INSTALLDIR="C:\Program Files\Java\jre-1.8\\" ProductCode={77924AE4-039E-4CA4-87B4-2F64180381F0}
2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4528

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding E20F63220FFDBBF2A95792603844A545 E Global\MSI0000
2⤵
- Loads dropped DLL
PID:5668

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding F7AB8FDF17C13ED88AD308D8341A50D8
2⤵
- Loads dropped DLL
PID:8068

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 47E3621C6CAD3805BC1D79EC1A72EBDA
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4860

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding F81007D9380C831CFAACF579B625378E E Global\MSI0000
2⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Indicator Removal: Clear Persistence
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6756

C:\Windows\Installer\MSI7AF8.tmp
"C:\Windows\Installer\MSI7AF8.tmp" /b 3 120 0
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5552

\??\c:\Windows\System32\MsiExec.exe
c:\Windows\System32\MsiExec.exe -Embedding 553AF88C170FA6DD87FEC2CABFDD3642
2⤵
- Loads dropped DLL
PID:668

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5376

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" scenario=install scenariosubtype=ARP sourcetype=None productstoremove=ProPlusRetail.16_en-us_x-none culture=en-us version.16=16.0
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2008

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3872

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery