Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 23:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
150 seconds
General
-
Target
a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe
-
Size
23.5MB
-
MD5
a8aec689cf6aae0e648435068829c7fe
-
SHA1
7b1d56e86a26e49ce311ef2aab4deb56def23aba
-
SHA256
7a5394bade4582b9826a436abfe3bc3233a8e857146a28fd70539da8c5450924
-
SHA512
790e6b60f583764c4b30ac492a5098026bad46b4edc34c3c0fc0aadafa1f8b67687636f994af2d06b0dc756020311b74dc97e7aaa07bd0ae4606e339bda1cfe9
-
SSDEEP
49152:XYgph7GBfWiHaqCGXDkYOMwwnMb4PmyVhV:XX77GBfWr1GIYOXwnS4rVhV
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fltMC.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\mmgaserver.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\RmClient.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\userinit.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\fontview.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\TpmInit.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\wecutil.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\dcomcnfg.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\msra.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasautou.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\explorer.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\AtBroker.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\dtdump.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\dxdiag.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\RmClient.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\wecutil.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\PresentationHost.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasphone.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\wlanext.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\dvdplay.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\clip.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\doskey.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\mfpmp.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\more.com a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\appidtel.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\efsui.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\pcaui.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\PickerHost.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\sethc.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\where.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\certutil.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\write.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\forfiles.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\xcopy.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\compact.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\find.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\gpresult.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\gpupdate.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\bitsadmin.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\Fondue.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\lodctr.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\convert.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\mobsync.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\poqexec.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\raserver.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\label.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\notepad.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasdial.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\ReAgentc.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\minidump-analyzer.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_84546\javaw.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpshare.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\show_third_party_software_licenses.bat_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\iexplore.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_84546\javaws.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Windows Mail\wabmig.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\sysmon.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVNice.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.19041.844_none_3a7392af5414371e\r\CCG.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.19041.1_none_fad576d8cf74b38a\dispdiag.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.1202_none_c0150a0a443c0ffc\wbadmin.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.19041.1_none_9ffa8bc52ecc9e29\comrepl.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.19041.1_none_cdd05846922cdabb\msdtcvtr.bat_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1_none_a813da7cbdfebb0a\adamsync.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1_none_b6a6a2ae8b1ec7b0\vfpctrl.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\r\LaunchTM.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\hh.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\LaunchTM.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\r\CustomInstallExec.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.1_none_e73c658ee671e530\ChtIME.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_1d907c422e447b14\dsdbutil.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.19041.1081_none_f52da7b1195e2d45\f\DiskSnapshot.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.423_none_df344b9fe5390f25\r\AppResolverUX.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.19041.844_none_93c03ca99a47dc8f\omadmprc.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_42ec0e96ce977bdb\f\gpscript.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.746_none_6ba9668b45cb4938\IcsEntitlementHost.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\vmms.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\r\SpeechRuntime.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.746_none_c291aefd01a5d6d6\f\EoAExperiences.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVDllSurrogate.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.19041.423_none_12ca604b48f8d3fb\f\CapturePicker.