Overview
overview
10Static
static
3a71c301f4f...18.exe
windows7-x64
8a71c301f4f...18.exe
windows10-2004-x64
8ADVPACK.dll
windows7-x64
3ADVPACK.dll
windows10-2004-x64
3W95INF16.dll
windows7-x64
1W95INF16.dll
windows10-2004-x64
1W95INF32.dll
windows7-x64
3W95INF32.dll
windows10-2004-x64
3fngrprnt.dll
windows7-x64
3fngrprnt.dll
windows10-2004-x64
3msnphoto.scr
windows7-x64
3msnphoto.scr
windows10-2004-x64
3msvcr71.dll
windows7-x64
3msvcr71.dll
windows10-2004-x64
3pibase.dll
windows7-x64
3pibase.dll
windows10-2004-x64
3pidav.dll
windows7-x64
3pidav.dll
windows10-2004-x64
3piorg.dll
windows7-x64
3piorg.dll
windows10-2004-x64
3piorgres.dll
windows7-x64
1piorgres.dll
windows10-2004-x64
1pisync.dll
windows7-x64
3pisync.dll
windows10-2004-x64
3pisynctw.exe
windows7-x64
3pisynctw.exe
windows10-2004-x64
3piview.dll
windows7-x64
3piview.dll
windows10-2004-x64
3slides~1.js
windows7-x64
10slides~1.js
windows10-2004-x64
10startup.js
windows7-x64
3startup.js
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2024 09:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
ADVPACK.dll
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
ADVPACK.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
W95INF16.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
W95INF16.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
W95INF32.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
W95INF32.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
fngrprnt.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
fngrprnt.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
msnphoto.scr
Resource
win7-20240729-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
msnphoto.scr
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
msvcr71.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
msvcr71.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
pibase.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
pibase.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
pidav.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
pidav.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
piorg.dll
Resource
win7-20241023-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
piorg.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
piorgres.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
piorgres.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
pisync.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
pisync.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
pisynctw.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
pisynctw.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
piview.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
piview.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
slides~1.js
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
slides~1.js
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
startup.js
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
startup.js
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
-
Size
2.6MB
-
MD5
a71c301f4f5faf1fb2dd44a7c38dcf7b
-
SHA1
3fcbee9772ca415dcee61395c92fec7eab962480
-
SHA256
3850a3586deb09cfba2a7a7837c4d9d1af712cc3bf5fd78dfdc411fb788a86eb
-
SHA512
d54b1793e8620cae7c75b930848e2dbe441ef8a0410612387beb4f56dcf757900b6a995cf003172ab2e4d43d0003e1920358ab4911b5125b5ac6e530e1927bac
-
SSDEEP
24576:VVYbWzOnA80yE23Z5EU2elH1QnxBuabsM8KGH7Co0OLeGrIocE5lArjPPz:EWzOkyrZOU2elcu08KGbNLeGMb4unz
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 10 IoCs
Processes:
a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exedescription ioc Process File created C:\Windows\SysWOW64\drivers\es-ES\SystemNdisImPlatform.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\SystemSystem.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\SystemSystem.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\SystemOperating.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\SystemOperating.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\afunixWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\afunixWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\SystemNdisImPlatform.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\OperatingSystem10.0.19041.1.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\OperatingSystem10.0.19041.1.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mIRCmirc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe" a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\mIRCmirc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe" a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 64 IoCs
Processes:
a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exedescription ioc Process File created C:\Windows\SysWOW64\Dism\es-ES\SetupPlatformProvideroperativo.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\de-DE\WindowsEapSimExtDesktop.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Com\de-DE\WindowsMIGREGDB.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sv-SE\OperatingWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\es\WindowsAppV.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\iai2c.inf_amd64_a77c815b2999404d\iai2ciai2c.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\WindowsErrorReportingMicrosoft.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\uk-UA\dtshdot3ui.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\InputMethod\JPN\WindowsSystem.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidspi_km.inf_amd64_7e53b3972dc4df20\hidspiWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\de-DE\winmgmtSystem10.0.19041.1.160101.0800.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\de\resourcesWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\es-ES\InternetF12Script11.00.19041.1.160101.0800.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\oobe\OperatingSetupCleanupTask.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\operativoFontExt.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wbem\es\WindowsAppV.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hdaudio.inf_amd64_fe5b23ea7991a359\Operatinghdaudio.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\NDISMiniport.