Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
27/11/2024, 06:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe
Resource
win7-20241010-en
windows7-x64
18 signatures
150 seconds
General
- Target a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe
- Size 672KB
- Sample241127-hbc2kaymdm
- SHA256 67901c82fcb9b1fb74cb8ec6d71dbe8180e7338d0a33d66cfed9f7cd3599d52c
- MD5 a669f3842b62ccfca8c9bd89e3601b4d
- SHA1 9a802f092480398d00d9cbf373199b57d70640ea
- SHA512 98d88373eaf6eb65ffa126c846af29279b449f6e584c21c55a35751c754d2dda52671a5570935d74ef8a70e80b3e3a0b75ce0f272291664d8cc868dfd668b553
- SSDEEP 12288:oeBNUbTVO86UqHcyB53eEYRbA1F8eKEa6Nmz7wSQ8YEst/:oJIUqHrB5ZeM1jNmz7wSwl
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Disables taskbar notifications via registry modification
- Executes dropped EXE 8 IoCs
pid Process 2240 alg.exe 1592 DiagnosticsHub.StandardCollector.Service.exe 1972 fxssvc.exe 3296 elevation_service.exe 1324 elevation_service.exe 1380 maintenanceservice.exe 4844 msdtc.exe 3436 msiexec.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3756129449-3121373848-4276368241-1000 alg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3756129449-3121373848-4276368241-1000\EnableNotifications = "0" alg.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 42 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\S: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\K: alg.exe File opened (read-only) \??\H: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\W: alg.exe File opened (read-only) \??\Y: alg.exe File opened (read-only) \??\U: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\Z: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\H: alg.exe File opened (read-only) \??\L: alg.exe File opened (read-only) \??\N: alg.exe File opened (read-only) \??\R: alg.exe File opened (read-only) \??\X: alg.exe File opened (read-only) \??\G: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\I: alg.exe File opened (read-only) \??\J: alg.exe File opened (read-only) \??\J: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\P: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\T: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\W: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\X: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\O: alg.exe File opened (read-only) \??\Z: alg.exe File opened (read-only) \??\V: alg.exe File opened (read-only) \??\R: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\Y: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\S: alg.exe File opened (read-only) \??\T: alg.exe File opened (read-only) \??\P: alg.exe File opened (read-only) \??\U: alg.exe File opened (read-only) \??\G: alg.exe File opened (read-only) \??\M: alg.exe File opened (read-only) \??\N: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\O: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\I: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\L: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\E: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\M: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\Q: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\V: a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened (read-only) \??\E: alg.exe File opened (read-only) \??\Q: alg.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\system32\dllhost.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\msiexec.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe alg.exe File opened for modification \??\c:\windows\system32\Agentservice.exe alg.exe File created \??\c:\windows\system32\pggnooaj.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created \??\c:\windows\system32\jcbbflmm.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\alg.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe alg.exe File opened for modification \??\c:\windows\system32\sensordataservice.exe alg.exe File opened for modification \??