Analysis
-
max time kernel
139s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/08/2024, 20:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe
-
Size
32KB
-
MD5
949872d3ed5b587b4e1599713aaad983
-
SHA1
3bfe7bc2e7c4de35bf648522576dbc37d5be8a27
-
SHA256
0f4d38736ba0c91d4c4b208dfce9a0ab2b26dbc44fde6488529acc712f193d2f
-
SHA512
ad383328c0b4a0c706bb7298bc17eb6fbc8e9772ea0a8b897c9859dc84605051f7bcdf25e8e182c2970a17d70fa34d275bdfe07b81ac9d5f2697cb5d955d0aaf
-
SSDEEP
384:jC2vY3xExHbnHTJ/H5+2rG7aV3/0tKIm2HHxv52IskiwTx9i3:jprxHbzLTrL3stKIbHHj7i3
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 40 IoCs
description ioc Process File created \??\c:\Windows\SysWOW64\drivers\de-DE\zhiwing.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\es-ES\ziehndin772.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\fr-FR\yumyfzwen757.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\ja-JP\zhiinkp780.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\UMDF\en-US\engflhksang.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\UMDF\en-US\engflhksang.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\UMDF\iqmgvshiiong782.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\UMDF\iqmgvshiiong782.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\it-IT\ydsiuan.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\uk-UA\uenguangqmo395.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\UMDF\uznzhiyun.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\de-DE\iangwu489.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\it-IT\ydsiuan.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\it-IT\anguanw642.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\en-US\enwuyzzkp.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\fr-FR\elinguan.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\de-DE\zhiwing.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\es-ES\ziehndin772.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\UMDF\en-US\iongiangs.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\cxlianri262.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\shivrsri.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\fr-FR\elinguan.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\ja-JP\zhiinkp780.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\shivrsri.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\en-US\iongania.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\fr-FR\yumyfzwen757.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\es-ES\ktongri643.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\es-ES\ktongri643.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\UMDF\uznzhiyun.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\it-IT\anguanw642.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\uk-UA\jfdliongzi.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\UMDF\en-US\iongiangs.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\cxlianri262.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\en-US\enwuyzzkp.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\en-US\iongania.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\ja-JP\angkuvwu852.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\ja-JP\angkuvwu852.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\uk-UA\jfdliongzi.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\drivers\de-DE\iangwu489.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\drivers\uk-UA\uenguangqmo395.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3404 services.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\services = "C:\\Windows\\services.exe" services.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "C:\\Windows\\services.exe" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Runservices\services = "C:\\Windows\\services.exe" services.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Runservices\services = "C:\\Windows\\services.exe" services.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created \??\c:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\shisiabsbw.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\ja-JP\Licenses\Volume\Professional\rhekengian.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\WCN\uk-UA\uenwwyuan389.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\VpnClient\fr-FR\fprgvuanci.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\basicrender.inf_amd64_df49c4daa6251397\uanafuan.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\c_wceusbs.inf_amd64_1ba398d9da634d3f\shiuangnibzp.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\mdmags64.inf_amd64_767b2d723d0fe83b\zhiouan.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_360f6f3a7c4b3433\I386\angzihnon.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\IME\IMETC\applets\uanribtq628.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\InstallShield\setupdir\001a\inzimbode.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\uanvlnruan.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\yunuanytyyy.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\System32\LogFiles\Scm\ingsoiuan.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\wbem\it\uenlykhezi641.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\th-TH\siangwgwu632.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\mdmkortx.inf_amd64_93b84ecb5fd1cc85\hionging.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\wbem\tmf\xhuengyi667.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\restore\uansoan96.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\uiccspb.inf_amd64_18454ae612999870\yuyiar377.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\InputMethod\yjchiyun.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\Speech\Engines\SR\es-ES\ianenjl.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\wbem\it\uenlykhezi641.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\auenin.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\de-DE\Licenses\_Default\Professional\engeemueng.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_9957a38c3d2283ed\jzyiueng773.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\en-US\Licenses\analjejian.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\uk-UA\Licenses\pbzyuwu.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Provisioning\zhipoozchi626.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\ongchihnznv.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\winrm\040C\tjenang618.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\c_printer.inf_amd64_cfb2c47c5677c442\uaninghfgu.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\mstape.inf_amd64_3e2c4fa2d4cbb487\njjnoenan542.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_f6f0831ba09dd9f5\anuangfzdl.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\netirda.inf_amd64_186702cd081cddb0\hugksiri16.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ISE\ianangtkbcj131.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\iuenguang.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\c_holographic.inf_amd64_6ab9629b23deb837\angrhiong313.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\MUI\0411\iangueno580.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\WCN\fr-FR\engzifurwy.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\VpnClient\de-DE\oangan243.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\it-IT\ahxiuchiueng167.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\es-ES\riingulne267.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_b06c3bc32f7db374\rzuanchi.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\c_netservice.inf_amd64_9ab9cf10857f7349\wyuin886.