Analysis
-
max time kernel
57s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-09-2024 01:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe
-
Size
69KB
-
MD5
eec73d5e57d461298462bda0ae7097fc
-
SHA1
a7796955e0475408e42c70e1839d654c5c428885
-
SHA256
ee4e13296df83a615961a3f0b198df16dc872b758b19a2642fdc16c59ee1c0d2
-
SHA512
3c3587482479169b512d51b6637d9ee0136a4d0e6b86c5cde9081dac9497d85e2db7d92f2725883ad4628b0ab029d960bd0ed5c9ea1fc1baaf633dbf78d5cf0c
-
SSDEEP
1536:EvzwF+cEpvnFbnL+43LIPnlEZfamCaYM4HPmqZZna7:3knF+4ctmtrq3ZZa7
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\System32\\userinit.exe,C:\\WINDOWS\\Film Porno.exe," eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Film bokep.com eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Film bokep.com eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fil Porno.vbs eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Film Porno.vbs eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServicesOnline = "C:\\WINDOWS\\Film Porno.exe" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\L: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\M: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\X: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\H: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\N: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\Q: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\R: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\T: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\W: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\A: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\B: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\I: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\O: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\Z: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\E: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\G: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\K: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\P: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\S: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\U: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\V: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File opened (read-only) \??\Y: eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe -
Modifies WinLogon 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = " !!! W32.Topinsutki.Moontok.B !!! " eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = " --- Hentikanlah kesombongan kalian --- ...Apa kalian tau rasanya menjadi manusia yang sia-sia?Apa kalian tau rasanya setiap saat dihina dan tidak mampu merasakan kesenangan kalian?Aku yakin selama hidup kalian tidak pernah sedikitpun merasakan rasa sakit itu?Wahai kalian yang ada di bumi ini,Kalian yang telah memojokanku dan Kalian yang telah merusak semua kesenanganku,Kalian hanya melihatku sebagai anak yang menyedihkan yang harus kalian singkirkan,kalian hanya memberiku satu-satunya jalan untuk membalas keputusan yang telah kalian buat,...Terima kasih...kini kalian akan melihat darah di kedua tanganmu yang tak akan pernah bisa di bersihkan dan kini aku akan hadir membangkitkan generasi yang lemah dan tak berdaya untuk melawan !!! Paray City 1 Juni 2007 !!! ----By Moontok #VM Community----" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\WINDOWS\\Film Porno.exe," eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created \??\c:\Windows\SysWOW64\CertPolEng.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\IME\IMEJP10\APPLETS\IMJPKDIC.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\ReAgentc.exe.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\sqlsrv32.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\wiaca00a.inf_amd64_neutral_163313056d8f34ab\CNHLX700.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\winipsec.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\wdmvsc.inf_amd64_neutral_a2cf745000e2ea92\dmvscres.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\RMActivate.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\setup16.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\adsnt.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\IME\IMESC5\imscui.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\rasphone.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\SyncHost.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\Dism\CompatProvider.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\prnep00d.inf_amd64_neutral_dd61103f3a2743d4\Amd64\EP0NOE12.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\migration\netiomig.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\tzutil.exe.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\msvbvm60.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\prnca00x.inf_amd64_neutral_eb0842aa932d01ee\Amd64\CNBPP3.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\wbem\wbemprox.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\atmlib.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\netplwiz.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\hpoa1ss.inf_amd64_neutral_8cae09a2238d64e0\hpotscl1.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\IME\IMEJP10\imjpuexc.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\diapi232.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\RMActivate_ssp.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\sscore.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\upnp.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\Dism\DismCore.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\Amd64\CNBJOP7F.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\NlsLexicons0018.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\prnca00a.inf_amd64_neutral_d64d696193e69d7b\Amd64\CNBBR328.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpfrsw71.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\DevicePairingWizard.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\xolehlp.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\CNB_0331.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\PushPrinterConnections.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\comsnap.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\NlsData0021.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\winrs.exe.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\prnep00c.inf_amd64_neutral_f0d9ddf52f04765c\Amd64\EP0NRE8T.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\prnep304.inf_amd64_ja-jp_27c560b15d9928c0\Amd64\EP7MDL07.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\KBDINGUJ.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\MMDevAPI.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\KBDIR.