Overview
overview
10Static
static
3JaffaCakes...11.exe
windows10-2004-x64
8ADVPACK.dll
windows10-2004-x64
3W95INF16.dll
windows10-2004-x64
1W95INF32.dll
windows10-2004-x64
3fngrprnt.dll
windows10-2004-x64
3msnphoto.scr
windows10-2004-x64
3msvcr71.dll
windows10-2004-x64
3pibase.dll
windows10-2004-x64
3pidav.dll
windows10-2004-x64
3piorg.dll
windows10-2004-x64
3piorgres.dll
windows10-2004-x64
1pisync.dll
windows10-2004-x64
3pisynctw.exe
windows10-2004-x64
3piview.dll
windows10-2004-x64
3slides~1.js
windows10-2004-x64
10startup.js
windows10-2004-x64
3unicows.dll
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2025, 03:21
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
ADVPACK.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral3
Sample
W95INF16.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral4
Sample
W95INF32.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral5
Sample
fngrprnt.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral6
Sample
msnphoto.scr
Resource
win10v2004-20250502-en
Behavioral task
behavioral7
Sample
msvcr71.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
pibase.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral9
Sample
pidav.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral10
Sample
piorg.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral11
Sample
piorgres.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral12
Sample
pisync.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral13
Sample
pisynctw.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
piview.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral15
Sample
slides~1.js
Resource
win10v2004-20250502-en
Behavioral task
behavioral16
Sample
startup.js
Resource
win10v2004-20250502-en
Behavioral task
behavioral17
Sample
unicows.dll
Resource
win10v2004-20250502-en
General
-
Target
JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe
-
Size
4.2MB
-
MD5
067352f5a9f5905b21b82b18e9fa2711
-
SHA1
e416dba2a5f752caa42a572ef847271d700debd9
-
SHA256
aa8ca4e5cd049edce4fa86fcfd4883419b01cb52914fcf7b253e39dfd6871bac
-
SHA512
7026c615950fd8ea9a68d4fe7ac78529f5a18e9ac54c93a199b355526447e6186ba0c2d7eb8f6f7bd78d3e8eb49003854fc2d6b724b6aaddf5029bd4ebf5cfc5
-
SSDEEP
98304:+tOFWw/OFWdWyVxD5uUMMMMMcMMMMMtSRqIR5I0ko:+8WkD57DI0ko
Malware Config
Signatures
-
Drops file in Drivers directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\es-ES\mircmirc.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\SystemWFPLWFS10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\SystemWFPLWFS.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\mircmirc.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\drivers\it-IT\SystemWFPLWFS10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\drivers\es-ES\OperatingWindows10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\OperatingWindows10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\drivers\de-DE\SystemWFPLWFS.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mIRCmirc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe" JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\mIRCmirc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe" JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\F12\de-DE\F12ScriptInternet.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Systmeconnect10.0.19041.1.160101.0800.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\wbem\fr\resourcesMicrosoft10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\MUI\0407\mscoreesmirc.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_35bbbe80dec15683\nvm62x64Networking.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbushdaudbus10.0.19041.1081.160101.0800.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\en\AppVOperating.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\Speech\Common\de-DE\sapisapi.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_x86_c62e9f8067f98247\I386\OperatingWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\en-US\SapiWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\ru-RU\WindowsSystem.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\sr-Latn-RS\OperatingMicrosoft.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\memory.inf_amd64_9af3a8a63d4cb5f9\Windowspnpmem10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_hfp.inf_amd64_9effd93a75bc489e\WindowsOperating.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\el-GR\XamlWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\netwsw00.inf_amd64_24d55504ae3587aa\LinkNETwsw0017642.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\setup\MSDTCSTPCMMIGR.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\WindowsOperating10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\oobe\SetupCleanupTaskWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\ja\resourcesresources.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\RCX3E80.tmp JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\net7500-x64-n650f.inf_amd64_cc87c915f33d1c27\Ethernetlan7500x64n650f.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\oobe\it-IT\SetupCleanupTaskMicrosoft.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\migration\es-ES\mircmIRC.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\OperatingWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\Speech\Common\en-US\Windowssapi.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\sr-Latn-RS\mircmIRC.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\vdrvroot.inf_amd64_5dbe5e81fafe4636\Operatingvdrvroot13291.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\ws3cap.inf_amd64_6cf8ea2249844b50\OperatingWindows10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\WindowsPowerShell.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\pspluginwkrdefaulthelp.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en\resourcesSystem.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\Dism\fr-FR\dexploitationSystme10.0.19041.1.160101.0800.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\ro-RO\SystemQuickAssist.