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\wsynth3dvsc.inf_amd64_1a08a3b6cd493e1f\ianisbmong269.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\wbem\ja\qzwuyi554.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\SMI\Store\Machine\ntipuengeng.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\mdmke.inf_amd64_b83f029888180def\udziongwu.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\mikkxyiyi507.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\taxuenin.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_ec11d0ad3c5b262a\wuwugmeh.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\mdmpace.inf_amd64_5e0fbd01da4f7c7b\lphmiongiong70.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\nvdimm.inf_amd64_9bb46b0de5ea33cd\wianong868.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\Speech_OneCore\Engines\TTS\uenangcibe.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\de\uenganghqg.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\mdmetech.inf_amd64_bbd46500a9d0e020\uengibin485.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\mdmusrgl.inf_amd64_19bd1d6c2b642b6f\engmwu208.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\fr-FR\Licenses\_Default\Professional\anghbxesi.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\winrm\enavuang.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\c_scmdisk.inf_amd64_d8f75a9c87c2f7c4\cziuang822.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\slmgr\0C0A\juanuan.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\wbem\ja-JP\uenyiee309.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\Com\fr-FR\yiuenqqzi.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\SysWOW64\IME\IMEJP\siisvianging.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Java\jre-1.8\lib\cmm\iancjpveng.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\uangenwkvlk994.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\zillssxang.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\qyuengueng41.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\ziuengxlr462.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sk-sk\ongdyhpgshi.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\ingyuekw825.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\gsapziiang.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\Updates\Download\PackageFiles\E4BF0454-C413-4B6C-AC7A-2EFE1D8B35CA\enguenfdu217.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\de-de\iongedbfzhi.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\riyunoqzs.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\uanyiekb863.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\zhihfiduan971.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\MSBuild\qwuuan607.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\iongyunkxld85.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\inentfi368.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Triedit\en-US\nbmzyunyun205.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Internet Explorer\SIGNUP\inimuuan.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\shicueng795.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\ilongong.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\lxciiong.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\engzbkrzhi.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\chiknsqueng.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\root\iangcyzlsshi620.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\chishiyo799.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\riziofo739.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\nriozisi.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ar-SA\chifzhi315.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files\Internet Explorer\uenvxmigeng706.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files\Internet Explorer\es-ES\zvychieng.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\shiengv.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\rioagiyu386.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\yunxhyu.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files\Internet Explorer\de-DE\yunuengb186.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\lib\ext\qlquanuen942.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\PersonaSpy\ynkglsiin810.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sk-sk\dinshi321.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\enrpyzhi594.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\engiangq49.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\yungolen.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-tw\ongsueng57.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\uanglsi.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Internet Explorer\en-US\nadcieng.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files\Mozilla Firefox\uninstall\ybbthinuan.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\ingkeueng.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\plugins\stream_out\wuciaazd.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\kwanueng429.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\de-de\yunegjang802.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\plugin2\bchiong436.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\plugins\d3d9\mhtyiiang423.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files\Windows Security\BrowserCore\iangbzhi.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ro-ro\siianglqco338.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\PlayReadyCdm\_platform_specific\win_x64\ongoyjrwu.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\asduyenri.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\ongeaiang.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ongarian558.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\iongrci781.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\uanbuang284.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\uangckheng493.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ciuengj.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\engsuang.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\uenajszhi314.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-gb\enonghsxvq.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\nxvginen.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created \??\c:\Windows\SystemResources\Windows.UI.ShellCommon\yizhiuo.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-onecore-dusm-api_31bf3856ad364e35_10.0.19041.546_none_dd291d346c87c616\nfiuangri.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\xbhdyushi.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_c_fsantivirus.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_e86f0a7773d21875\situen367.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-l..ostic-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_aba25e4675f0b175\shiinn235.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-dhcpds_31bf3856ad364e35_10.0.19041.1_none_7e9770d57c447e72\tuhchici.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CertificateServices.PKIClient.Cmdlets.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\shisnjciang350.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..tion-mgmt.resources_31bf3856ad364e35_10.0.19041.1_it-it_2510c53edc4667da\zicqeaiang.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-eapteap.resources_31bf3856ad364e35_10.0.19041.1_es-es_843dd6754594cb7b\cifshi.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00020405_31bf3856ad364e35_10.0.19041.1_none_e535d698e7938c93\ihtjuangchi37.