Analysis
-
max time kernel
138s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-08-2024 16:02
Behavioral task
behavioral1
Sample
b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
General
-
Target
b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe
-
Size
85KB
-
MD5
b41be2ad467aee515e9223457d616b4b
-
SHA1
ad2d4bf5e5f574de1aa8725e0bfb275b48228860
-
SHA256
9847f8a5dcffe85ca88be47872d1235da56e0989d66a7f8d9141cc61783f9816
-
SHA512
7630f75c359965ed662deea72a0d8d1788635002f88508cd4380414c990f57e0f79ce9b39125f28cc6c3ac6ca0032837c5d2bdf1e88b938582fff0c914c5833b
-
SSDEEP
1536:Wjl+2lHKITkBXkHbo/8kbrcJj6XWLuFm6yECw0qjW9SRnkgFflnLX:O5HKITkBXkHbo/8kbgj6XWLuFTyDeSSd
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/408-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x000900000002341e-5.dat upx behavioral2/memory/408-1983-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/408-1981-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/408-4244-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/408-4245-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/408-4249-0x0000000000400000-0x000000000040F000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\xcopy.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\PickerHost.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\prevhost.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\mspaint.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\net1.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\print.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\recover.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\mavinject.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\mfpmp.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\SecEdit.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\TpmInit.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\charmap.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\netbtugc.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\PickerHost.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\wextract.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\wowreg32.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\finger.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\Fondue.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\RdpSa.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\srdelayed.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\msra.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\perfmon.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\RMActivate.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\cipher.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\cttune.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\gpupdate.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\secinit.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrshost.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\gpupdate.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\lodctr.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\mmgaserver.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\msfeedssync.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\at.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\ddodiag.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\dplaysvr.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\ftp.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrm.cmd- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\mmc.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\nslookup.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasdial.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\appidtel.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\chcp.com b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\fsquirt.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\typeperf.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\MRINFO.EXE b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\certutil.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\colorcpl.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\eventcreate.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\format.com- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\label.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\openfiles.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SysWOW64\wermgr.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\firefox.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\updater.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\LimitDeny.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\7-Zip\7z.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\cookie_exporter.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.195.15\MicrosoftEdgeUpdateOnDemand.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.195.15\MicrosoftEdgeUpdateSetup_X86_1.3.195.15.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.195.15\MicrosoftEdgeUpdate.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.19041.1_none_53029e0f94a11c6d\WUDFHost.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.1_none_5c015a65c60d8097\hnsdiag.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.19041.1_none_3626754ec37c229b\RmClient.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.84_none_29cf9b86db5fb249\Setup.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.19041.1266_none_e488d49c8a22d21e\winlogon.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1266_none_1f1ff89fbf279f16\f\FaceFodUninstaller.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_9e3e509d4c4881e1\f\MuiUnattend.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.19041.1288_none_23aa03725ec9354a\wuauclt.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\explorer.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\CallingShellApp.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1266_none_82441dbab862ff6a\r\msoobe.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.746_none_a9ff72b1a43fd663\r\DeviceCredentialDeployment.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1266_none_bee3df875f7e71bb\r\spaceman.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.19041.1_none_ec479f963c4c3325\ddodiag.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\f\mofcomp.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\f\tracerpt.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.746_none_2703bed0ba809808\f\GamePanel.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.19041.1266_none_92496ac84272f5f1\r\LegacyNetUXHost.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.1_none_43a1294286598aee\IcsEntitlementHost.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\r\appidpolicyconverter.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.19041.423_none_12ca604b48f8d3fb\CapturePicker.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_d0cf24ea634e86e3\r\explorer.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SystemApps\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\UndockedDevKit.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\f\immersivetpmvscmgrsvr.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\f\tpmvscmgrsvr.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.19041.1202_none_72f9f7c7a1b307dd\TpmTool.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\f\hcsdiag.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.746_none_7946fb11bf19dc87\r\coredpussvr.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.19041.1151_none_cf9de3ecb3a8f61c\f\BrowserCore.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.1_none_4a6487592c595dd4\mpnotify.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.153_none_ff44cfa7cb529ce3\r\lpremove.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.19041.746_none_7aa85dbabd7172c7\PrintIsolationHost.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.82_none_2dad4b68cbfd8794\FlashPlayerApp.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-adminservice_31bf3856ad364e35_10.0.19041.906_none_388c7870566ba06d\WMSvc.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_735abbdbad8c902f\cmd.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_b2e64138c9682982\f\InputSwitchToastHandler.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.19041.1_none_02ef1556ab50e6d8\wabmig.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_7777dd52093f9dd6\r\control.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1151_none_c86feb6936a97173\r\omadmclient.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\doskey.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..oreuap-iotuap-tools_31bf3856ad364e35_10.0.19041.1_none_e15558ebc4b8bd81\iotstartup.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.19041.1266_none_b5fa73367bbd2f91\klist.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\AppVNice.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootconfig_31bf3856ad364e35_10.0.19041.1_none_c2078a8db9a59aef\bootcfg.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.264_none_4a12028313046a9e\r\ntoskrnl.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.746_none_dbecc8a3cdc7c3cf\DataUsageLiveTileTask.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.19041.1_none_3a8d8b0c2eae5eda\DpiScaling.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\r\user.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-adminservice_31bf3856ad364e35_10.0.19041.1_none_1058f7ab971a5799\WMSvc.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1_none_61cd745a990bcfb3\msinfo32.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.19041.1_none_6568d39003c9a6d5\TieringEngineService.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_10.0.19041.1_none_fa6e7f402dbc0227\MSBuild.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.1266_none_22ccf50c942e2ac7\f\TokenBrokerCookies.exe- b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b41be2ad467aee515e9223457d616b4b_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
630KB
MD5ce29c26378e8b4f7ff45ec80c5313b6c
SHA15d5f3ea1929d7240bb23a8a123281bbc5721d879
SHA2569ce8aafade319c93d42229c91958fde0e92731292f46444e3159b1600673e79b
SHA51239976cc1b1959ab0e16e64bb130a20b82ded9b9285e0a697d3e7d3b13a1c5e31c1f0b3d4de24368fc135093097cbbb358d558c39def7ae51a851cdce5fb29ad6