Analysis
-
max time kernel
136s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 15:19
Behavioral task
behavioral1
Sample
b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
General
-
Target
b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe
-
Size
75KB
-
MD5
b3fbc9928894083f3ec8e28f4e7c340a
-
SHA1
59ca104e9edb492153b9c1fee3e65df5861a0535
-
SHA256
d6fd23d4856e85ba833ef07572c5b834ccba38e9675563d0ddc1f95c87ea38c8
-
SHA512
da259b46df98f1f41bcb7aab3c04acb8683099341809aca52613ae43ca4d36afa91c7ca2b3388b524c36785fd5c1d673e48c7a555ec85f0d20454c43d06802cc
-
SSDEEP
1536:Wjl+2lHKITkBXkHJ7q6affYYl/3hJ2stu2WfpzYRZKMoZNI:O5HKITkBXkHJ+6CYo/3hJ2stu2WfpzYZ
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2840-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x00090000000233f5-5.dat upx behavioral2/memory/2840-1765-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2840-1761-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2840-4249-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2840-4250-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2840-4251-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2840-4256-0x0000000000400000-0x000000000040F000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\instnm.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\ktmutil.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\PING.EXE- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasphone.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\verclsid.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\AtBroker.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\mobsync.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\mstsc.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\replace.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\wscadminui.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\RpcPing.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\runonce.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\TSTheme.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\tttracer.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllhost.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\eudcedit.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\scrnsave.scr- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\sdbinst.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\subst.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmmon32.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\efsui.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\MRINFO.EXE- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\net1.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\verifiergui.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\logagent.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\runas.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrs.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\raserver.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\systray.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\fontview.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\typeperf.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\unregmp2.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\userinit.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\tzutil.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\dfrgui.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\logagent.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\msra.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\PkgMgr.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\write.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\wusa.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\iscsicli.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\waitfor.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\at.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\edpnotify.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\label.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\fontview.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\iexpress.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\iexplore.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\iexplore.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Windows Mail\wabmig.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\minidump-analyzer.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\updater.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.1_none_6c93021db54246b0\PasswordOnWakeSettingFlyout.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.928_none_0f531ea0d233243b\DiagnosticsHub.StandardCollector.Service.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.746_none_bd9bc99304595128\f\ReAgentc.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1266_none_1f1ff89fbf279f16\r\FaceFodUninstaller.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\CredentialEnrollmentManager.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_e9349b06dfab6fdc\imjpuexc.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\f\SgrmLpac.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.1_none_9c79736d61efaf52\imecfmui.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\ssh-keygen.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6a67731cf3e151f2\r\pcaui.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.19041.1_none_4d9121ef47f5b52d\mshta.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1202_none_ca1e0a7a1f21274c\f\drvinst.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1202_none_ca1e0a7a1f21274c\r\drvinst.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_737d8b2eaaa38234\r\DWWIN.EXE- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\r\NarratorQuickStart.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.19041.1_none_2cda3b956fcdb26f\InfDefaultInstall.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\r\WSManHTTPConfig.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.19041.1_none_a6017688e5093466\dcdiag.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_a40a1f93665b43eb\SndVol.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\r\SenseSampleUploader.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_e9349b06dfab6fdc\f\imjpuexc.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_955497efbb030cb9\wermgr.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.19041.1_none_f049c4ee402ced19\colorcpl.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\r\sethc.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_092d70d1898e5ff9\r\DismHost.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\r\ssh-agent.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.1_none_1eef5aede16ab3bc\Dism.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\r\logman.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.207_none_c5e1b9def3522696\securekernel.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\f\windeploy.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\chgport.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\TSAppInstall.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_816403dd2374fa29\dfrgui.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\ScriptRunner.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.19041.1023_none_374973298940e35c\f\FilePicker.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_470f45b46101edfb\powershell.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..executionprevention_31bf3856ad364e35_10.0.19041.1_none_8a292178f857b8d8\SystemPropertiesDataExecutionPrevention.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_76d2900542f0226c\r\BackgroundTransferHost.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\Taskmgr.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.19041.1_none_65a5646e8443d0f8\MicrosoftEdgeDevTools.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.19041.746_none_49c7c9a4b745444e\f\PhotoScreensaver.scr- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_9204c42a031e28cf\f\appcmd.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.423_none_841c30f68571c385\f\hnsdiag.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx-dw_b03f5f7f11d50a3a_10.0.19041.1_none_46d7d57b97bd01e0\dw20.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\a30f994536e5d701169b00001815341f.aspnetca.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\Taskmgr.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-secinit_31bf3856ad364e35_10.0.19041.1_none_47fda84da0bc8185\secinit.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.546_none_f8b0afde1e951639\f\WmiPrvSE.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1_none_522bacd027283125\UwfServicingSvc.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\r\uwfux.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\f\SecHealthUI.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.423_none_c3eac275ecdf7e0a\f\NgcIso.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.746_none_726cc4a1ebcb1c1e\mpnotify.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.746_none_7946fb11bf19dc87\r\coredpussvr.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.746_none_dbfd31e3890afb72\r\SensorDataService.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netsh_31bf3856ad364e35_10.0.19041.1_none_1fe6ae13cb971ac8\netsh.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2b8b5a41940eac9f\r\prevhost.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netsh_31bf3856ad364e35_10.0.19041.1_none_159203c1973658cd\netsh.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.19041.1_none_3451e3c68828f3da\smss.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\r\gpresult.exe- b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b3fbc9928894083f3ec8e28f4e7c340a_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
619KB
MD59bb2cc6f09c41f21366b4a92cd5d3ae1
SHA1773955e884fa72d595734b51a45521c4c462a26f
SHA256ebbd4894777d41cda85f3b8404a1e090473dbf690b771ad40c55ba92e29bd24e
SHA51268f6f470a6a2bbcd72a6c97cbf505c34edf7d2788b5f8c97c102c9675f1bf20e7cea9246226c616c4213dd89085850f055cc59bfcb31a3171774a7a3fab48a81