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-internal-bluetooth_31bf3856ad364e35_10.0.19041.153_none_5393ecd0063f2e3d\dmbziangyun.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_10.0.19041.1_it-it_a0b367f31f29d0aa\enwoabwuan.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-t..rk-ctfmon.resources_31bf3856ad364e35_10.0.19041.1_es-es_4c35ff90d5a8f3fc\ciunwu.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_scunknown.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_643e672c29a8039c\ingchijcy638.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_dual_compositebus.inf_31bf3856ad364e35_10.0.19041.1_none_767d0904051e600c\lqipriiong106.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1202_none_a391067a6b9b433c\uengneng.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-audio-callcontrol_31bf3856ad364e35_10.0.19041.746_none_0929e56c3644f331\r\cichitbej602.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..s-regkeys-component_31bf3856ad364e35_10.0.19041.1_none_b07f1d459f7f777b\cijsoian.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Tpm\uengfczi833.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework64\v2.0.50727\1031\uanuanb.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_dual_wsynth3dvsc.inf_31bf3856ad364e35_10.0.19041.1_none_6e36e01cf27b17e1\uangkspgin632.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-a..nager-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_5cf9f7a0fe1bb87c\ianuiang.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-appwiz.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d8ced4dbf26d73c\yunriyq.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..component.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_44a3afab1196c3c8\vrfbinzhi.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\diagnostics\system\Bluetooth\it-IT\iongnhsing.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\jinshi96.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-c..tprovision-joinutil_31bf3856ad364e35_10.0.19041.1151_none_e9f3583235551cae\f\wuengcw.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\appcompat\encapsulation\dihyuen.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\INF\.NET CLR Data\0411\shirilpi346.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-s..spp-tools.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_815c01a11132a1eb\encihi853.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\wow64_fdssdp_31bf3856ad364e35_10.0.19041.746_none_232be7b6076e6821\f\moiangiong.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_desktop_shell-search-srchadmin.resources_31bf3856ad364e35_7.0.19041.1_uk-ua_87ae52abf8e50e10\uengrvqgri770.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.19041.264_none_7a40d01e6ba302b9\engengjxdd.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\fnuanuan.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_amdsbs.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_22fb9d7ff7c6c2c7\vengen.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-s..ylistener.resources_31bf3856ad364e35_10.0.19041.1_en-us_1e328e838497577f\anykmin.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\x86_auditpolicygpmanagedstubs.interop_31bf3856ad364e35_10.0.19041.1_none_7bc7a6195074370b\zyplyiian55.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-c..tem-tracedatahelper_31bf3856ad364e35_10.0.19041.1151_none_69db5af0c09c2a3a\f\iangrdqjong734.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-powershell-sip_31bf3856ad364e35_10.0.19041.546_none_4667e7de618212fb\r\uanmci850.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-t..putprocessor-gipdll_31bf3856ad364e35_10.0.19041.153_none_36748f895fe91bee\lhesyuiong.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.746_none_4ae21b160a9d5bb2\r\ziyiun559.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-quickassist.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f1637bf85a740a0f\iangvuoyoian824.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-hid-user_31bf3856ad364e35_10.0.19041.1_none_8c9d55f126cc2eb2\chichianjqi628.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.19041.746_none_ff3f6c27e956149f\jingzi694.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.746_none_8ea10e81a707d623\yuwegiong78.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-p..ructureconsumercore_31bf3856ad364e35_10.0.19041.1202_none_ae0b61173f965b5b\r\ziangqjdjq559.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-shutdownux.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_60b3fa969a1a735c\fjycnuengian.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-w..omponents.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_1a234e1d533ecf9e\iangengizye291.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-systemcpl_31bf3856ad364e35_10.0.19041.423_none_c93602eaf1314ea8\r\engpznvueng.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_hyperv-vmtpm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_1f55df53ddf128ea\ingcin394.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\f\enenc.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-cryptsp-dll_31bf3856ad364e35_10.0.19041.1_none_e9a325e2da8acade\shiuiong43.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\de-DE\iangyuneha648.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\de-DE\uenripcat125.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-recover.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4804640f06a5d2a4\rciang.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.19041.84_none_2c3254d57443e050\r\aneri.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-onex.resources_31bf3856ad364e35_10.0.19041.1_es-es_1cd2fc5b155a41ea\hywowuian676.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\x86_microsoft-windows-d..4-payload.resources_31bf3856ad364e35_10.0.19041.1_es-es_38b98b29b9cb7c23\siflewong936.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\uanuans.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File opened for modification \??\c:\Windows\INF\ServiceModelService 3.0.0.0\0407\vuotuenshi10.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Context\v4.0_4.0.0.0__b77a5c561934e089\engnsfnmueng722.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-d..oryservices-ntdsapi_31bf3856ad364e35_10.0.19041.1_none_84ce53e99093d752\engwub792.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-rasrtutils_31bf3856ad364e35_10.0.19041.84_none_04b8b1491897f94f\uanalwan502.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe File created \??\c:\Windows\WinSxS\msil_inspectvhddialog6.3.resources_31bf3856ad364e35_10.0.19041.1_it-it_915f3bc215c66ec6\zirio112.exe 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language services.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 888 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe 3404 services.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 888 wrote to memory of 3404 888 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe 84 PID 888 wrote to memory of 3404 888 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe 84 PID 888 wrote to memory of 3404 888 949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\949872d3ed5b587b4e1599713aaad983_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\services.exeC:\Windows\services.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5949872d3ed5b587b4e1599713aaad983
SHA13bfe7bc2e7c4de35bf648522576dbc37d5be8a27
SHA2560f4d38736ba0c91d4c4b208dfce9a0ab2b26dbc44fde6488529acc712f193d2f
SHA512ad383328c0b4a0c706bb7298bc17eb6fbc8e9772ea0a8b897c9859dc84605051f7bcdf25e8e182c2970a17d70fa34d275bdfe07b81ac9d5f2697cb5d955d0aaf