\c:\windows\system32\sgrmbroker.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created \??\c:\windows\system32\kelaeecj.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\openssh\ssh-agent.exe alg.exe File created \??\c:\windows\system32\clijojei.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created \??\c:\windows\system32\ebfmlnjg.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\lsass.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\msdtc.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created \??\c:\windows\system32\kgonlfap.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created \??\c:\windows\system32\pbhegdge.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\locator.exe alg.exe File created \??\c:\windows\system32\akhnbkjc.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created \??\c:\windows\system32\dnlfhbne.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\dllhost.exe alg.exe File opened for modification \??\c:\windows\system32\msiexec.exe alg.exe File created \??\c:\windows\system32\openssh\fdiaqjdf.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe alg.exe File opened for modification \??\c:\windows\system32\locator.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created \??\c:\windows\system32\kcfmbpcb.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created \??\c:\windows\system32\polgmopa.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\Agentservice.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\wbengine.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\svchost.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created \??\c:\windows\syswow64\dngepmdf.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created \??\c:\windows\system32\popcmnmn.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created \??\c:\windows\system32\ijpfikpa.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created \??\c:\windows\system32\perceptionsimulation\acqlmpkb.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\vds.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Windows\System32\WindowsPowerShell\v1.0\iogihflg.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\searchindexer.exe alg.exe File opened for modification \??\c:\windows\system32\snmptrap.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\openssh\ssh-agent.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\tieringengineservice.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\searchindexer.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\fxssvc.exe alg.exe File opened for modification \??\c:\windows\system32\sgrmbroker.exe alg.exe File opened for modification \??\c:\windows\system32\vds.exe alg.exe File opened for modification \??\c:\windows\system32\Appvclient.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\svchost.exe alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification \??\c:\windows\system32\spectrum.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created \??\c:\windows\system32\dmnmoipc.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\fxssvc.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\Appvclient.exe alg.exe File opened for modification \??\c:\windows\system32\lsass.exe alg.exe File opened for modification \??\c:\windows\system32\spectrum.exe alg.exe File opened for modification \??\c:\windows\system32\sensordataservice.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created \??\c:\windows\system32\diagsvcs\eemembjo.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\tieringengineservice.exe alg.exe File opened for modification \??\c:\windows\system32\vssvc.exe alg.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\elevation_service.exe alg.exe File created C:\Program Files\Google\Chrome\Application\elidehmc.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\imamgieo.