Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 08:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe
- Size 213KB
- Sample261002-ks3dwstyas
- SHA256 b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb
- MD5 330421f9e4ab0b7db2f449b1ef711d32
- SHA1 423ff4bf7fd8d19e6306801a1c2ae29061101617
- SHA512 ffe90bd95e67fbff393eb30c41f8f4cb81d27fec0c9de8180d57c7f8d3e2d98ab87964300686055529debb97821d402e53f3c90f8421d7859f33cb52fdfbd81c
- SSDEEP 3072:8jWZMPGQe5sX6dehxxjq0Fp2XAdff3+Jg/P44xpflta2c935a4ZChBA5mn7PrV:8jM2GtsDPOXAdff3CgzuYBAe7x
- TLSH T1C3243A312AE5D032E0B2157449F95BA2AB7679613F3086CFA3890B9D5D30FC19E3875B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\logagent.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\ddodiag.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\fontdrvhost.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\help.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\PATHPING.EXE jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\ReAgentc.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\subst.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\whoami.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\appidtel.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\attrib.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\doskey.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\netbtugc.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\wevtutil.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\wscadminui.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\format.com- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\Magnify.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\mountvol.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\resmon.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\PING.EXE- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\Robocopy.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\rrinstaller.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\nslookup.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\printui.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\RdpSa.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\setx.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\shutdown.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\stordiag.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\dplaysvr.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\wextract.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\chkntfs.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\eventcreate.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\mstsc.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\pcaui.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\PresentationHost.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\NETSTAT.EXE jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\PresentationHost.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\recover.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\reg.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\runas.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\sdbinst.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\timeout.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\dpapimig.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\notepad.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\powercfg.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\setup16.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\explorer.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\ROUTE.EXE jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\tar.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\wecutil.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\mcbuilder.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\sort.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\winver.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\7-Zip\7z.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\7-Zip\7z.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Internet Explorer\iexplore.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.19041.844_none_de5d9fe254d9f8c4\f\BioEnrollmentHost.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.1_none_5106d54a804dbfc3\rmttpmvscmgrsvr.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_ce6643a69c39f80a\r\ThumbnailExtractionHost.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.19041.1_none_02ef1556ab50e6d8\wab.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.19041.117_none_610933d42d963a44\f\wsl.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\ARP.EXE- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_be3404fb0dff5d84\r\TSTheme.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_ad0ed54dd130eec3\r\DismHost.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_d9e841974c1d46e8\r\setupugc.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.19041.1151_none_f7be996d8409bfa1\wsl.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\x86_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15805.0_none_f04c7dcfd4283324\AppLaunch.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1_none_e9b79397c28488a5\pcalua.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4478665ed379a3fc\r\AtBroker.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.1_none_6905f2230c3224a7\djoin.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\scp.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.1023_none_5c93ef2449c89609\f\securekernel.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.207_none_ac38fc33d542b487\f\WorkFolders.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\replace.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.19041.1_none_0220120c9d66a59c\dcdiag.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_0f44a2d7a5e3a37a\ChtIME.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.84_none_65d0f4a4c6cd4975\Magnify.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\PrintBrmUi.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.264_none_a71c9f7fdcd899c5\r\SearchApp.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_69775cdd639910cb\TRACERT.EXE- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_96167fa49059f7a3\shrpubw.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.19041.1202_none_e17f082b30dd9027\wifitask.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\msil_servicemodelreg_b03f5f7f11d50a3a_10.0.19041.1_none_0bb55a3e8d066c16\ServiceModelReg.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7a559100246cff2b\f\CloudNotifications.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.19041.1_none_a2b2be7cc3d8faf5\DisplaySwitch.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.1_none_1b0a4d6f748b99f5\bthudtask.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_4cb1ff2aa122b5dd\r\tttracer.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_d7b5820f5a89765b\agentactivationruntimestarter.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.1_none_9b8799837b1e944c\WindowsSandbox.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.1_none_1655d5e596a1ade0\netbtugc.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.19041.1_none_e2e6c013142b9760\OOBENetworkConnectionFlow.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.19041.1023_none_9583d52fd3076014\r\SystemSettingsAdminFlows.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\rwinsta.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1_none_ee00310940a3cd37\wordpad.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_ac2441dbb712f006\r\msra.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.19041.1_none_d8250298c68d9cb6\msdtcvtr.bat- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.19041.1081_none_e34aea343fc255b7\_isdel.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.1_none_b4746d3aaf96ef0d\regedit.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1_none_604b329da953cf68\FaceFodUninstaller.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.19041.1023_none_374973298940e35c\r\FilePicker.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_8f1e438c6737a711\r\wscadminui.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_10.0.19041.84_none_cbe289218fb48371\f\wsqmcons.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.1_none_4a6487592c595dd4\wlrmdr.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-choice_31bf3856ad364e35_10.0.19041.1_none_83aca2e25f8134a1\choice.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\aspnetca.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.153_none_1721bd4ad34c0544\r\MusNotifyIcon.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\r\sftp.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1_none_6d464952ec5b23a2\wusa.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.19041.423_none_15f557c171018574\f\CHXSmartScreen.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.19041.746_none_c7a124154e1d7314\mtstocom.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\r\SgrmBroker.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4184
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 763KB
- SHA256 7dd2f3b0d0b842891cbc5a76f34681b80a8474240fb9ba6e94390c65283db758
- MD5 d5781de3f2402c9ca64f15277b199a64
- SHA1 497d47c60a58614ceb517987698f49bf6cf6d9cc
- SHA512 789c89b2d9952e65c5c585e2940a391bece152ab0e666584bdcedf7bb7615b25e9813f8f67e3c66122e50ba4933a53dc71cfbd38806c2860fddd937d906e2846
- SSDEEP 12288:4bdfK6QUXZNYVLeyUji0h90ZD0wxpGZIVuKrHsN:4pi6J0Le5ji0hmxNrMN
- TLSH T16DF43C25F6B48331D073C0B9C5E6A79AEA7134411B308ACB5385C76C6E67BD6CA36732
- MD5 SHA1 SHA512 SSDEEP TLSH