Analysis
-
max time kernel
125s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 03:41
Behavioral task
behavioral1
Sample
ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
4 signatures
150 seconds
General
-
Target
ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe
-
Size
322KB
-
MD5
ea84cf15639d2f92f662f645302c2fc6
-
SHA1
540b698f71ed2f14f66d8cce8a26516729b8d0fe
-
SHA256
11ace62fc70a1f1f220e0b39a1657bdebfcb97637c3b116d73b0aa4939cb852e
-
SHA512
7af841c89e7321b94f366ed56f324361b11f18b43b2f2d8c3abfe1d89a8873778dfd9ec55246ca39c6aad3592dcb696a8952208233f40ca61e880b1a6159e7a0
-
SSDEEP
6144:PGtsDPOXAdff3CgzusvePPMqLckUet72FwBI+AFdb8Mut:lbdfK6xaMVkUet7EwBI+APut
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4364-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x000f000000023370-5.dat upx behavioral2/memory/4364-1958-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4364-1957-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4364-4307-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4364-4308-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4364-4309-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/4364-4313-0x0000000000400000-0x000000000040F000-memory.dmp upx -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\mmgaserver.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\srdelayed.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\TSTheme.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\wlanext.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\comrepl.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\makecab.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\systray.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\wecutil.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\msinfo32.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\raserver.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\ctfmon.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\forfiles.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\getmac.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\help.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\tttracer.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\wlanext.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\dcomcnfg.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\PATHPING.EXE ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\taskkill.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\WerFault.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\eudcedit.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\fltMC.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\LaunchTM.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\poqexec.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\Robocopy.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\ARP.EXE- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\Dism.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\TapiUnattend.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\unregmp2.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\ndadmin.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\wermgr.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\proquota.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\shutdown.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\label.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\mfpmp.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\MRINFO.EXE- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\netsh.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\mavinject.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\regedt32.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\comp.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\dxdiag.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\typeperf.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\charmap.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\fc.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\find.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\clip.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\convert.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllhost.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\driverquery.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\dxdiag.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\runas.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\sfc.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\systeminfo.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\SysWOW64\where.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\7-Zip\Uninstall.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\msedgewebview2.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\Install\{C4DE67E0-347D-4E90-AF69-87B120456F47}\chrome_installer.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\Install\{C4DE67E0-347D-4E90-AF69-87B120456F47}\chrome_installer.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.195.15\MicrosoftEdgeUpdateOnDemand.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\IMEPADSV.EXE- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftPdfReader.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.1202_none_7f995fddf54c000c\r\SppExtComObj.Exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.19041.1202_none_b9662ef4fe1412ad\OfflineScannerShell.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.264_none_13222f28beaa00a7\f\vmwp.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_7777dd52093f9dd6\r\control.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\wmpshare.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_171488549e32a4d3\typeperf.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.746_none_43128ab833fd583f\fsquirt.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_aa218bebc7c352ef\r\upnpcont.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.19041.746_none_c77d8290c75caeee\r\DataExchangeHost.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.1_none_735c6874d3056a0a\ofdeploy.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\query.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.19041.1_none_be7f82b3c03af8b8\TpmTool.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.1_none_cd761f3a5c1f786f\auditpol.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.928_none_1d29b4735b607954\services.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.19041.1_none_bf2412b3ea69b4cb\lpkinstall.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\vmms.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\f\Setup.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.19041.1202_none_72f9f7c7a1b307dd\TpmTool.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_01dba454b887ba53\r\fltMC.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.19041.1_none_ffa61ab82b82ecca\Fondue.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.19041.1_none_15d956c7fccae922\runas.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\CHKROOT.CMD- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.1_none_8a237828132e61da\Build.bat- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.423_none_c3eac275ecdf7e0a\f\NgcIso.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.19041.84_none_2c3254d57443e050\f\SrTasks.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\ssh-add.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1202_none_5b834788c0d17953\iexplore.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.1_none_d0a876615f23523d\WmiPrvSE.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\f\setup16.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.19041.84_none_8a067925a612632c\ApproveChildRequest.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx35linq-edmgen_31bf3856ad364e35_10.0.19041.1_none_646d0595db3c1ad4\EdmGen.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.1288_none_75442af2fe19577c\f\tcblaunch.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.1_none_9fbebf8222c20a6d\uwfux.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_be98bb8265bc211a\f\mmgaserver.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-alg_31bf3856ad364e35_10.0.19041.1_none_5eda5fa3fa7c0fb7\alg.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_6c7de5b30e8f6071\r\BackgroundTransferHost.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_f28ba6a10743aebc\SpeechModelDownload.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.19041.1_none_339537d6c993f72b\AgentService.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\f\ApplySettingsTemplateCatalog.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.1266_none_3e00d223332897b8\r\SearchApp.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1151_none_0412565dd5f26733\wkspbroker.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\r\CredentialEnrollmentManager.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1_none_ef1691668a233417\appidtel.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_119b1e415d838a28\autoconv.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.19041.546_none_70569b662ddb706c\CameraBarcodeScannerPreview.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.19041.746_none_ff3f6c27e956149f\LanguageComponentsInstallerComHandler.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.1266_none_18784aba5fcd68cc\f\TokenBrokerCookies.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\SgrmBroker.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.19041.1_none_407b1fa0f7dce496\RmClient.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_d7b5820f5a89765b\r\agentactivationruntimestarter.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setx_31bf3856ad364e35_10.0.19041.1_none_6cbc8da4ecceab64\setx.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_216932a6d29366ce\diskperf.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.19041.746_none_a5986eca8fd4063b\f\CastSrv.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\PrintBrm.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\SecHealthUI.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.19041.1266_none_23ae8c0349f1b325\f\UsoClient.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1202_none_a27aa61d221bdc5c\f\wordpad.exe- ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea84cf15639d2f92f662f645302c2fc6_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4364
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4160,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:81⤵PID:1944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
867KB
MD5c43f60f05aa50dec1acfa961d3b65a76
SHA1eb9ddde74e7fcf33655062e3bbef0a5185ffb932
SHA256aed3d7ecf4790d1b74114bdcadbf2b28c3b9757ac2ef6372a8fa5c3cc0818800
SHA5120904cb349a984b508cc6fe4e9f5430f544aa986f2f2b46008f8fafd48f26641021181b67775d609e21dea92fe1808cebb8bb1aa17b757519f3d76d5891ea1744