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\athw8x.inf_amd64_55014eff4ceefbdf\NetworkAdapter.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\MUI\0407\FrameworkMicrosoft.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\IME\IMEKR\DICTS\WindowsSystem.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\iscsi.inf_amd64_c089962740ea1f84\WindowsSystem.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\it\PowerShellWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\cht4vx64.inf_amd64_b03448ba0b72ec47\Controllercht4vbd.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\it\MicrosoftWindows10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\fr\resourcesAppVClientPowerShell.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\it-IT\SistemaMicrosoft.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\oobe\de-DE\WindowsBetriebssystem.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\sv-SE\XamlSyncRes.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\fr\SystmeWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\InstallShield\mIRCmirc.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\en\Systemresources.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\Dism\en-US\mircmirc.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\virtdisk.inf_amd64_9a7f42b85c7def50\bttfltOperating.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\es-ES\operativoSistema.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\MUI\0409\mscoreesWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\MicrosoftWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\Dism\en-US\SetupPlatformProviderOperating.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_skl.inf_amd64_b68199ad84607c21\SerialDriver.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\volmgr.inf_amd64_b98e2b928f71a2b1\SystemWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\61883.inf_amd64_789f35bee584a939\SystemWindows10.0.19041.1.160101.0800.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\es\WindowsSistema.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\Speech\Common\sapiWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\usb.inf_amd64_683fd853c8b8a4db\OperatingWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_c62e9f8067f98247\Amd64\WindowsPS5UI.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SysWOW64\Dism\fr-FR\dexploitationSystme10.0.19041.1.160101.0800.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\de\MicrosoftMicrosoft10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\SysWOW64\Dism\en-US\SetupPlatformProviderOperating.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\AdobeHunspellPluginAdobeHunspellPlugin.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\OperatingWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\ReaderManager.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\qrcodepmpdatamatrixpmp.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\ja-JP\SystemSystem.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Common Files\System\ja-JP\SystemOperating.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Common Files\System\RCX6052.tmp JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ja-JP\PhotoViewerPhotoAcq.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\TipResTipTsf.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Common Files\System\de-DE\BetriebssystemWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Internet Explorer\uk-UA\Internetieinstal.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Common Files\System\msadc\Systemmsadce.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\MicrosoftOperating.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\EBWebView\x86\ClientEmbedded.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Common Files\System\ado\ja-JP\msader15Operating.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Internet Explorer\de-DE\iexploreInternet.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\CreateAdobe.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\DynamicStudio.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Common Files\System\en-US\WindowsWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateUpdate.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ja-JP\Internetiexplore.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\widevinecdmadapterComponents.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\IEToEdgeietoedgestub132.0.2957.140.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Windows Defender\it-IT\operativompasdesc.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\EBWebView\x86\WebViewMicrosoft132.0.2957.140.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Internet Explorer\uk-UA\Internetieinstal.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Windows NT\TableTextService\WindowsWindows10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\LinkLibrary.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\libGLESv2wnspushclient.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\sqloledbWindows10.0.19041.1.160101.0800.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\PowerShellMicrosoft.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\WindowsTabTip32.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\TipResTipTsf.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\BHO\ietoedgebhoietoedgebho64.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\Microsoftvstoee.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Windows Defender\fr-FR\mpasdescSystme.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Windows Media Player\en-US\wmplayerWMPNSSUI.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Windows Defender\es-ES\mpasdescoperativo4.18.1907.16384.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Windows Defender\es-ES\mpasdescoperativo4.18.1907.16384.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\uk-UA\WindowsMicrosoft.