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\lv-LV\QuickAssistWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\en-US\vdswmiwbemcntl.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\ja-JP\WindowsMIGREGDB.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\res\Microsoftpadrs41210.0.19041.1.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\InputMethod\JPN\WindowsSystem.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\it\AppvClientComConsumerMicrosoft.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\GigabitEthernet.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MUI\040C\mscoreesMicrosoft.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Common\ja-JP\sapisapi5.3.24006.00.160101.0800.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\MUI\040C\mscoreesMicrosoft.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\fr-FR\SystmeWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wbem\RCX9E7B.tmp a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\uk-UA\mircmirc.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wbem\it-IT\Windowswmiutils.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\lsi_sas3i.inf_amd64_79c7a4d8be0a9744\LSISAS3iWindows27575.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\OperatingSystem.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\hu-HU\mircmirc.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Dism\fr-FR\mircmirc.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\msux64w10.inf_amd64_5aa81644af5957b3\msux64w10Adapter.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_ede00b448bfe8099\AdapterIntelR.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\acpitime.inf_amd64_e1498a974ab95ea7\Operatingacpitime.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\XPSViewer\es-ES\XPSViewerMicrosoft.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bg-BG\QuickAssistOperating5.82.160101.0800.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wbem\Systemfastprox.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Common\fr-FR\Systmesapi.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\en\resourcesOperating.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\buttonconverter.inf_amd64_73b807c3bed63b18\Microsoftbtnconv.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\de\resourcesWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wvpci.inf_amd64_86afbe8940682d27\vpciOperating.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\fr-FR\InternetInternet.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\CSRSrvappmgr.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\RTL85n64Adapters32016.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\migration\it-IT\WindowsSystem.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\XPSViewer\it-IT\FrameworkXPSViewer.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\de\resourcesAppVClientPowerShell.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111\e1i65x64Gigabit.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Common\sapiMicrosoft.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\migration\ja-JP\shmigMicrosoft.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\de-DE\CSRSrvdevicecenter.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\ja\MicrosoftWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ko-KR\SystemOperating10.0.19041.1.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\xml\Systemwmi2xml.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\fr\Windowsresources.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\lsi_sas.inf_amd64_74bb5e3e01cfd526\FusionMPTDriver.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\Microsoftsrloc8.0.19041.746.160101.0800.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\MLNXENmlx4eth63.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exedescription ioc Process File created C:\Program Files (x86)\Common Files\System\de-DE\WindowsMicrosoft10.0.19041.1.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\TabTip32Sistema.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\WindowsTableTextService.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\Systemsqlxmlx.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\it-IT\WindowsSistema10.0.19041.1.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\MicrosoftWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\PlatformJava.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\DataBuild.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\fr-FR\dexploitationSystme.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\de-DE\msadcorWindows10.0.19041.1.160101.0800.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AdobeAiod19.8.20071.303822.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\UpdateGoogle.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\AdobeHunspellPluginAdobeHunspellPlugin.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AdobeAiod19.8.20071.303822.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\Entityresources.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshareSystem.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\msadc\it-IT\msadcormsaddsr10.0.19041.1.160101.0800.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoViewerPhotoViewer10.0.19041.1.160101.0800.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\Studiovstoee.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\Systemoledb32r.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\EngineFramework.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\fr-FR\msader15Windows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\VisualVisual.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\Install\{F123CA10-B28F-434D-9884-6C3679B73C43}\miniinstallerInstaller.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasksresources.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\de-DE\Microsoftmsader15.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\ja-JP\WindowsWMPNSSCI.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javajavaws6.34.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Updatemsedgeupdate.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\UpdateGoogle.