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1_none_0990e3dd20dd5732\omadmclient.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.19041.84_none_bf1eecf3f472e3ce\f\Defrag.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.19041.1202_none_c26e06f4b82585b5\r\dmclient.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_ba2b07b5ed02761a\f\imecfmui.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.19041.1288_none_f26bd0dcdf662cc9\f\AgentService.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.746_none_c1db40c45e8f2d9e\wbengine.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7000e6adf00c3d30\r\CloudNotifications.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.19041.1_none_8f7cfa81649ea7a8\esentutl.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\ApplySettingsTemplateCatalog.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1_none_8591bd54bdb2be6f\AtBroker.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\r\uwfux.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.423_none_2cade1bc915dca0d\r\Microsoft.AsyncTextService.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.746_none_63b0fc68ee30f2cb\f\IMESEARCH.EXE- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.19041.1_none_e8e077950faced1a\fodhelper.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.19041.746_none_3db5b5ee37a4dee7\CompPkgSrv.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Installer\$PatchCache$\Managed\E39B69A3F3677E14587CF1C3CC73FE72\48.108.8828\fileCoreHostExe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_4.0.15805.0_none_d67d06ef0c4a2e1c\InstallUtil.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\audiodg.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_datasvcutil_b77a5c561934e089_4.0.15805.0_none_5b1ada239e3b0505\DataSvcUtil.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\CloudExperienceHostBroker.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\SyncAppvPublishingServer.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.746_none_79bfc5cb57157e98\WindowsActionDialog.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\f\Taskmgr.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\r\Taskmgr.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.19041.1_none_682105a41c3c7a6b\IMJPSET.EXE- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.1_none_9224c91b2d8eed57\imecfmui.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1237_none_7578510aa0f564fa\f\vfpctrl.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1266_none_aa0661cc14f9fe9a\vmwp.exe- a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_770f598aef14382e\dfrgui.exe_ a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e097474bc7f1da01 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1238455479" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31125959" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1242361621" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074472bebe7af3a46942426e1e277b42a000000000200000000001066000000010000200000005c55e8d9956eaa66c4a02ef73d647cbaeb5e1ccfe384fb1f45f5f1edd91d9903000000000e8000000002000020000000603cdeba5b84c41e41c83d174baee612448f8cc86a05495fc45052b63e1a99492000000070187486c948aa6fcd8b969f6db63a174f3fb3a70293aac2ecc052926b27080740000000072a7c2f5fc0e6acb4b079edfd24298458f3d7f6acbfe0a0f65ffb5d62e3dfc15d5d12381e92a41e205a3f53c8732fc4fdbf0772f010252fee4919bd61959514 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31125959" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074472bebe7af3a46942426e1e277b42a00000000020000000000106600000001000020000000bafbb011ced29e45c463f7af940cbc465c701ce9d7e225e8846175780043a306000000000e8000000002000020000000cc8c5db192f48920d0dbba7f7ffa235225aa8c45744177296b91449a4394ede12000000011a4b2cc77eadd72fc55f7055a17afa54eb6da5202684ab5f90d1fd4acbabecc40000000a69ad7c2681783f6ca3a4d7c310013cc1fc1ec9c26a13071aabfa0745dcb8c4f843b17220c6e3ad0b1e77c5baae9e69e8087c7776096ff76cb5bf8a0d38437ee IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b039584bc7f1da01 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{756A2BE6-5DBA-11EF-9912-C61537EC8B44} = "0" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1238455479" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31125959" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430789063" IEXPLORE.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1308 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1308 IEXPLORE.exe 1308 IEXPLORE.exe 912 IEXPLORE.EXE 912 IEXPLORE.EXE 912 IEXPLORE.EXE 912 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 796 wrote to memory of 1308 796 a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe 84 PID 796 wrote to memory of 1308 796 a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe 84 PID 1308 wrote to memory of 912 1308 IEXPLORE.exe 85 PID 1308 wrote to memory of 912 1308 IEXPLORE.exe 85 PID 1308 wrote to memory of 912 1308 IEXPLORE.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a8aec689cf6aae0e648435068829c7fe_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1308 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:912
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24.0MB
MD5efb851a0843bc4362136a5d834edef8c
SHA1567a1464fa0a325dfdbf2b03414a7b300775d135
SHA256110c7191fe7438a572fe96487f75e35672ffb3945cbb2e55a0552b366ea2fd1d
SHA512b4a902b406f94a8e77caa850795eb1238ecc3259b9437740b4cfab9c3a17007610d972f99097f89606fb2a20de21e1606af7de1564d7b09dbbd6e7832670e8e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD55807ccf18a4daa262942fd318d06027d
SHA1dbc8a19819ea0e72bb69aea4e08b5c08b19cebe9
SHA25649127429f1b3e1e3126358abbce54b463587489939f48256edc3f4f54dc10890
SHA512204d2d8ff7d0b847b6263f9759441c88c32d39fca326de017c1c1e2bb33d64455adfcde5e96705f5408361a3a34baf002aaff12645413e5ec3bb13b2d7e980ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD54c21a82d6afd6e88565dafe5b6dad6a3
SHA13d92174fdec3de123193d00d0292057d759d3850
SHA256f9e0b7866ee2484b9ffefbf48703ee94b70ca3975c5e7bd66c3ba6b5043ca41a
SHA512aed1e304464e4d804794e5e066ccd22a1adf8020fd5db435ae80ad6bf101802846d58864a5c1906c4a5a49fbecfa1ccee57ec6b977b559e7cda46764dc2ef9a0
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee