Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3de05d6e905...18.exe
windows7-x64
8de05d6e905...18.exe
windows10-2004-x64
8ADVPACK.dll
windows7-x64
3ADVPACK.dll
windows10-2004-x64
3W95INF16.dll
windows7-x64
1W95INF16.dll
windows10-2004-x64
1W95INF32.dll
windows7-x64
3W95INF32.dll
windows10-2004-x64
3fngrprnt.dll
windows7-x64
3fngrprnt.dll
windows10-2004-x64
3msnphoto.scr
windows7-x64
3msnphoto.scr
windows10-2004-x64
3msvcr71.dll
windows7-x64
3msvcr71.dll
windows10-2004-x64
3pibase.dll
windows7-x64
3pibase.dll
windows10-2004-x64
3pidav.dll
windows7-x64
3pidav.dll
windows10-2004-x64
3piorg.dll
windows7-x64
3piorg.dll
windows10-2004-x64
3piorgres.dll
windows7-x64
1piorgres.dll
windows10-2004-x64
1pisync.dll
windows7-x64
3pisync.dll
windows10-2004-x64
3pisynctw.exe
windows7-x64
3pisynctw.exe
windows10-2004-x64
3piview.dll
windows7-x64
3piview.dll
windows10-2004-x64
3slides~1.js
windows7-x64
10slides~1.js
windows10-2004-x64
10startup.js
windows7-x64
3startup.js
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/12/2024, 18:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
ADVPACK.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
ADVPACK.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
W95INF16.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
W95INF16.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
W95INF32.dll
Resource
win7-20240729-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
W95INF32.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
fngrprnt.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
fngrprnt.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
msnphoto.scr
Resource
win7-20241010-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
msnphoto.scr
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
msvcr71.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
msvcr71.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
pibase.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
pibase.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
pidav.dll
Resource
win7-20240729-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
pidav.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
piorg.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
piorg.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
piorgres.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
piorgres.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
pisync.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
pisync.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
pisynctw.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
pisynctw.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
piview.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
piview.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
slides~1.js
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
slides~1.js
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
startup.js
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
startup.js
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe
-
Size
2.6MB
-
MD5
de05d6e9059d16c24eb5fbd8f83af700
-
SHA1
6927b2015eca6a33b5812e2806bf1f2ad06a718c
-
SHA256
c962634c994cac4d2722ce8bc5b73aa10e0a3d46c0ee0b7f24d0cfe522ef00d1
-
SHA512
4c60ce4d69f40e0ce662f12a4af708261672b753b5b8df3be4b60378d04cd0cc6f6ecababfa4752f1b40b72f6caf804100f3f4d22892b67122c436e4db40d6d4
-
SSDEEP
24576:IVYbWzOiA80yE23Z5EU22lH1QnxBxabsM8KGH7Co0OLeGrIocE5lArjPPA:hWzOryrZOU22lcx08KGbNLeGMb4unA
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\es-ES\OperatingWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\OperatingWFPLWFS.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\MicrosoftWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\MicrosoftWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\WindowsNDISCAP.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\WindowsSystem.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\OperatingWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\OperatingWFPLWFS.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\WindowsNDISCAP.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\WindowsSystem.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\mIRCmirc.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\mIRCmirc.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mIRCmirc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe" de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\mIRCmirc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe" de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Speech\Engines\SR\ja-JP\Operatingsrloc.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\en-GB\MicrosoftOperating5.82.160101.0800.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RCX5E6B.tmp de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\wbem\fastproxipmiprr.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_cnl.inf_amd64_f668309b543472eb\IntelRiaLPSS2iI2CCNL.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\MUI\0409\MicrosoftOperating10.0.19041.1.160101.0800.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\uiccspb.inf_amd64_18454ae612999870\uiccspbOperating.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ja-JP\MicrosoftWindows10.0.19041.1.160101.0800.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\ko-KR\WindowsSystem6.6.19041.1.160101.0800.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ehstorpwddrv.inf_amd64_220e4fad6c84d016\WindowsOperating.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\bg-BG\WindowsMicrosoft.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\oobe\fr-FR\Microsoftdexploitation.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\lsi_sas.inf_amd64_74bb5e3e01cfd526\LSISAS1FusionMPT.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\rdvgwddmdx11.inf_amd64_e8336336d081cc11\SystemOpenCL.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_8984d8483eef476c\AdaptersRealtek.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\Systempspluginwkr.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\zh-CN\QuickAssistMicrosoft5.82.160101.0800.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\InstallShield\InstallShieldInstallShield.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\ja-JP\mofdWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\pt-PT\MicrosoftOperativo.