849d81de07df19823cf7f72aced6b7744dc5339a734dbdcb6b328937cddd1d49

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
Size

246KB
MD5

82bf5560f4e7af755d53a38172625234
SHA1

773519556cb5aef24deba2a1e4199ab1333293e9
SHA256

849d81de07df19823cf7f72aced6b7744dc5339a734dbdcb6b328937cddd1d49
SHA512

f562def03d4e5fe4dd8805e403a65eb97fdef80d31e16ed48f80ccfdd119d1ca51c2cc4e0d04b06015e1d0f900ab07c4386f7a0d978620cf576148c31925ac3d
SSDEEP

6144:R7FUFTq82IYvx2eWgMRc+bo+kJl6z0FIkM:ZFUFTqy8x2EMRzM1kIFIJ

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341439.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341455.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341534.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01931J.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DigitalInk.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0149018.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0148757.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02412K.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImages.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarToolIconImages.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099166.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIcon.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341653.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackgroundRTL.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309664.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0313974.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0337280.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DiscussionToolIconImages.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\LINE.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\default_thumb.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341447.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384900.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIcons.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145669.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382947.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DataListIconImages.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DATETIME.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145361.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145879.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384885.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387591.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackground.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382966.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382968.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382969.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03379I.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\CreateSpaceImage.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24Images.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectToolsetIconImages.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382958.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382963.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309480.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageSmall.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145895.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0148798.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099145.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099190.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382939.JPG	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\InformationIcon.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Auto.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ViewHeaderPreview.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableUpArrow.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_High.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Off.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\ViewHeaderPreview.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be\Desert.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp1.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\Wallpaper\Architecture\img14.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-us-component_31bf3856ad364e35_6.1.7601.17514_none_b52573ad8e4c2d89\US-wp3.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-landscapes_31bf3856ad364e35_6.1.7600.16385_none_e57abb2f66db71a9\img10.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\Wallpaper\Landscapes\img12.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Garden.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\Wallpaper\Landscapes\img7.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\Wallpaper\Scenes\img27.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img17.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-nature_31bf3856ad364e35_6.1.7600.16385_none_d5909570704a09c0\img3.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\Wallpaper\Landscapes\img10.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_6.1.7601.17514_none_61acd141e5332baf\wmpnss_color32.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_6.1.7601.17514_none_61acd141e5332baf\wmpnss_color48.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Roses.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img15.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-nature_31bf3856ad364e35_6.1.7600.16385_none_d5909570704a09c0\img6.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-us-component_31bf3856ad364e35_6.1.7601.17514_none_b52573ad8e4c2d89\US-wp6.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026\Psychedelic.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\security_watermark.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Wallpaper\US-wp4.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp3.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp6.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Garden.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp2.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\Wallpaper\Landscapes\img11.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be\Jellyfish.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\SoftBlue.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\GreenBubbles.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\Wallpaper\Landscapes\img8.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_6.1.7601.17514_none_61acd141e5332baf\wmpnss_bw32.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026\Blue_Gradient.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_6.1.7601.17514_none_61acd141e5332baf\wmpnss_bw48.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be\Chrysanthemum.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\Wallpaper\Scenes\img25.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-au-component_31bf3856ad364e35_6.1.7601.17514_none_36a5754e72dd8aff\AU-wp1.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-ca-component_31bf3856ad364e35_6.1.7601.17514_none_fae061a2e0ae5019\CA-wp4.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Peacock.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-nature_31bf3856ad364e35_6.1.7600.16385_none_d5909570704a09c0\img4.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp6.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\Wallpaper\Scenes\img29.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-scenes_31bf3856ad364e35_6.1.7600.16385_none_a4393b1a254aeaee\img25.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-nature_31bf3856ad364e35_6.1.7600.16385_none_d5909570704a09c0\img5.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp2.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\GB-wp1.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\Wallpaper\Scenes\img28.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp4.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be\Tulips.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-nature_31bf3856ad364e35_6.1.7600.16385_none_d5909570704a09c0\img2.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp5.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\Wallpaper\Landscapes\img9.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-landscapes_31bf3856ad364e35_6.1.7600.16385_none_e57abb2f66db71a9\img8.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\Wallpaper\Characters\img19.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-za-component_31bf3856ad364e35_6.1.7601.17514_none_a5926b147a413e6a\ZA-wp6.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be\Penguins.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-nature_31bf3856ad364e35_6.1.7600.16385_none_d5909570704a09c0\img1.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp1.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp3.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp4.jpg	82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\82bf5560f4e7af755d53a38172625234_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099147.JPG

Filesize
226KB

MD5
31d909057c735d883b84735d1c7a4aae

SHA1
5c3d12c0853571dafbb1abb1d7aa7752acbb9cc5

SHA256
1b841f0f06db23aee7c258918b162595d6223433e0e9ab0f1f7b0fc21d09986c

SHA512
ca436716b8181bf1b6f2c1c8b5c676133a10ba12eccec6b9bb5f5307546dd82441311fabf0c322a2befba4025b8b3b2bc669394bdcec459f7e2974b087e3f087

Download Submit
memory/2428-0-0x000007FEF594E000-0x000007FEF594F000-memory.dmp

Filesize
4KB

Download
memory/2428-1-0x000007FEF5690000-0x000007FEF602D000-memory.dmp

Filesize
9.6MB

Download
memory/2428-2-0x000007FEF5690000-0x000007FEF602D000-memory.dmp

Filesize
9.6MB

Download
memory/2428-3-0x000007FEF5690000-0x000007FEF602D000-memory.dmp

Filesize
9.6MB

Download
memory/2428-340-0x000007FEF5690000-0x000007FEF602D000-memory.dmp

Filesize
9.6MB

Download