Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/11/2024, 05:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe
-
Size
3.0MB
-
MD5
b4eacfeba13503c98b7b3ad5f9801380
-
SHA1
bd6c3b198b76a2e741ef3e83092a8718ef60f9fe
-
SHA256
85a04fae9bc11b0ed310559e04c3c26b704dd30c955084ca7a93756a31622693
-
SHA512
b9a457984307b6ada85cb4ed6ca2f0eba3c0a8684f245e616443f2ab0efe5dedfd2456b32c37135db4cbd793c61613ab559df5311ff64ce01e52c0a579396b32
-
SSDEEP
49152:eu5HOTeWWqs8LIWfX5DZDmNQCfzlEp6RljIEp6PbtL2tL:dHxWvsgzhNDmopopIV2V
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\SetIEInstalledDate.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\auditpol.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dpnsvr.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\recover.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sethc.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rasphone.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\subst.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\systray.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MRINFO.EXE b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\proquota.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RegisterIEPKEYs.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\verifier.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setup.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\help.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\iscsicli.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesRemote.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\TsWpfWrp.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gpresult.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\label.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sdchange.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wevtutil.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wbem\mofcomp.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dccw.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\esentutl.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\PATHPING.EXE b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RunLegacyCPLElevated.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\TCPSVCS.EXE b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\diskraid.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\finger.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fontview.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\isoburn.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP10\IMJPUEX.EXE b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\autochk.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\chkntfs.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cipher.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\write.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msdt.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\PresentationHost.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\resmon.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\cleanmgr.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\dplaysvr.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sbunattend.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ddodiag.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\tzutil.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\unregmp2.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\eventcreate.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\raserver.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ReAgentc.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RpcPing.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RMActivate_isv.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WPDShextAutoplay.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\sxstrace.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\AdapterTroubleshooter.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\psr.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp_isv.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gpupdate.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SyncHost.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\minidump-analyzer.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files\Java\jre7\bin\ssvagent.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Media Player\WMPSideShowGadget.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files\7-Zip\Uninstall.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_8.0.7601.17514_none_a0c922c3b170dd5d\RegisterIEPKEYs.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_6.1.7601.17514_none_301a46c726a4cdc6\repair-bde.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..xing-service-server_31bf3856ad364e35_6.1.7601.17514_none_0db5e5844ed6ffe9\CIDAEMON.EXE b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_6.1.7600.16385_none_052696aea98bcefc\TRACERT.EXE b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-regini_31bf3856ad364e35_6.1.7600.16385_none_684b2e15d381ea25\regini.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\dfsvc.ni.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-extrac32_31bf3856ad364e35_6.1.7600.16385_none_371e8c461d966a55\extrac32.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.2.9600.16428_none_46d2efef53c02386\iexpress.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_6.1.7601.17514_none_12d42225a9a7aef7\rpcinfo.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_6.1.7600.16385_none_244ae8599e6d81bb_hh.exe_f87e0044 b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\MSBuild\1a154709cdfe214029ea88c51ab2b579\MSBuild.ni.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_6.1.7600.16385_none_1ddb4b87a6618437\chkdsk.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_6.1.7600.16385_none_a018e05d0d33081d\dllhst3g.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_6.1.7601.17514_none_38a043f2b45f9ad2\msconfig.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7600.16385_none_cd7aeeff1897d018_lodctr.exe_b02cefba b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\ehome\McrMgr.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_caspol_b03f5f7f11d50a3a_6.1.7601.17514_none_f885d1129806720d\CasPol.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_8.0.7601.17514_none_752e3bb068638683\msfeedssync.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..up-drivepreparation_31bf3856ad364e35_6.1.7601.17514_none_ff178cca7f9d03eb\BdeHdCfg.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\ehome\ehvid.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-driverquery_31bf3856ad364e35_6.1.7600.16385_none_f217bd1caebaa683\driverquery.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-getmac_31bf3856ad364e35_6.1.7600.16385_none_67f38861bbac1910\getmac.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-security-secedit_31bf3856ad364e35_6.1.7600.16385_none_0adc1fc1cb6f944b\SecEdit.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\SMSvcHost\e88db1688b08fbb889b0b9d4b1a51493\SMSvcHost.ni.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MSASCui.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..pdateclient-activex_31bf3856ad364e35_7.5.7601.17514_none_af500e3c7fc49bc4\wuapp.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-r..s-regkeys-component_31bf3856ad364e35_6.1.7601.17514_none_58b4153116c17b41\RDVGHelper.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_6.1.7601.17514_none_533cd4f8150e6a86\RMActivate_ssp_isv.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_6.1.7600.16385_none_8d8925a444607f8c\reg.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..c-journalnotewriter_31bf3856ad364e35_6.1.7600.16385_none_9e59e11166b683d3\PDIALOG.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-choice_31bf3856ad364e35_6.1.7601.17514_none_218cf07ba262766c\choice.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_regasm_b03f5f7f11d50a3a_6.1.7601.17514_none_a3c349b4bdac0898\RegAsm.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-msauditevtlog_31bf3856ad364e35_6.1.7600.16385_none_23376bf5921e7b63_auditpol.exe_83c870f4 b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-session0viewer_31bf3856ad364e35_6.1.7600.16385_none_3ddbd9a9605f0519_ui0detect.exe_639495e3 b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_6.1.7600.16385_none_bac291589d407fde\TFTP.EXE b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ConvertInkStore.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\Narrator\4cc02fad33053737088d4c18267ca0a0\Narrator.ni.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_be8acdd10de3b1a6_netbtugc.exe_825f4f74 b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\msil_loadmxf_31bf3856ad364e35_6.1.7600.16385_none_388de5065074b62c\loadmxf.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\msil_servicemodelreg_b03f5f7f11d50a3a_6.1.7601.17514_none_1f2918adb8a9c100\ServiceModelReg.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\ehome\loadmxf.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4008824c98f8edac\dnscacheugc.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_6.1.7601.17514_none_cde4c4fd7ab159cb\RMActivate_ssp.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\Backup\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_6.1.7601.17514_none_c910d80f114e267a_vdsldr.exe_20c491b3 b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe$ b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_7351a917d91c961e\expand.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ehome-devices-mcrmgr_31bf3856ad364e35_6.1.7600.16385_none_901eda10f3ab38d2\McrMgr.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-scripting_31bf3856ad364e35_6.1.7600.16385_none_a45d44bd1a0af822\cscript.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..-coreinkrecognition_31bf3856ad364e35_6.1.7600.16385_none_498d334c14a3b9bb\hwrreg.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_6.1.7601.17514_none_726f4033dc35da15\cvtres.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.1.7601.17514_none_df7c5af777ec4541\drvinst.exe b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2516 b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4eacfeba13503c98b7b3ad5f9801380_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5b4eacfeba13503c98b7b3ad5f9801380
SHA1bd6c3b198b76a2e741ef3e83092a8718ef60f9fe
SHA25685a04fae9bc11b0ed310559e04c3c26b704dd30c955084ca7a93756a31622693
SHA512b9a457984307b6ada85cb4ed6ca2f0eba3c0a8684f245e616443f2ab0efe5dedfd2456b32c37135db4cbd793c61613ab559df5311ff64ce01e52c0a579396b32