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\MicrosoftWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\EdgeMicrosoft.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\WindowsTipRes10.0.19041.1.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VC\VisualMSDIA90.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msadcerWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\fr-FR\msader15Windows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\fr-FR\dexploitationSystme.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\InternationalWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\fr-FR\ieinstalieinstal.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\it-IT\MicrosoftSistema.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ja-JP\WindowsMicrosoft.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Defender\fr-FR\Windowsdexploitation.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\es-ES\operativoWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Defender\it-IT\operativompasdesc.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\PowerShellresources.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\VisualStudioOffice9.0.30729.7079.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\Systemmsdasqlr.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\setupwmsetupwm.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Photo Viewer\OperatingSystem.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\MicrosoftDAO360.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\msdaorarSystem10.0.19041.1.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\Systemmsdasqlr.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\DataBuild.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\pdf417pmpdatamatrixpmp.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\ContentModule.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationBuildTasksPrinting.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ja-JP\Internetiexplore11.00.19041.1.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\PowerShellPackageManagement.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMAcrobat.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\Entityresources.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\VisualMSDIA90.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\ja-JP\WindowsOperating.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\it-IT\MicrosoftSistema.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\uk-UA\WindowsWAB32res.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exedescription ioc Process File created C:\Windows\WinSxS\amd64_dual_netax88179_178a.inf_31bf3856ad364e35_10.0.19041.1_none_31a7988a6e7d04d6\ASIXGigabit1.16.27.321.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling.resources_31bf3856ad364e35_10.0.19041.1_it-it_484363d862c381ab\operativoDPISCALING.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ISECommon.Resources\v4.0_3.0.0.0_fr_31bf3856ad364e35\dexploitationresources10.0.19041.1.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ngservice.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_96c215ac01d6a482\WindowsWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ationservice-netapi_31bf3856ad364e35_10.0.19041.1_none_2b6c643e548ec657\WindowsSystem.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cryptdlg-dll.resources_31bf3856ad364e35_10.0.19041.1_en-us_fb3b3dd8a19c2a90\WindowsCRYPTDLG10.0.19041.1.160101.0800.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\PresentationCore.Resources\3.0.0.0_es_31bf3856ad364e35\Microsoftresources.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..yn-router.resources_31bf3856ad364e35_10.0.19041.1_it-it_95f4a0fe64d3c160\operativoSistema.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_fundisc.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_36ab53fd4f0fac3c\Microsoftdexploitation.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_microsoft.transacti..ridge.dtc.resources_b03f5f7f11d50a3a_10.0.19041.1_ja-jp_d4ea5ab3d9ebf8dc\MicrosoftRbridge.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..t-lookup-powershell_31bf3856ad364e35_10.0.19041.1_none_2b90387e98ff6682\MicrosoftSystem.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt-shortcut_31bf3856ad364e35_10.0.19041.1_none_efaf63248e6d4479\PromptCommand.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..gine-main.resources_31bf3856ad364e35_10.0.19041.1_de-de_d7075eebda7299a0\MicrosoftWindows10.0.19041.1.160101.0800.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..vider-dll.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4a98c6b57998478a\OperatingSystem.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-application..cts-winrt.resources_31bf3856ad364e35_10.0.19041.1_es-es_72e1073832a3e555\SistemaAppContracts.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_ja_31bf3856ad364e35\resourcesPowerShell.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-ieadvpack.resources_31bf3856ad364e35_11.0.19041.1_it-it_542f87beeb5bb3d1\InternetADVPACK.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c6a0b88ad524d1c0\ldifdeldifde.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemCore\v4.0_4.0.0.0__b77a5c561934e089\FrameworkPresentationFrameworkSystemCore.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-setup.resources_31bf3856ad364e35_11.0.19041.1_de-de_3600c224335f0c2a\Internetinseng.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_10.0.19041.1_de-de_2589afbe61546a4d\advapi32Microsoft.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..localsessionmanager_31bf3856ad364e35_10.0.19041.1_none_5b35da44a9e83608\SystemMicrosoft.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..minkernel.resources_31bf3856ad364e35_10.0.19041.1_en-us_1f7e552c79c688a7\WindowsPRFLBMSG10.0.19041.1.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-keyenum_31bf3856ad364e35_10.0.19041.1_none_a5a9b2ae0002c1cf\SystemWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.tpm.commands.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c1be5b511e7525cd\resourcesdexploitation.