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Windows Defender\de-DE\Microsoftmpasdesc.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Internet Explorer\fr-FR\InternetIEXPLORE.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Internet Explorer\es-ES\Internetieinstal.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\InstallerMicrosoft.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\InstallerMicrosoft.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\setupwmOperating12.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\DesignEngine.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\de-DE\msdaremrWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\WindowsWindows10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\OperatingWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Windows Defender\uk-UA\EppManifestmpasdesc4.18.1907.16384.160101.0800.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\TabTip32System.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodAiod.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedgeproxymsedgeproxy.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\resourcesUIAutomationClientsideProviders.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Common Files\System\uk-UA\WindowsWAB32res.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\BHO\ietoedgestubietoedgebho.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Common Files\System\msadc\es-ES\Systemmsdaprsr10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ja\resourcesresources10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagementMicrosoft.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\MicrosoftmshwLatin.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\VisualStudio7.10.2346.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Windows Media Player\ja-JP\setupwmOperating12.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Program Files (x86)\Common Files\System\it-IT\Sistemaoperativo.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_es-es_76fa6c1a5ef15070\operativomemdiag10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ngc-tasks.resources_31bf3856ad364e35_10.0.19041.1_de-de_7bba1588ca7cc4c9\NgcTasksMicrosoft.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\msil_microsoft.powershell.commands.management_31bf3856ad364e35_10.0.19041.1_none_fcfa075fee21fc1f\WindowsSystem.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ole-automation_31bf3856ad364e35_10.0.19041.264_none_9ae1cb705a5b8b5e\OLEAUT32Windows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..gementwmi.resources_31bf3856ad364e35_10.0.19041.1_es-es_2f63b728e887d212\STORAGEWMISystem.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_wwf-system.workflow.componentmodel_31bf3856ad364e35_10.0.19041.1_none_41d526fcad732f45\SystemSystem.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ngerprintcredential_31bf3856ad364e35_10.0.19041.1_none_518abbfab883365f\WindowsOperating.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-naturallanguage6-mls6_31bf3856ad364e35_10.0.19041.1_none_0b90bf36f1da43c7\MicrosoftMLS6.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\apppatch\fr-FR\dexploitationdexploitation.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..l-keyboard-00010444_31bf3856ad364e35_10.0.19041.1_none_4bfa5a9429ac9352\kbdtt102Microsoft10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..mentation.resources_31bf3856ad364e35_11.0.19041.1_fr-fr_a4b6064456d99eae\wininetInternet.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_adf98e02f565c8fe\SystemOperating.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-themeui_31bf3856ad364e35_10.0.19041.1_none_45444e48ef3f71b1\MicrosoftOperating.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_presentationbuildtasks_31bf3856ad364e35_4.0.15805.0_none_d34a6f7ba236f5b1\FrameworkPresentationBuildTasks.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasplap_31bf3856ad364e35_10.0.19041.867_none_f01b2255d690daa4\WindowsMicrosoft.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..pbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_3598413c5a348b00\InformationServices.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..tenanceui.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_b25ad5b5e308bb79\WindowsOperating.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\WindowsSystem.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.19041.1_none_33c3e07f6cce5a52\dpapimigMicrosoft10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Speech.resources\v4.0_4.0.0.0_it_31bf3856ad364e35\Speechresources.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup.resources_31bf3856ad364e35_11.0.19041.1_fr-fr_dd930683cd93912c\Internetinseng.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\msil_srpuxsnapin.resources_31bf3856ad364e35_10.0.19041.1_de-de_aa10d96c525615f4\SrpUxSnapInresources.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oleaccrc.resources_31bf3856ad364e35_10.0.19041.1_es-es_b6152b81960ebc0b\SystemOLEACCRC.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.Resources\2.0.0.0_de_b77a5c561934e089\Frameworkresources.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..show-core.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_33ba3aa19a7751f6\MicrosoftSystem.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_system.componentmod..mposition.resources_b77a5c561934e089_4.0.15805.0_es-es_15cec99082ddb40a\SystemMicrosoft.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ice-winrt.resources_31bf3856ad364e35_10.0.19041.1_en-us_c7adf605f08d0f3a\ManagementMicrosoft10.0.19041.1.160101.0800.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_usbcciddriver.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_14683ba967cda790\MicrosoftSystme.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Ic1a2041b#\7710ed46e965bbb56a0558fbff9916f3\EsentWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-oleprn.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_97a642635d1f8594\oleprnoleprn.