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\gonmdlab.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\mgecidfd.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\dotnet\ddnfppgh.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\olemadei.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\nopnnfcn.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\papfoeie.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\idklmhke.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe alg.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clmaedbq.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\7-Zip\jgpijieg.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7zG.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\ldcnmoao.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\ibkjjmkl.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\cgmodhlq.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\gleiimcg.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\pijgofaf.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File created C:\Program Files\Java\jdk-1.8\bin\cobmhpje.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\lgamkbac.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\plqcccib.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\ink\hhfjjgab.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\miqfjfol.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\jkgaipki.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\ckfdqqhh.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe File created C:\Program Files\Java\jdk-1.8\bin\kldonlpi.tmp a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe alg.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe - Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe 2240 alg.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3076 a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe Token: SeAuditPrivilege 1972 fxssvc.exe Token: SeTakeOwnershipPrivilege 2240 alg.exe Token: SeSecurityPrivilege 3436 msiexec.exe - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer alg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" alg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a669f3842b62ccfca8c9bd89e3601b4d_JaffaCakes118.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3076
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2240
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:1592
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4360
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1972
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3296
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1324
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1380
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4844
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
- Size 1.9MB
- SHA256 6e8703151d735446c5527d30f792e35a794cb06175205f1bcee35271d612a789
- MD5 caaedfd43bc28344e48fd9c2a5626d47
- SHA1 6fbf7ba9cf02adcfdf3e05200d6678f505d437c6
- SHA512 4f7726969e9c8f0139e31737ed2f484c1244d4cd9ad504b39b59755bc37289b09a5cd673f587c8b9a308b72cee2f4db58cabddb24a6391ddfb68afd3b30a7d07
- SSDEEP 49152:PuYk3H5koU8fTqkkYLO/W2buywzMbOX+T7z5fn+xBHwkYbIHY:PEfTqi90b0FH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 621KB
- SHA256 6af4410d87541072af42b6c2f9c45300654d8287254bd45f292cb4bce0f91cee
- MD5 69bd91912b1110399af65ebbc4e4ba1c
- SHA1 35e749f3f6ea4d76f063010b6fab396f22be5b77
- SHA512 8f71131764affbef76abf2b281ee5186ded64ab184bb4c9c97259a8d6de9f5708fbbfa9be66a770f429a5fd71c784b41b3731899f2998698b1108484a5f9b137
- SSDEEP 12288:xsixPwEsHuXzh1mfVbx3RiY5WqfuzqYv6GRj6QH3K:xZFwVuDhytx34Y5WqmzDjVX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 940KB
- SHA256 f324bd937b930a129d3e37eb28370b7bce55655cd84b10b090bc7f4dd8ef1d87
- MD5 c0419d3d55fa0e40be2f6ef228e50c0e
- SHA1 373db478c078045a8b49ff3b8bccd99fb3205f32
