Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 06:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe
-
Size
731KB
-
MD5
463d924f023e80c3850d2b1c8561ad2b
-
SHA1
e0a8c887b51ec16a40ece73eeb333265e36fb60a
-
SHA256
cea4e5f486fc3c2ee078e2a0d2256b97187ec772b1e291847d32e6fe8d095380
-
SHA512
a994ccbdb44389cfe769d6f2b871ddf78632713d987dbf37d725d51c4ea15de676c18eff5a0530d45a9ea4108cdf5eec9a2234ccb3723dcb0b03b73b3ec1fdd6
-
SSDEEP
12288:g8L25c+ugtP0AF9jh0zzF9zl04skRICpwPz/0wi6AoCPY1urkh//spebIl6nMfSF:gGr+hiAF9gR0aPpC/FAoCPY1urkh//sW
Score
8/10
Malware Config
Signatures
-
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe -
Disables Task Manager via registry modification
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\SVCHOST = "svchost.com" 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\slmgr.vbs 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\winrm.vbs 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File created C:\Windows\SysWOW64\svchost.com 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\svchost.com 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File created C:\Windows\SysWOW64\ClubxXx.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\license.rtf 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\Documentation.url 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\WinAmp 5 Pro Keygen Crack Update.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\The Chronicles of Riddick - Escape From Butcher Bay crack.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\The Chronicles of Riddick - Escape From Butcher Bay crack.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\RCXCCA2.tmp 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\README.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DAO\WinAmp 5 Pro Keygen Crack Update.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\installation_telemetry.json 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\The Chronicles of Riddick - Escape From Butcher Bay crack.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\RCXCD5E.tmp 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.cfg 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\The Chronicles of Riddick - Escape From Butcher Bay crack.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\Triedit\The Chronicles of Riddick - Escape From Butcher Bay crack.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\RCXCDD0.tmp 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\readme.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\Virtuosa Phoenix Edition Crack.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\RCXCCC8.tmp 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\AUTHORS.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Windown Longhorn Beta Leak.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\RCXCCB6.tmp 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\RCXCD6F.tmp 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\The Chronicles of Riddick - Escape From Butcher Bay crack.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\RCXCC91.tmp 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\VGX\The Chronicles of Riddick - Escape From Butcher Bay crack.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\RCXCDBD.tmp 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\The Chronicles of Riddick - Escape From Butcher Bay crack.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\WinAmp 5 Pro Keygen Crack Update.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WinAmp 5 Pro Keygen Crack Update.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\DVD Maker\Shared\RCXBE33.tmp 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\RCXCD84.tmp 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\RCXCD6E.tmp 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\The Chronicles of Riddick - Escape From Butcher Bay crack.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\WinAmp 5 Pro Keygen Crack Update.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\eula.rtf 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe -
Drops file in Windows directory 29 IoCs
description ioc Process File opened for modification C:\Windows\ehome\fr-FR\epgtos.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\ehome\fr-FR\playReady_eula_oem.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\ehome\it-IT\playReady_eula_oem.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\Downloaded Program Files\kazaa participation hack.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\Read Me.url 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\SoftwareDistribution\Download\RCXBF35.tmp 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\ehome\en-US\playready_eula.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\ehome\es-ES\playready_eula.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\ehome\it-IT\epgtos.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\ehome\ja-JP\playready_eula.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\Downloaded Program Files\RCXBE11.tmp 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\ehome\de-DE\epgtos.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\ehome\en-US\epgtos.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\ehome\ja-JP\epgtos.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\system\SystemNetBBS.dll 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File created C:\Windows\system\SystemRunInternet.dll 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\SoftwareDistribution\Download\kazaa participation hack.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\ehome\de-DE\playready_eula.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\ehome\es-ES\epgtos.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\ehome\fr-FR\playready_eula.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File created C:\Windows\Downloaded Program Files\kazaa participation hack.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\ehome\de-DE\playReady_eula_oem.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File created C:\Windows\system\SystemNetBBS.dll 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\ehome\es-ES\playReady_eula_oem.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\ehome\it-IT\playready_eula.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\ehome\ja-JP\playReady_eula_oem.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\system\SystemRunInternet.dll 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File created C:\Windows\SoftwareDistribution\Download\kazaa participation hack.exe 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe File opened for modification C:\Windows\ehome\en-US\playReady_eula_oem.txt 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe 2296 463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\463d924f023e80c3850d2b1c8561ad2b_JaffaCakes118.exe"1⤵
- Disables RegEdit via registry modification
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
733KB
MD587eda58fce108e934df6e0158af84ab8
SHA13e2103a7d2f68ca02a73ec9abff1b75e864d6294
SHA256a6956bd3b402b51a19636b2570f1e6a249ea8cd14d3d3a4d823d158b8b42a939
SHA5129ab0ade8e8a8aaf0dd7fe111e6a6684bef687f390fb554c32a409fa77958893237a594f26a65d3dcb58a815e0adabe5390f9ec9b4cf70d6c509aae67430c43c6
-
Filesize
4KB
MD5df336060e55b58fb1f4b8aad0ca0c3af
SHA1c150c7f5cc49b00aee54033ec8dce212db7504fd
SHA25665bf259f46db84aca25ad4925a785b454569b68d9ce1610961d65d8afcc8fc96
SHA512a10e2676b179aee95a691a68a7481038707b49679d748590930ef751951b759cbea5021e6152fd2ee701e3be8ef57b87c9b085364633cd987cc70b22d320f0e2
-
Filesize
3KB
MD550594c36d70bcd26fb461e7c3ff2699d
SHA122a1f730d4f645f24870f58784053f923f311d52
SHA256b8b383a2b53584ab01c2b536b69f52b0e816fc50f1ed723a095439016c1c1c66
SHA512ed18fa771af506e98bbc557589c6f58f2418263eaf273fd646b14ffa92d957d9286d1722e3c4378a6b46c3365b9f87bf56892752ea511c20bc1e216f3de8630c
-
Filesize
177B
MD525a174bf79e30879367088aaf4f5d7fb
SHA1b55306fe67fccfa081ac1534fadfa0af7bed6c35
SHA256d723e6215942b8375437043ce5bb642a68b1652796ec096003b0ae0963c75554
SHA51261c612fac223d7b907101b022fe4003bbef039ce41f4fa63d0f4fe5aecfc63982dbd34da27e8ed15321381360a01255e990f4bce806c85277ecd6aae27f9f5c7
-
Filesize
543B
MD5d6ead8f5496720f1f37b7a85f32b2884
SHA1f89eb47a6581e7f931083ad8f0f72516f79a1499
SHA25628070d14406359723bd0b0caa008bb6de70fcc853425be004e6d61d2c7f4581b
SHA512a742c33ee031b1edcb73417cf06918bb351e2550d2951d6fc530fd12ebebe4a4e1741bc5096e3400098b46923aeca8d12dccfbda7c6d503286440138a384df41
-
Filesize
909B
MD5163e555421aab9e0750757f7de7c70a3
SHA1f4198d764c735518fe607cd4f4815b800607c305
SHA2563da32a3e3e3f0149914933cca6a5ecd29776cda95eb43cacd167ac7b130e8f20
SHA5124532c46c417ea5fddabd9aefe30f553ae8a133630262759a3da931c7a776f7b1af4da283d9a3fc024d50e2315e6bb4394687ebe8eff903ced80d81a9f536b0b2