Analysis
-
max time kernel
135s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 08:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe
-
Size
158KB
-
MD5
c05d61f8e09dce38db6fba619b714b98
-
SHA1
d87c04792899cca54457b660fe7d04dd684ed56b
-
SHA256
583ba7b20da6acc1c2e501d2a2e32d533650bdd8a5f9f1d94b5c8382e7ad9c9b
-
SHA512
b2c5e3b5a97d435a0f019a242f9d45c8216825c78bdd3337fbcd72f4b9ef0c9a17a4530eae4776f25a8e6c529113c9642bf8902ebc4c34e058903e19caf58c5c
-
SSDEEP
3072:uBjoafTJvJ6RsMHdnV5QJscpl1zlsRgLhLy1eQY3noVQvoArT:efTJROJnV5QJscpl1zlsRgLty1eQY3nB
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ACLControl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ACLControl.exe" c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe -
Modifies WinLogon 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl\DllName = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ACLControl.exe" c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl\Impersonate = "0" c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl\Asynchronous = "1" c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACLControl\Logon = "ACLLogon" c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Com\it-IT\comrepl.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\ieunatt.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\powershell.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\cmmon32.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\eventvwr.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\isoburn.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\bootcfg.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\cmdl32.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\GamePanel.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\lt-LT\quickassist.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\uk-UA\cmdl32.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\ja-JP\WMIC.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\fi-FI\quickassist.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\at.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\iexpress.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-MX\quickassist.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\tr-TR\quickassist.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\en-US\MigRegDB.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\cmstp.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\hh.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\de-DE\IEChooser.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Fondue.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\uk-UA\Fondue.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\it-IT\mofcomp.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Fondue.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\cmdl32.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\cmdl32.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\en-US\mofcomp.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\csrss.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\es-ES\IEChooser.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\cmstp.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\cmstp.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\CloudNotifications.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\uk-UA\GamePanel.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\isoburn.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\it-IT\MigRegDB.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\CloudNotifications.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\GamePanel.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\ro-RO\quickassist.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\explorer.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\uk-UA\IEChooser.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\explorer.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\at.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\uk-UA\iexpress.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\zh-TW\quickassist.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\hr-HR\quickassist.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\charmap.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\uk-UA\ieunatt.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\isoburn.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\XPSViewer\ja-JP\XPSViewer.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\at.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\cmdl32.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\eudcedit.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Fondue.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\de-DE\WinMgmt.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\en-US\WinMgmt.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\dialer.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\charmap.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\fr-FR\IEChooser.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\hh.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\es-ES\WMIC.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\powershell.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\ieunatt.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\canary.identity_helper.exe.manifest c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\ja-JP\wmpnetwk.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe.config c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe.config c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\telemetryrules\hxcalendarappimm.exe_Rules.xml c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85546\java.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\uk-UA\wmpnetwk.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\uk-UA\wmpnscfg.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\fr-FR\setup_wm.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\uk-UA\wmplayer.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\TabTip32.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\TabTip32.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{6ADF0E6F-E89E-4071-B634-15DAFC87E007}\chrome_installer.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\uk-UA\setup_wm.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\es-ES\wmlaunch.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\fr-FR\ieinstal.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\ja-JP\wmplayer.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\en-US\wmlaunch.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\es-ES\wmplayer.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-e..atibility.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_de9230c716bec0cf\DWWIN.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..auncher-cmdlinetool_31bf3856ad364e35_10.0.19041.1_none_ad30f89d0263039b\pwlauncher.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleExperienceHost.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_pt-pt_79ad1526caedcc46_memtest.exe.mui_77b8cbcc c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.264_none_309e9e4a939c0bac\cscript.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.746_none_43128ab833fd583f\bthudtask.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\r\explorer.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\find.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_f57e08b2e5fa6e95\runonce.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\f\LaunchTM.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.1052_none_323c9a9ad543e3a3\r\smartscreen.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..p-utility.resources_31bf3856ad364e35_10.0.19041.1_en-us_aa5b3dc03e55204b\finger.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..assistant.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfc0bcd305c2bfaa\pcalua.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mcomputer.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b39aec0ac4bbb524\SystemPropertiesComputerName.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..oundagent.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d2b68ad2cec3abb\SpaceAgent.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.1266_none_e8d910c7c702b558\r\MusNotificationUx.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_multipoint-logcollector_31bf3856ad364e35_10.0.19041.1_none_56138d203a7fc4cf\LogCollector.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eudcedit.resources_31bf3856ad364e35_10.0.19041.1_de-de_bb1c696557bdee69\eudcedit.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\f\vmcompute.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-driverquery.resources_31bf3856ad364e35_10.0.19041.1_es-es_b2ceaf1661d2c74f\driverquery.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist.resources_31bf3856ad364e35_10.0.19041.1_sv-se_9d5a8b98b0fb4eb6\quickassist.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.19041.746_none_099c40ad55bc5d6c\AuthHost.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.19041.746_none_a5ade2e84580e250\r\DmNotificationBroker.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.207_none_ac38fc33d542b487\f\WorkFolders.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.153_none_47569e595c44e70c\r\FileExplorer.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.1_none_5106d54a804dbfc3\rmttpmvscmgrsvr.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.1202_none_fdbbcf53ca14e151\r\wimserv.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_1d38815769c81e5a\r\dllhost.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\r\oobeldr.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\r\gpresult.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.19041.1_none_8ddc3834fb6f659f\iscsicpl.exe.mun c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nsettings.resources_31bf3856ad364e35_10.0.19041.1_en-us_13b777f93b1dfd31\PresentationSettings.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_3.5.19041.1_none_82a6b3679b68b331\MSBuild.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..ne-editor.resources_31bf3856ad364e35_10.0.19041.1_en-us_73e25911d31276d0\reg.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk.resources_31bf3856ad364e35_10.0.19041.1_es-es_ff4a720691132dc8\autochk.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..r-process.resources_31bf3856ad364e35_10.0.19041.1_es-es_424e6038665b571e\dwm.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.1_none_51facbaf4051768b\resmon.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.19041.1_none_b0876c2e7a0b3a5f\SpaceAgent.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_ad0ed54dd130eec3\r\DismHost.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_3bcd0306a19592e2\r\Robocopy.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\Boot\PCAT\fi-FI\bootmgr.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms.resources_31bf3856ad364e35_10.0.19041.1_es-es_fbd8177850cc1935\vmms.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_a40a1f93665b43eb\r\SndVol.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..telrunner.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_b86e662e5cd8a100\CompatTelRunner.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\f\uwfux.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..linetools.resources_31bf3856ad364e35_10.0.19041.906_en-us_723764f005113fa1\f\gpresult.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.19041.1_none_69f4af04dd2c1f80\lpr.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.1_none_6bac6724a4ab4460\svchost.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1052_none_b39097e5dc722fb4\f\GamePanel.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\en-US\bfsvc.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\r\rdpshell.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_f5ba41fece31d7fe\r\SpatialAudioLicenseSrv.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1266_none_650ebab5a8c02ffc\f\autofmt.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr.resources_31bf3856ad364e35_10.0.19041.1_es-es_1392da55382b3ddc\cleanmgr.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn.resources_31bf3856ad364e35_10.0.19041.1_it-it_138a010e9ec4c5b5\isoburn.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.19041.1_none_2318682da2c7a3ea\PresentationSettings.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.19041.1288_none_ff9a0c377d92f65b\r\wpnpinst.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.19041.844_none_5308232e9343b869\r\WinBioDataModelOOBE.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-v..skservice.resources_31bf3856ad364e35_10.0.19041.1_en-us_5801e9f68bdc3d85_vds.exe.mui_2268d934 c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.746_none_3f7ee0a8ee28ef7d\f\netiougc.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist.resources_31bf3856ad364e35_10.0.19041.1_ro-ro_094bffe9efb84386\quickassist.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.19041.1_none_a4a8dfd6e5f1aab8\dsmgmt.exe c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_10.0.19041.1_it-it_09cd7363afc7ebfa_rasautou.exe.mui_55686a97 c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe File created C:\Windows\Boot\PCAT\nb-NO\bootmgr.exe.mui c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c05d61f8e09dce38db6fba619b714b98_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD53501e1143afdfac59c9659876e6fe961
SHA169d496bd5bf3623f335dcfcfdbfc185e386bd62a
SHA256019960a09d2d72980e86634d8c8e319b07442bd5b5b5cfff2d51394bab43a431
SHA512fd553053195eae99b1face910ab5855e35002aef352e9b4c6b68cf098c7625bdf658066eb2a60129b4fbd69e4562f8984f1857bb024c123b73b2388045070850
-
Filesize
138KB
MD5c4d77f566bd7b2e5e86ca968c762d7a0
SHA119bf978aaa08b277d541cec6e8f9c644fb95fd5c
SHA2567e23b525a3f8566f9b187dfda0aaaefd4bb8fa2ea1d25e56a4f827c1ba5b44b0
SHA5123ff3521fa54419bac366ada327d7d23cda009fd41a539440caf1775424d6c074f93a73394734473a7cf5406a48c6e5642702db555e42078d4046b0a9e813dbbb