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MUI\0411\Frameworkmscorees.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Dism\en-US\SmiProviderOperating.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\it-IT\SistemaWindows10.0.19041.1.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\uicciso.inf_amd64_32023cb966fd5c8c\SystemMicrosoft10.0.19041.1.160101.0800.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\operativoMicrosoft.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\migwiz\SystemOperating10.0.19041.450.160101.0800.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Common\fr-FR\SystmeWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\ja\mircSystem10.0.19041.1.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mlx4_bus.inf_amd64_4c426f3bebc68844\winverbsndfltr.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\de\WindowsBetriebssystem.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\pwrshmsgoperativo.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\MicrosoftRMicrosoft.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ipmidrv.inf_amd64_ddb154dfd1a1c33d\WindowsIPMIDRV.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\Operatingspsreng.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\hu-HU\mIRCmirc.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\F12\uk-UA\F12ScriptF12Platform.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\it\operativoresources.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\MUI\0411\Frameworkmscorees.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\Systempspluginwkr.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\windowstrustedrtproxy.inf_amd64_db5be14d5e02560f\SystemWindowsTrustedRTProxy.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\iscsi.inf_amd64_c089962740ea1f84\OperatingiSCSI.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\oposdrv.inf_amd64_9090a824ce0d0e68\WindowsMicrosoft.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Com\en-US\SystemOperating.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\en\WindowsmIRC.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\en-US\MicrosoftSystem.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\es\DismSistema.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmfn2.inf_amd64_5ebadf201c5b5845\bcmfn2driver.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\WindowsWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\oobe\fr-FR\mircmirc6.34.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\hu-HU\mIRCmirc.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ru-RU\MicrosoftWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\megasas.inf_amd64_289e18fb610dd883\Windowsmegasas.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\de\WindowsBetriebssystem.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\imesearchpsimesearch.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\es-ES\MicrosoftSistema.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\migration\en-US\Systemshmig.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\msports.inf_amd64_f2e8231e8b60f214\Windowsparport.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_30040c3eb9d7ade4\netv1x64Adapter.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidvhf.inf_amd64_0a924aec7600dcde\SystemOperating.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\fr\WindowsWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\el-GR\WindowsWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\SystemPowerShell10.0.19041.1.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\es-ES\OperatingMicrosoft.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\SysWOW64\XPSViewer\ja-JP\XPSViewerFramework3.0.6920.9135.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateresfaGoogle.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\mircmIRC.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\PhotoViewerImagingDevices10.0.19041.1.160101.0800.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\es-ES\mircmIRC.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\AdobeWCChromeNativeMessagingHost.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\PrintingUIAutomationClient.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\SwiftShaderwnspushclient.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceserviceFirefox.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\UpdateUpdate.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftUpdate.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\mIRCmirc.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\resourcesPackageManagement6.34.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\en-US\mircmIRC.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Defender\ja-JP\Systemmpasdesc.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Internet Explorer\IEXPLOREielowutil.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Defender\uk-UA\mIRCmirc6.34.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\AdobeAcrobat.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\msadc\ja-JP\msdaremrSystem.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Internet Explorer\fr-FR\mircmIRC.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceserviceFirefox.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\mircAdobeHunspellPlugin.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\mircmIRC.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\es-ES\msader15System.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\mIRCMicrosoft6.34.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\en-US\mIRCmirc.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeManager1.824.29.8644.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\de-DE\Operatingmsader15.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\AdobemIRC.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ja-JP\mircmirc.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\ja-JP\msdaremrSystem.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeManager1.824.29.8644.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\Autojaureg.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\en-US\msdaorarSystem.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\Systemmpasdesc.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\InternetExplorer11.00.19041.746.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Internet Explorer\mIRCMicrosoft11.00.19041.1.160101.0800.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Previewrt3d.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProviderMicrosoft.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\it-IT\mircmIRC6.34.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\mIRCJava.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\msadc\es-ES\Sistemamsadcor10.0.19041.1.160101.0800.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\en-US\Microsoftmsader1510.0.19041.1.160101.0800.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\ModuleDecryption.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\AdobemIRC.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\AdobeAcrobat.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\uk-UA\PhotoViewerMicrosoft.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\PackageManagementSystem.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\MicrosoftVisual10.0.60828.0.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Media Player\RCXE42D.tmp de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\uk-UA\WindowsTipTsf.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\resourcesEngine.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Windows NT\Accessories\en-US\mircmIRC.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\resourcesresources.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\es-ES\mircmIRC.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\msadc\it-IT\mircmIRC.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\WindowsPowerShell.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\es-ES\WAB32resSistema10.0.19041.1.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\mIRCmirc.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\System\es-ES\mircmIRC.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\MicrosoftInstaller.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoaderVSTOMessageProvider10.0.60828.0.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\mircmirc.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x86\ClientBrowser.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\MicrosoftVisual.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-i..onal-keyboard-kbdus_31bf3856ad364e35_10.0.19041.1_none_34a329b3b3f01d7b\Systemkbdus.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ntdsatq.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ad5f8a3595c3fe7d\MicrosoftSystem.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_net7800-x64-n650f.inf_31bf3856ad364e35_10.0.19041.1_none_67b1d28c9184f600\lan7800x64n650fEthernet.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rtup-core.resources_31bf3856ad364e35_10.0.19041.1151_en-us_c9f16b25e2c56827\SystemOperating.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ettingshandlers-usb_31bf3856ad364e35_10.0.19041.1_none_88844fd7bbe1ccb7\UsbSettingsHandlersMicrosoft.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tmlrendering-legacy_31bf3856ad364e35_11.0.19041.264_none_33cbc8e23aac35d1\MSHTMLOperating.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\v4.0_10.0.0.0_en_31bf3856ad364e35\WindowsSecurity.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce.resources_31bf3856ad364e35_10.0.19041.1_it-it_581fa2c5820a2ddb\MicrosoftWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_255fcd60d7fffa61\WinInitWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\de\Microsoftresources.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-timeline_31bf3856ad364e35_11.0.19041.1_none_36b281a7740d4722\InternetTimeline.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shdocvw_31bf3856ad364e35_10.0.19041.746_none_cfc2e2a39f163490\SHDOCVWMicrosoft.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\PLA\System\SystemDiagnostics.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_wpf-system.speech_31bf3856ad364e35_10.0.19041.1_none_db8f623b038de54b\SystemWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msvideodsp_31bf3856ad364e35_10.0.19041.746_none_b7de238f30df0c06\msvideodspWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_usbvideo.inf_31bf3856ad364e35_10.0.19041.1_none_68edf5c3d317ed16\Microsoftsecureusbvideo.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_1d38815769c81e5a\dllhostWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1023_none_2cc973d075644422\WindowsProxyStub.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..t-roaming.resources_31bf3856ad364e35_10.0.19041.1_it-it_81f7ad6a2ca88b46\VaultRoamingVaultRoaming.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_pt-pt_cddf32f2df4e7d54\Operativocomctl32.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-a..sibility-experience_31bf3856ad364e35_10.0.19041.1_none_4c07292659d13e35\OperatingWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\v4.0_10.0.0.0_it_b03f5f7f11d50a3a\MicrosoftVisualBasic.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.19041.1_none_77b40a18a99e4f02\MicrosoftVisual.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-modernexecserver_31bf3856ad364e35_10.0.19041.1_none_8a2c8aea2c307df6\ModernExecServerWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..re-atmini.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d68a9f096cb718b5\WindowsUNIMDMAT.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-ise_31bf3856ad364e35_10.0.19041.1_none_1ed6cb15a1b51b10\WindowsPowerShell.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..input-cpl.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_9f0bb4ff62372b98\WindowsMicrosoft.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_disk.inf_31bf3856ad364e35_10.0.19041.789_none_8b27201323bd7e45\diskMicrosoft.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_idtsec.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_165806b4591c34ab\operativoidtsec.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uiribbon.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_25f495087c8bd49b\dexploitationdexploitation.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mountvol.resources_31bf3856ad364e35_10.0.19041.1_it-it_c60e547c2ea39b69\mountvolWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-simcfgd.resources_31bf3856ad364e35_10.0.19041.1_en-us_837a6599134a264e\MicrosoftWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..gine-isam.