Analysis
- max time kernel
68s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 09:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe
- Size 1.7MB
- Sample260924-lkdk8sae87
- SHA256 0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5
- MD5 72fe16534ab580753d9da2f384d0ab67
- SHA1 45ab6492d7515201607a481dd1cfddb05914acd1
- SHA512 64ff0d42ab3ec49faa2705d23f2c92a282d8a53c2902722abca78a936bc6d88733b207af780e15fe9bc7e882691725f63465afb2c9f0a1d361c1276c72fdedbf
- SSDEEP 24576:6jY6yiW/A0nRQjoxz+YaDk47NIBllkBTEKRAENqpFUfuppm7hNZk:6ji6joxz+YaDk4iO1EKRf8q2pUhPk
- TLSH T142859F22F6618837E1372A35DCA785D96929BF402E24AC673AF83E0CBF797C17D11152
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe" jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 10 yandex.com 6 yandex.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe - Checks processor information in registry 2 TTPs 11 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe - Enumerates system info in registry 2 TTPs 41 IoCs
description ioc Process Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 3952 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 3952 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4204 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4204 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 3952 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 3952 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4204 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4204 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 3952 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 3952 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4204 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4204 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 3952 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 3952 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4204 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4204 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 3952 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 3952 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4204 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4204 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 3952 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 3952 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4204 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4204 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 3952 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 3952 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4204 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4204 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe - Suspicious use of SendNotifyMessage 6 IoCs
pid Process 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4644 wrote to memory of 3952 4644 jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe"1⤵
- Modifies WinLogon for persistence
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3952
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_0005eee483f613acffd16302a50b7cc5dddc7276274ac80b5d5fab390e1a20e5.exe1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4204
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004BC1⤵PID:4360
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\AVDefender2011\AVDefender2011.ini
- Size 362B
- SHA256 61119e0bee1f9d826d5f72d8a5b78835fc43e23c92bce84fd9795182a950c416
- MD5 7612153f54adac6e445b48d874e920e3
- SHA1 10a3f13c219a28f82529873630d68bd423f972e3
- SHA512 ea11cf7ee10dbee15b71d20eee6eaceaa1a57f9d37b7a082db46a69a54c196131966562ba57fb13cee3572c3b7ef5a712595eda3e5cb3f9de8350fdc6eba452b
- TLSH T13DE068846E44418D0D6014668D360FF08AC053A486C238306DC0EE9D9E0D634D52A043
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\AVDefender2011\vlc.dat
- Size 4KB
- SHA256 b7df43c8431d20442b624c803e8ea713214d4d470cb6c2087bf50fe3fddc20fa
- MD5 a4d222db62064d16dd2d72018c66049d
- SHA1 1b4c7f03ad9ee116bce2578366266a8258448498
- SHA512 19d0deae68fc81d4039d5e2a6a9f1196b76477d5a815198df5c9dd543b9eb9a8d23f400b42216f51db750f220429dc3a90f3e642df4476984d7caf2d950d373d
- SSDEEP 48:Q4K2qlcnWSSb5l888nCCCcCFCCCCSzkUbMoZiMvSJ6SSSywU6D:Q4tbWSSb5YzkUbMGiMvq6SSSywU6D
- TLSH T10891DC02E6AA5631F571EF3BC5EB225F137B32431B428E8A272C8105A493795EBC2209
- MD5 SHA1 SHA512 SSDEEP TLSH