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\spp.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\ucrtbase.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\CNBP_281.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\wiaca00c.inf_amd64_neutral_27f4ad26fea72eb1\CNHL470.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\systeminfo.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\dfrgui.exe.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\RmClient.exe.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\dsdmo.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\msv1_0.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\WindowsCodecsExt.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\cmicryptinstall.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\serialui.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\olesvr32.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\SysWOW64\msidntld.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\System32\DriverStore\FileRepository\wiasa002.inf_amd64_neutral_6429a42f1243419a\SaSegFlt.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Java\jre7\bin\fxplugins.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\Office14\URLREDIR.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\GRINTL32.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\System\Ole DB\msdaurl.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_ru.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImage.jpg.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145810.JPG.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386120.JPG.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtospdif_plugin.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Windows Photo Viewer\ImagingEngine.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\System\MSMAPI\1033\MSMAPI32.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\CERTINTL.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02897J.JPG.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FSTOCK.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\Microsoft.Office.Infopath.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\MSGR3FR.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\OFFOWCI.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341554.JPG.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImage.jpg.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_05.MID.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Mozilla Firefox\mozavcodec.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Engine.resources.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384888.JPG.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\VideoLAN\VLC\plugins\demux\libadaptive_plugin.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Windows Journal\JNWDRV.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\ONPPTAddin.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSO.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\ONENOTEMANAGED.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0284916.JPG.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImage.jpg.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Windows Defender\MpAsDesc.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dts_plugin.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuvp_plugin.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SUMER_01.MID.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382952.JPG.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\DVD Maker\OmdBase.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Mozilla Firefox\vcruntime140.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Resources.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSPTLS.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\MEDCAT.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\ONLNTCOMLIB.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_cdg_plugin.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\STSUCRES.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created \??\c:\Windows\Microsoft.NET\Framework64\v3.5\fr\EdmGen.Resources.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-deskperf_31bf3856ad364e35_6.1.7600.16385_none_209ac7a9488f9245\deskperf.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-s..oundthemes-heritage_31bf3856ad364e35_6.1.7600.16385_none_5872c0830d0c4747\Windows Error.wav.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\x86_microsoft-windows-eventcreate_31bf3856ad364e35_6.1.7600.16385_none_d53926c7a0e7716d\eventcreate.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\x86_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.1.7600.16385_none_9d06e2f6f1e51f98\ctfmon.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_fundisc_31bf3856ad364e35_6.1.7600.16385_none_d7d9607f549396fc\fundisc.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-activexproxy_31bf3856ad364e35_6.1.7601.17514_none_703438df00e9e0d7\actxprxy.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaf08ebffb#\2252d66ed466508b3e8ab4d944669b9d\System.Management.Instrumentation.ni.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\assembly\GAC_MSIL\Narrator\6.1.0.0__31bf3856ad364e35\Narrator.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-ehome-ehrec_31bf3856ad364e35_6.1.7600.16385_none_a6e882bc6eb8ea53\ehrec.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\SvcIni.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\ehome\ehProxy.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\Media\Quirky\Windows Balloon.wav.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\dfsvc.ni.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-deviceproperties_31bf3856ad364e35_6.1.7600.16385_none_463f54aa539a0b62\DeviceProperties.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_bd4644e077251730\cmdl32.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework.Luna.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-00000485_31bf3856ad364e35_6.1.7600.16385_none_44fc7c6a7cc59f55\KBDYAK.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\Policy.1.0.Microsoft.Interop.Security.AzRoles.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_es_31bf3856ad364e35\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-d..-mmc-usersandgroups_31bf3856ad364e35_6.1.7601.17514_none_62031a1b9887a2a0\localsec.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\Media\Raga\Windows Battery Critical.wav.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-d..ctx-directinput-cpl_31bf3856ad364e35_6.1.7600.16385_none_ed74ea7e48da75bc\joy.cpl.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-ehome-mspbda_31bf3856ad364e35_6.1.7601.17514_none_97ddd8f55fe49f33\mspbda.