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c44d6e62078280f6\Microsoftesent.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..ntrol-rll.resources_31bf3856ad364e35_10.0.19041.1_en-us_5999f37e19ca45ad\msadcorOperating.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..hony-phoneproviders_31bf3856ad364e35_10.0.19041.844_none_c87fbaf3835e2c51\SystemWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_uiautomationtypes.resources_31bf3856ad364e35_10.0.19041.1_es-es_5b29b61590850247\resourcesMicrosoft.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..gine-main.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_227b07c7bc49ad6c\wbenginedexploitation.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFramework.Resources\3.0.0.0_de_31bf3856ad364e35\resourcesMicrosoft3.0.6920.9135.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..-installer-provider_31bf3856ad364e35_10.0.19041.1_none_e07a24cd798ea597\WindowsSystem.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-media-streaming-ps_31bf3856ad364e35_10.0.19041.1_none_fa562f83ace75b88\SystemWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32.resources_31bf3856ad364e35_10.0.19041.1_it-it_8f67596e02ed3011\MicrosoftWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..trolpanel.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_82bd035d72e5b69b\WindowsSpaceControl10.0.19041.1.160101.0800.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-devicepro..-provider.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3598a5c4d3e2b04d\SystmepcsvDevice.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_microsoft.tpm.resources_31bf3856ad364e35_10.0.19041.1_it-it_7e4c3b1f1c999520\resourcesWindows10.0.19041.1.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..ingengine.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_052572e98a5d9a97\Microsoftnetcfgx.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_system.net_b03f5f7f11d50a3a_4.0.15805.0_none_523f0dc5019ce57d\SystemMicrosoft.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_system.security.cryptography.encoding_b03f5f7f11d50a3a_4.0.15805.0_none_55ea56eac6b07027\SystemMicrosoft.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-raschap_31bf3856ad364e35_10.0.19041.746_none_f0b84dd1d61bbbab\OperatingSystem.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..esources-mrmindexer_31bf3856ad364e35_10.0.19041.264_none_46982d372e36f203\WindowsMrmIndexer.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.19041.1_hr-hr_518d45e670368f11\WindowsMicrosoft.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.19041.1023_da-dk_81985656bd2d9e84\OperativsystemWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-memoryanalyzer_31bf3856ad364e35_11.0.19041.746_none_e4a876e17bd553bc\MemoryAnalyzerInternet11.00.19041.746.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Data.Entity\3.5.0.0__b77a5c561934e089\systemsystem.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SecurityAuditPoliciesSnapIn.resources\v4.0_10.0.0.0_en_31bf3856ad364e35\resourcesOperating10.0.19041.1.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobilepc-location-api_31bf3856ad364e35_10.0.19041.1_none_c6d89e540fba4acd\WindowsLocationApi10.0.19041.1.160101.0800.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directx-directdraw_31bf3856ad364e35_10.0.19041.1_none_c54b5ac293bf8733\ddrawexSystem.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..appushsvc.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_54ace3fe83503858\dmwappushsvcMicrosoft.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File opened for modification C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_es_31bf3856ad364e35\Sistemaoperativo.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist.resources_31bf3856ad364e35_10.0.19041.1_bg-bg_c9dec778944b102b\SystemWindows.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mitigation-client_31bf3856ad364e35_10.0.19041.1081_none_e15c172231b1940f\OperatingMicrosoft.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-notify.resources_31bf3856ad364e35_10.0.19041.1_en-us_e98c1b2c31078c32\WindowsFVENOTIFY.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-jet-ji32.resources_31bf3856ad364e35_10.0.19041.1_de-de_0575ece3198c884d\MicrosoftSystem.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_20b4a77ccba0074b\Windowssecurityhealthagent.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-textpredictionengine_31bf3856ad364e35_10.0.19041.1_none_d7c3fcd1dae5d48f\SystemMicrosoft10.0.19041.1.160101.0800.exe de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1640 de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe 1640 de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe 1640 de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe 1640 de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe 1640 de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe 1640 de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe 1640 de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe 1640 de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe 1640 de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe 1640 de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe 1640 de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe 1640 de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\de05d6e9059d16c24eb5fbd8f83af700_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\ToolsStudio.exe
Filesize2.6MB
MD5de05d6e9059d16c24eb5fbd8f83af700
SHA16927b2015eca6a33b5812e2806bf1f2ad06a718c
SHA256c962634c994cac4d2722ce8bc5b73aa10e0a3d46c0ee0b7f24d0cfe522ef00d1
SHA5124c60ce4d69f40e0ce662f12a4af708261672b753b5b8df3be4b60378d04cd0cc6f6ecababfa4752f1b40b72f6caf804100f3f4d22892b67122c436e4db40d6d4
-
Filesize
2.6MB
MD53593aa4f0c27ab8d9af031b90ec37d75
SHA18937c3cf7bad87e564c63d9d3c0c68de0511f9db
SHA2561b98283eceea8cce2c7dc80e48c915b7cb8eaddfc0469c1ea2d5c12e13f486d6
SHA51247825ed57d19f033699e6242c40fdd20b769a8f06129684d6c130dd3c23d037864d336730c7e5f3678f70a5d1f5a378747596151d3203a032b3c813642f0fa5e
-
Filesize
3.2MB
MD5d63b2f2650b9c5b0b414012e3656cf8f
SHA1e2b0dde1849c968a9c4ebe6ab36cf507d4bdbc2e
SHA2562d7ed0024325e2beb193d9e824482eb723517e5daaca79c4ad04af65406e0cb3
SHA512b63cebae0d2306a6f31b41ca8a6d9ae9181e7c02fa2aea42855d7417e3e3a78b29b1304b25a67ee2ce29e180b3f210609e81ee51d9cf0a916cbcfe1b1a57e16c