- SHA512 ec250f8dd9afa569e951f15a0da2b11e7fcef066476da79a9aece918de3af59657b997974cd0070cafe0fde2f2809079390843dfcd7a642538dae4821cc6c97b
- SSDEEP 12288:n7a3iwbihym2g7XO3LWUOfh4CoIKEyLGRusZaXuxyElSbjkkcc/aIa29XbU:e+gkEcfh4Co5EECuaSuxyEAHdn/e21b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.3MB
- SHA256 551bb9a9ea4ad94df0915fea80873c95b8348262c985d964d6644855647292d8
- MD5 89a7b5d80b4ac8202cf369757a5d5567
- SHA1 0fb74702642e8e8a383032841eb601155fb6a878
- SHA512 750e8cca9f5b3cce514b4c3089233a77edf626ebbb635656e79539f44c41e17f5317e8d00b5b4e7f87363830bd9d9b8c8fb5196be2fda2b6890db9c276a81d8d
- SSDEEP 24576:tBpDRmi78gkPXlyo0Gyjr7a1WpepDugQi3xA7l:HNRmi78gkPX4o0GyjX4WEQOul
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.1MB
- SHA256 9bfa090f6d67f1204c9355647806ef658c2f6f3c68055d781ed78fee1b77b6d1
- MD5 0e2b7efbd224b3333ed8d88326f71a4a
- SHA1 bde75e074f87560cf29a2f161b78039232ca4e20
- SHA512 3d49bdb3f2171a158138ae014e247083e23bb4b1ef12268469b661aefe9516a22fda63e3b084b4fa2ebfccf5abfa551c2001ff772c35e7e2093927294b9453d7
- SSDEEP 12288:BfC6Aj+TN5uixZN+8rKhUdTC/wE18D0Ca5ZIXVqD0hzvxMv3LgOGB6/FVf6X4S:BLOS2oqPIXVqQI3LjG8dVf6X4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 410KB
- SHA256 51f487866719c5d73800a8877b8f9f84e8313a8afdf3d336ecfa10d2598988ff
- MD5 74e2d26a9eeaa20f5d4ca9fc976af771
- SHA1 edd5a96977c348f1429c067f8801cd87768fb8ef
- SHA512 8158703c262fd729c488a309321c8782f2a67d6a6e0d9fe38db1a1d3ae5ceb1567a295f18e3b9eb56d8578e88fea084b331ef77bc573095d8d3cb3519a6517d5
- SSDEEP 6144:Uaq9XlVLvea70wFN5ffkLaQndSrO+SIlp7/WNX7x2EwcY8UiIeYUbQYVHUz:Uv91Vx704kLaO0qIlp7+x9xhIS2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 672KB
- SHA256 0b33e2536581c7ef3dc89952c0489a5aefbc3a575695217126ba49b5e75cc2d4
- MD5 19dfcc628bb09aebff8bae9471de638f
- SHA1 dbd9588e94c750204c8a675cb6f73235713c047b
- SHA512 918e548be1f03a3b0e0e00ed95484808312a18d140521433455f3317e93d5a04272100bc596764677f7fb30a8a544199d57d3f116d2da221c4a2fb92df4ecfaf
- SSDEEP 12288:geBNUbTVO86UTNvm6az95vDZx1C4I2zodsF5XUEAtyT5pqFg6NdZ:gJIUTNOBHL5C4I2zouf/QFgA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.5MB
- SHA256 150ffc2f7215401df2fc576afaa4c93e470362f96611678271c18955811941eb
- MD5 67a7627be94361429e56db26d063b7ac
- SHA1 40f9b4113dc13a2918860b4a2c9e6ac8cc5d470a
- SHA512 06cb597ea83d248f122c261e431e81becc4ace42690fe9aab7ff4c3d4351c33686f0c58c11829fd22f705be4ffd6017d2b8d9a0b512e68879e827313f408b196
- SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THs:EQvGAdlCEL8c/yRNw5Cx0i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 738KB
- SHA256 41672a3f98b268ec0f0bc55f86d138fa468957589ffd692104039854824483c1
- MD5 6b3f99df10731e7e8119ddec050d03a9
- SHA1 a0cd35c7db74bdb80e6f42586382dc84251019dc
- SHA512 3b93e0e09368a2cce750d310d61b090d177c9653d87810490405604eb280671957c48676a0d1449d629c5d09bb8e9523047ec101dc4b6f6cf3bf9766de4842db
- SSDEEP 12288:eAwSfxL/2Dc3iDLLmt0LDQewsHjL9NhH/L37q7NV3/4W8049fa7Nq+GHgV:DjewsHjL9NhHnaV3/4f0Ea7mgV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 23.8MB
- SHA256 19c8e2c69d5678988b434bc310624f2be67d53469b8385da0186758633ca3cf5
- MD5 05749e0727f7884a9226b6769da3ef8b
- SHA1 ae8c2887eb3e827fe8c06e0d7adc9ae7d59fdaa4
- SHA512 049946667ed926420d2e4781f2d28fdfed426ded760a1a006107463a5515cd03e2928ae080f182156494572ca4cd973fc529921a57f1382b3a1c11a5388b5564
- SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyrIldPlbuJHd2s:HUEtQevvqc2W1cpV2rI32d2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.5MB
- SHA256 1818f91c6748891c51ce13d5ff407963532fe5d243d502820316b0e9ead4d3bc
- MD5 d34c6fb083f94f88cab52a48923bd9e0
- SHA1 d54212077b44947c7f3695348a5823c878405669
- SHA512 1314ed62e1b54e1e654b8beb7c1b0f6c5f11e8f459021d0509b42216f1c2c7933cfa5c8221e38f6a98553b4e3dfd6f2de772ed1801a141f0ec593f3e83a8c5c4
- SSDEEP 49152:XCbRquA/m2yL5zZfFiV+XenmE3/z3eAG:AoqEVjnmUeA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\boadfmod.tmp
- Size 637KB
- SHA256 e696ba1f57401eea208541f6165af587dfffe28be8d7e3385cfbc6b043317e1f