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\assembly\GAC_MSIL\UIAutomationClient.resources\3.0.0.0_de_31bf3856ad364e35\UIAutomationClient.resources.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.DurableInstancing\v4.0_4.0.0.0__31bf3856ad364e35\System.Activities.DurableInstancing.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework\v2.0.50727\it\MSBuild.resources.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Diagnostics.StackTrace.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\wpfgfx_v0300.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\diagnostics\system\HomeGroup\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Controls.Ribbon\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Controls.Ribbon.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework\v3.5\1031\cscompui.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-i..ional-normalization_31bf3856ad364e35_6.1.7600.16385_none_51e1f25be7a1ebd9\normaliz.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\Media\Afternoon\Windows Exclamation.wav.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_6.1.7601.17514_none_fa8534ab236134c4\rrinstaller.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\x86_microsoft-windows-ie-pdm-configuration_31bf3856ad364e35_11.2.9600.16428_none_d6876629731ce419\PDMSetup.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Editor.Resources.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servf73e6522#\60b93ce08d30a2fba087f8630a504cb8\System.ServiceModel.Web.ni.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceMonikerSupport.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-bootconfig_31bf3856ad364e35_6.1.7600.16385_none_680b6eb133f91b1b\bootcfg.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.1.7601.17514_none_32e02520f8081891\wsmprovhost.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-00000843_31bf3856ad364e35_6.1.7600.16385_none_441dca567d53951f\KBDUZB.DLL.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\Media\Afternoon\Windows Notify.wav.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\assembly\GAC_MSIL\system.runtime.serialization.resources\3.0.0.0_ja_b77a5c561934e089\System.RunTime.Serialization.Resources.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\PresentationCore.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\NlsData0009.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-hal-events-container_31bf3856ad364e35_6.1.7600.16385_none_823a39eb761acce2\microsoft-windows-hal-events.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-ie-sysprep_31bf3856ad364e35_11.2.9600.16428_none_fde92cdecf0ab7d9\iesysprep.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\Backup\amd64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4008824c98f8edac_dnscacheugc.exe_aa32623e.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\es\ComSvcConfig.resources.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\FileTracker.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-ie-pdm-configuration_31bf3856ad364e35_11.2.9600.16428_none_32a601ad2b7a554f\msdbg2.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_6.1.7600.16385_none_5702948e8e63fc30\wecapi.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-quirky_31bf3856ad364e35_6.1.7600.16385_none_e55404efe49bb9cb\Windows Ding.wav.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\x86_microsoft-windows-osk_31bf3856ad364e35_6.1.7600.16385_none_aa93298fbb4246f2\osk.exe.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\assembly\GAC_MSIL\Microsoft.Synchronization.Data\1.0.0.0__89845dcd8080cc91\Microsoft.Synchronization.Data.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations.resources\3.5.0.0_it_31bf3856ad364e35\System.ComponentModel.DataAnnotations.Resources.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap.resources\2.0.0.0_de_b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.Resources.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\7f0531cbaadefd63fb9c1f7ae51fc668\Microsoft.CSharp.ni.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework64\v2.0.50727\DE\System.Messaging.Resources.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-ie-htmlediting_31bf3856ad364e35_11.2.9600.16428_none_2a7ffc755872f69a\mshtmled.dll.exe eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe -
Modifies Control Panel 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\s1159 = "[ Moontok.B ]" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\s2359 = "[ Moontok.B ]" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\HungAppTimeout = "900000" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\WaitToKillAppTimeout = "900000" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Mouse\DoubleClickSpeed = "900" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "Microsoft Internet Explorer provided by +++++<W32.Topinsutki.Moontok.B>+++++" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.infokomputer.com/" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.infokomputer.com/" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://www.infokomputer.com/" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.infokomputer.com/" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.infokomputer.com/" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2844 eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe -
System policy modification 1 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoUserNameInStartMenu = "1" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoShellSearchButton = "1" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoResolveSearch = "1" eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eec73d5e57d461298462bda0ae7097fc_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops startup file
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2844 -
C:\Users\Admin\Pictures\Film Porno.exe"C:\Users\Admin\Pictures\Film Porno.exe"2⤵PID:6660
-
-
C:\Users\Admin\AppData\Local\Film Sexs.exe"C:\Users\Admin\AppData\Local\Film Sexs.exe"2⤵PID:2996
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Film bokep.com"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Film bokep.com"2⤵PID:2784
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
869B
MD563652687558b43bb88e09680bb037e5b
SHA1ad3c29b64c59e8b92d29fc4ad41be0ef9cbefff2
SHA2560eb2dcb319456c4245278714a2c060578fdb0678390d427c6ebc8fa93160f1ad
SHA512009d774815fbca317da977ce3bd785ab564ddaf83358ec1d3a01c8cc880ce52614e7e2981f75866d677d1af8de2b628bc5cb5f63448a759c84c7479df62d0a4e
-
Filesize
69KB
MD5eec73d5e57d461298462bda0ae7097fc
SHA1a7796955e0475408e42c70e1839d654c5c428885
SHA256ee4e13296df83a615961a3f0b198df16dc872b758b19a2642fdc16c59ee1c0d2
SHA5123c3587482479169b512d51b6637d9ee0136a4d0e6b86c5cde9081dac9497d85e2db7d92f2725883ad4628b0ab029d960bd0ed5c9ea1fc1baaf633dbf78d5cf0c