Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 09:21
Behavioral task
behavioral1
Sample
de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
4 signatures
150 seconds
General
-
Target
de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe
-
Size
1.6MB
-
MD5
de2375cdac81186fe214399e3e59c1d1
-
SHA1
96e2d246922f4754ec1e76e757f21ea4b288e667
-
SHA256
0e7a4317ffe87e9a35d9c550558b23c794c19fe46810f2d5f8d4b35d5b9991a8
-
SHA512
59a839124c686ec1b8c668bee470b5925258642cfc3e2e4dfbddf473006887e1734a22369e09a3d8184af35f4e647d47f28fd053fd7e2f42064394866b4b651d
-
SSDEEP
24576:lpi6eMDSwaeH8wpZ1FGgmfOCa+uRgiNOnfD3RgUOscZXI:lpowaeH8+Z1pmfOj9o73RgUOF2
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3764-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x000900000002345e-5.dat upx behavioral2/memory/3764-1576-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3764-1575-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3764-4013-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3764-4245-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3764-4246-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3764-4251-0x0000000000400000-0x000000000040F000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cmdl32.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\iscsicli.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\netsh.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\subst.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\regedit.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\chcp.com de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\wowreg32.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\TpmInit.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\TRACERT.EXE de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\relog.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\runas.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\appidtel.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\notepad.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\ktmutil.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\rasautou.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\RmClient.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\Robocopy.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\tree.com de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\wermgr.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\clip.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\fltMC.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\dcomcnfg.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\ipconfig.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\ntprint.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\RpcPing.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\sethc.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\tcmsetup.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\charmap.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\control.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\Utilman.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\wusa.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\explorer.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\GamePanel.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\print.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\tar.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\xcopy.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\runonce.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\userinit.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\findstr.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\mfpmp.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\proquota.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\resmon.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\cmstp.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\format.com- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\mode.com- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrshost.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\dccw.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\unlodctr.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SysWOW64\eventvwr.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\updater.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\show_third_party_software_licenses.bat- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\wmprph.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\7-Zip\Uninstall.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_installutil_b03f5f7f11d50a3a_4.0.15805.0_none_004b4e08cd94c339\InstallUtil.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\r\wdagtool.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-makecab_31bf3856ad364e35_10.0.19041.207_none_cef5032ec7ecd573\makecab.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_477a57e55b61aba8\r\SyncHost.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.1_none_623e57cb80e184b5\PasswordOnWakeSettingFlyout.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_10.0.19041.1_none_ef230558c150a821\inetinfo.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.19041.1151_none_cf9de3ecb3a8f61c\f\BrowserCore.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_msbuild_b03f5f7f11d50a3a_10.0.19041.1_none_421bb61742382b2d\MSBuild.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_e304dcaa2490f61c\r\SystemUWPLauncher.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1_none_61cd745a990bcfb3\msinfo32.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.19041.746_none_49c7c9a4b745444e\r\PhotoScreensaver.scr- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\a267614236e5d701639700001815341f.UwfServicingSvc.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.19041.746_none_744cb37f06e446cc\RuntimeBroker.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_e95531bdadf3df5c\wmpshare.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.19041.1_none_9470ed79dcf5eade\help.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_c171e0be75e709de\r\dsdbutil.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.1_none_e190f18a08ed1a44\FlashUtil_ActiveX.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.19041.1288_none_ff9a0c377d92f65b\wpnpinst.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.19041.1_none_c3249fe181844dfb\MsSpellCheckingHost.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_324ea383dbfddeb9\mavinject.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1_none_0d3d1dcf5184d281\appidpolicyconverter.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.19041.746_none_a5986eca8fd4063b\r\CastSrv.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1_none_bf506ecc66a800df\poqexec.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.264_none_be8a8ad4892e651d\printui.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1_none_595f2a7acaf53bba\WpcUapApp.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_9fcce199936290f4\upnpcont.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.1_none_56a3c953964ea509\WinMgmt.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.19041.844_none_3a7392af5414371e\f\CCG.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupcl_31bf3856ad364e35_10.0.19041.1_none_0ea013578aa5744f\setupcl.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.19041.746_none_9d44fd61d4c8aeec\SecurityHealthSystray.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.1_none_6314a7411fa6f2ec\FXSSVC.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\f\typeperf.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceproperties_31bf3856ad364e35_10.0.19041.1_none_a03b7086d9468b36\DeviceProperties.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_d93ee361fbbc8f0a\r\XGpuEjectDialog.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_21d0a68ccdc67be8\r\wusa.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.928_none_138fb436497565f4\f\directxdatabaseupdater.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.19041.985_none_4a26c2c5164ad5c7\f\CIDiag.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1_none_bf506ecc66a800df\TiWorker.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.19041.1_none_ea34e25ca28496c3\tzutil.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.1_none_86e0e6ce46c9ed74\WinRTNetMUAHostServer.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.19041.1_none_c9f3f831b5b3535d\PinningConfirmationDialog.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.19041.1151_none_cf9de3ecb3a8f61c\r\BrowserCore.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.19041.264_none_7dd490aa65cdf624\r\runexehelper.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\r\gpupdate.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\f\ScreenClipping\ScreenClippingHost.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_6f1fcb1866fcb4b8\r\ntprint.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.19041.1266_none_90436a82b05bca89\WPDShextAutoplay.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\audiodg.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootconfig_31bf3856ad364e35_10.0.19041.1_none_c2078a8db9a59aef\bootcfg.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.153_none_47569e595c44e70c\FileExplorer.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.19041.1266_none_23ae8c0349f1b325\f\UsoClient.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.1266_none_1abb9653828c3f41\SecurityHealthService.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVNice.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..verycenter-platform_31bf3856ad364e35_10.0.19041.153_none_212a5b73f083deb3\SystemResetPlatform.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.19041.1_none_1a86be89cbd66ed2\bdeunlock.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1023_none_228521f0037fd996\f\PickerHost.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.117_none_7879d5035b0edfac\r\nltest.exe- de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\de2375cdac81186fe214399e3e59c1d1_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3764
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5901b41fcb245b66b9144191952aa339f
SHA17d643803455433f5531a19570222bb0d21f86669
SHA256c6c75c3c3b33371789edfccb2b0d9484c46211682e61c547ceedf38f023a24aa
SHA512d8ce149d4bb38905f31cce9ecdaefce03b80f5fd9a4fb211bc9396cb72362f17b11644452d36140556a1c86d6a9edff2216d7e689c0e4343c42c3e524a2ea269