- MD5 ae316f8dff7fbfbfef76c9dbb349729f
- SHA1 b6f09797233bb1fb0053498188676d66c59e4904
- SHA512 982593279aff51e6d23d9b0e8a0773194fa4cc56bf8e68b829e19380a040f02ec01609a6bfde4b46e7aa2d69bbe00a75258978846e88269d723f5effd8d3c40d
- SSDEEP 12288:/mw5HEjsChNoBFgl0WDm+CaIs/sLlG099Ze5Tuwgp:+wu5OWnds/97
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
- Size 2.0MB
- SHA256 8ee4bae1872843884d7c31ec5164689ce1c8094246660e3df42142261b0c82eb
- MD5 3e95a871ed117b72a06b692bc5747467
- SHA1 2440877a4364c5c1f9213d9fb1bdeeb4c53aea0e
- SHA512 89d78d77aa3b7f3839d82f7cedd83062d346cd60bf435a6281186c569bea659653dab42340ecc9667d32000d429cfe90f9607451f2eab8a4f3eb025f730d77a9
- SSDEEP 49152:u59PYHvI7wi/RIKuLFrFXlMWGxbgpYCN:uGgRIKgMaYU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\lanmocjd\ncibckpn.tmp
- Size 678KB
- SHA256 3a312f8e4ac1a9d110af91dc968021d21455f361ca70b5fe6a50e9aefcd09328
- MD5 a18679ac7596eece8496e2a9c01d5072
- SHA1 4c3e6801f7893ae924c113fe9f0665ea0979f1f4
- SHA512 3e9e9e22216f3276bb5d57df3f8eeef1b39117a6d5fdec0f00e48122dbeb3d8931250bf6dd27ccb4f3624a3391f0fc16c297aa2accd4d318b514d9e2dfb92a0b
- SSDEEP 12288:S1BhOWvSqY4zvmjOwJITDjVRcVajC6nU:0PO0hmOhTVRVG6n
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 487KB
- SHA256 0fc9068411ec5b93a020e8d52bcaed4a7e172967a0135f093971f11b16498575
- MD5 3f652686a91e2479e2f08ca883a07b0e
- SHA1 8bb19b9c36c78bdbcb8051644cac6a8d87d4b8fa
- SHA512 4c5b26dfd87cbe3ef54bd17c87caa831440e26ac389646e4d5a75a2cd7576761f44aac0834723484e8b10a9d0e7a0099eb5215e37316f2952cfd56597c19af68
- SSDEEP 12288:PhbHjfXGmfs60yKvJFpV55othGiww1c8yY:PhbHjPGXyKv5yjGij1c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.0MB
- SHA256 2fe3b96b81eacd9870273a13d00a8a9a6b809fa6afafb8a75dd43d04a40d44a0
- MD5 477ec6a03d6a75b24c53a1af47351c39
- SHA1 457d9bc5c99b884484c2d014d385eca068a9a05d
- SHA512 130ec3a9f7fffd3db4341c72f3155bd7f2e5b14afdb2b076d98f6b9fed77286e464df7955bf13806198f708e613d7a19a8ea8157614463913846e3e789b4e824
- SSDEEP 24576:+3YgnJcRTk4yti+R5dRR/hBclBeXoQUcYw:+IgnaTk46pRR/hBcFkY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\alg.exe
- Size 489KB
- SHA256 2ff74c6198f2f46eea518fe88669a224a21601f89afe2789c39eb28f13bddb81
- MD5 54e80d671d67fe0304d90b71bacc9a57
- SHA1 3b35e2153300301169f7e868356b55039a3a9bd8
- SHA512 88ee84535f45af2213eb484f779534facf89af7007fa7876430451da1dd6e3c01eb91530d59d265b442696bcba0ecc555a1d51ab35f1ae1d65438f429483baeb
- SSDEEP 12288:lEP3RYVLKHoXhPPrt5QA8ViB9XqX7HSn/j:mYVOoRPrsiB9qXTq/j
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\msdtc.exe
- Size 540KB
- SHA256 2828b5166e4465f23c54d1cf32f54af915b7f7ad0b8d0521cc9fae533153a7c5
- MD5 093cab04bc06fb2c407980fbf9739ac4
- SHA1 b345cb9d064d5d21c172c85c01b248fdbf9e4768
- SHA512 91153745bc93865aa79eee7f283bc879da1d382ed75fa169a9b46f65cc7e699ddd43e48a004e7fe1abd693320ecac5da53438a0786ca93327931671d6d329b0b
- SSDEEP 12288:Kjky0t/IJMO+DnrrNqpYyK1yDCniiB9XqX7HSn/j:KIyt2DrAWaiB9qXTq/j
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\msiexec.exe
- Size 463KB
- SHA256 e7491d7d5dfafcab67adb4341c18dcb81deb234131071bde4220b7260a44e747
- MD5 3f298b5bcc3b4236a251454968a746db
- SHA1 4fe368a497bf5a3ec6b7e3e8af6ba620c392e030
- SHA512 6078c5821fee663ba7c6d4ed54d2697957a9b813865f6e113180f9f9b829e89af75992f222b3aca53e0bb529fd3735ff52a722a16c568ec503e85687259618e1
- SSDEEP 12288:m4pO/E7e0nUnRVrAVDxrdtVPzSpAxVNPuEkCnJL4n:3EEK0nUnnMVNrjV2pAxVN3
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system32\Appvclient.exe
- Size 1.1MB
- SHA256 faa8f7c672648bc99e4af79624e82c5089559d5185d193f9f911de779183faf1
- MD5 0b3f2cb42967c2b80ac11eb137fb9040
- SHA1 28077a74327b4c7b9f4ce15e5431cab71cf0ba17
- SHA512 acb2633d57826ae316a940d96d5ba76488ea5eb3fa9affea7c59845e004c8543317940b255e20794d6d0f08f7a18dc8087b2afa4244be791ccc6d622506bff79
- SSDEEP 24576:k1QT7EcpfxR+N5AWAz3ooiY1jMqbvlF39y8V2qDA:ZTDxR+N5YzTDjMG39JA
- MD5 SHA1 SHA512 SSDEEP