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-media-mp3acm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_83aad7fe2344f21b\CodecLayer3.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_system.serviceprocess.resources_b03f5f7f11d50a3a_10.0.19041.1_fr-fr_263bf10b2a0b7bb9\resourcesSystem.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nlasvc.resources_31bf3856ad364e35_10.0.19041.1_de-de_7c747e98039a4732\Windowsnlasvc.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..trolpanel.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_d0560aa6c0f64b1e\MicrosoftSHAREMEDIACPL.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_rhproxy.inf_31bf3856ad364e35_10.0.19041.1_none_bf23bc1290f4573d\Windowsrhproxy.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\Boot\EFI\hr-HR\bootmgrbootmgr.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\WindowsOperating.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wof-tasks.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c5e9b82f6683d8ac\dexploitationdexploitation.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rdbss.resources_31bf3856ad364e35_10.0.19041.1_de-de_31f7421117e87f45\WindowsMicrosoft.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.1_none_3ba8bf202ebf3481\imesearchpsMicrosoft.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.19041.1_none_7ab192ed7079aec0\MicrosoftWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-tasks_31bf3856ad364e35_10.0.19041.1288_none_c098111d522e08c1\MicrosoftWindows10.0.19041.1288.160101.0800.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..l-library.resources_31bf3856ad364e35_10.0.19041.1_es-es_41fee2bbdeb0ad8e\WinBioDataModelMicrosoft10.0.19041.1.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.WSMan.Run#\927a00c8d6c2756ed97e610e209e12ab\WindowsMicrosoft.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gpuenergydriver_31bf3856ad364e35_10.0.19041.1_none_046a9b5a2d69211d\SystemOperating.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_microsoft.virtualiz..vmbrowser.resources_31bf3856ad364e35_10.0.19041.1_es-es_1288a7adb07378d6\resourcesresources.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap.Resources\2.0.0.0_it_b03f5f7f11d50a3a\resourcesFramework.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..emedia-controlpanel_31bf3856ad364e35_10.0.19041.1266_none_2479a17e4ac5a184\OperatingSHAREMEDIACPL10.0.19041.1266.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell32_31bf3856ad364e35_10.0.19041.1_none_2c6ee2b3e5ba3635\MicrosoftSystem.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint.resources_31bf3856ad364e35_10.0.19041.1_it-it_ff02864ffd7a91b5\Microsoftoperativo10.0.19041.1.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..shell-exe.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_9938ec5a8757db86\Windowsdexploitation.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.19041.1_es-es_ed469269904a497b\contextoControlador.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..orkaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_bd9990a0c98c5e01\WindowsOperating.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\SystemMicrosoft4.8.4084.0.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_2ccf0dd80bf99416\MicrosoftSystme10.0.19041.1.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tasklist.resources_31bf3856ad364e35_10.0.19041.1_it-it_0328c4db9d46a804\SistemaWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.19041.1_ar-sa_4548affc94f716b4\WindowsSystem.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..forcedcodeintegrity_31bf3856ad364e35_10.0.19041.1_none_b02dae7988700938\VbsApiMicrosoft.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_windowsformsintegration.resources_31bf3856ad364e35_10.0.19041.1_es-es_d7faa34514f991bb\Microsoftresources.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-datastore.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_b58eab27322e4377\WindowsVmDataStore.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ldap-client_31bf3856ad364e35_10.0.19041.1_none_b381ff6d2a29fc51\WindowsWLDAP32.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-clip_31bf3856ad364e35_10.0.19041.1_none_682199f2efbfb806\clipWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-library_31bf3856ad364e35_10.0.19041.153_none_1938164b9765a005\Windowscontainer.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..gssystems.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_3bfbc85ba6735f51\CSRROFLCNZ.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_regasm_b03f5f7f11d50a3a_4.0.15805.0_none_9be7d950c1f8addd\MicrosoftFramework.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_microsoft.windows.s...commands.resources_31bf3856ad364e35_10.0.19041.1_en-us_846fbf84d2e12e39\resourcesSystem.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\PolicyPolicy.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-application..-appcontracts-winrt_31bf3856ad364e35_10.0.19041.264_none_69003b4adc98d976\ServerWindows.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero2\v4.0_4.0.0.0__31bf3856ad364e35\Aero2PresentationFramework.exe a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exepid Process 1812 a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe 1812 a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe 1812 a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe 1812 a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe 1812 a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe 1812 a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a71c301f4f5faf1fb2dd44a7c38dcf7b_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5a71c301f4f5faf1fb2dd44a7c38dcf7b
SHA13fcbee9772ca415dcee61395c92fec7eab962480
SHA2563850a3586deb09cfba2a7a7837c4d9d1af712cc3bf5fd78dfdc411fb788a86eb
SHA512d54b1793e8620cae7c75b930848e2dbe441ef8a0410612387beb4f56dcf757900b6a995cf003172ab2e4d43d0003e1920358ab4911b5125b5ac6e530e1927bac
-
Filesize
2.6MB
MD5186551e54bc9b3359adef431a35d54d9
SHA18e5d83a7a39a48a33f96913f126173476b28c09f
SHA256c992b635f2bd67496745c97fb1b8824bef6cc674f62d8b3410c1cc6dfa520926
SHA5127e758d8442ced4d6212e16549ae2e3548037a72b6a1925711c0a66879286e0536450fa52cbb38ad70dd6eced28876931bf8d2a478d755cc29d7773e72ab8a4c3