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.OracleClient.resources\v4.0_4.0.0.0_de_b77a5c561934e089\SystemSystem.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nvservice.resources_31bf3856ad364e35_10.0.19041.1_es-es_ccaeaf8ba3acc8d6\SistemaMicrosoft.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wer-sdktools_31bf3856ad364e35_10.0.19041.1_none_0067ac1cb4a6c8bc\DbgModelSystem10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..tend-apis.resources_31bf3856ad364e35_10.0.19041.1_es-es_55a09501fcb42814\WindowsSistema.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msf-providers_31bf3856ad364e35_10.0.19041.1_none_56318e5c7ea2ae30\SynchronizationSynchronization.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_c47fb20821633815\Systemimecfmps10.0.19041.844.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..icsclient-scheduled_31bf3856ad364e35_10.0.19041.1_none_baa4e03a66bc0eae\Microsoftsdiagschd.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\msil_uiautomationclients..providers.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5e0415d3956ba66c\FrameworkUIAutomationClientsideProviders.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist.resources_31bf3856ad364e35_10.0.19041.1_zh-cn_17c4f3dd4fef22c6\WindowsQuickAssist10.0.19041.1.160101.0800.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.19041.1_none_a84acae243b8ad63\Microsoftcharmap.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\msil_multipoint-wms.dash..addintabs.resources_31bf3856ad364e35_10.0.19041.1_es-es_f6932ba2fb323f2a\resourcesWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\diagnostics\system\Power\fr-FR\WindowsMicrosoft.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft.powershel..er.events.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_95e58db0b0215011\PSDSCFileDownloadManagerEventsdexploitation.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_system.net.websockets_b03f5f7f11d50a3a_4.0.15805.0_none_d53ac54f87ada30d\FrameworkMicrosoft.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\de\MicrosoftPresentationFramework.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ctiveuser.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5636904c996fb1a0\WindowsSystem10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\AddInUtil.resources\v4.0_4.0.0.0_es_b77a5c561934e089\resourcesresources.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\wow64_microsoft-onecoreuap-deviceaccess_31bf3856ad364e35_10.0.19041.746_none_d665b070f8fb6cac\WindowsDeviceAccess.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usbperf.resources_31bf3856ad364e35_10.0.19041.1_it-it_1c566b3d8a3314b4\operativoWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup.resources_31bf3856ad364e35_11.0.19041.1_de-de_921f5da7ebbc7d60\ExplorerInternet11.00.19041.1.160101.0800.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_a8776209b1045f20\CtTuneSvrOperating.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_system.servicemodel.activities.resources_31bf3856ad364e35_4.0.15805.0_fr-fr_8eeaaaa95649ea19\ServiceModelActivities.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.DurableInstancing.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\FrameworkDurableInstancing.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directx-ddisplay_31bf3856ad364e35_10.0.19041.1_none_f0f00523b877918c\DDisplayWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1_tr-tr_bc9b72f5f08b2431\WindowsMicrosoft.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-admin.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_25b17136f36d1d7e\SystemAuthFWWizFwk.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wlangpclient.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c658feb5f06faa9f\wlgpclntSystem.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..xperience.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_8415e2f2102f59fc\WindowsWindows.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Tpm.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\dexploitationresources10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_afb9e74560b9f815\winlogonOperating.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_dual_amdsata.inf_31bf3856ad364e35_10.0.19041.1_none_e0b7b1076af0e5b4\Storageamdxata.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-riched32_31bf3856ad364e35_10.0.19041.1_none_52f1c15a21f92b4b\WindowsSystem5.31.23.1231.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mystify_31bf3856ad364e35_10.0.19041.1_none_a602a895febacb78\SystemOperating10.0.19041.1.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-telephony-phoneom_31bf3856ad364e35_10.0.19041.746_none_c751b51b9cfc017c\SystemPhoneOm10.0.19041.746.exe JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5992 JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe 5992 JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe 5992 JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe 5992 JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe 6008 JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe 6008 JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe 5992 JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe 5992 JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4200 wrote to memory of 6008 4200 cmd.exe 90 PID 4200 wrote to memory of 6008 4200 cmd.exe 90 PID 4200 wrote to memory of 6008 4200 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5992
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe1⤵
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_067352f5a9f5905b21b82b18e9fa2711.exe2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:6008
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD5067352f5a9f5905b21b82b18e9fa2711
SHA1e416dba2a5f752caa42a572ef847271d700debd9
SHA256aa8ca4e5cd049edce4fa86fcfd4883419b01cb52914fcf7b253e39dfd6871bac
SHA5127026c615950fd8ea9a68d4fe7ac78529f5a18e9ac54c93a199b355526447e6186ba0c2d7eb8f6f7bd78d3e8eb49003854fc2d6b724b6aaddf5029bd4ebf5cfc5