Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 08:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe
- Size 213KB
- Sample261002-ks3dwstyas
- SHA256 b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb
- MD5 330421f9e4ab0b7db2f449b1ef711d32
- SHA1 423ff4bf7fd8d19e6306801a1c2ae29061101617
- SHA512 ffe90bd95e67fbff393eb30c41f8f4cb81d27fec0c9de8180d57c7f8d3e2d98ab87964300686055529debb97821d402e53f3c90f8421d7859f33cb52fdfbd81c
- SSDEEP 3072:8jWZMPGQe5sX6dehxxjq0Fp2XAdff3+Jg/P44xpflta2c935a4ZChBA5mn7PrV:8jM2GtsDPOXAdff3CgzuYBAe7x
- TLSH T1C3243A312AE5D032E0B2157449F95BA2AB7679613F3086CFA3890B9D5D30FC19E3875B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\bthudtask.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\chkntfs.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\colorcpl.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\MRINFO.EXE jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\srdelayed.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\TapiUnattend.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\winrm.cmd jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\compact.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\net1.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\ReAgentc.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\SecEdit.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\systeminfo.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\msiexec.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\ntprint.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\srdelayed.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\w32tm.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\ddodiag.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\Netplwiz.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\sfc.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\curl.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\driverquery.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\netsh.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\win32calc.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\convert.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\dplaysvr.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\eventcreate.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\ieUnatt.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\net.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\SecEdit.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\calc.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\charmap.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\diskusage.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\mountvol.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\odbcconf.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\ReAgentc.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\recover.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\unregmp2.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\dllhst3g.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\format.com jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\msinfo32.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\sort.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\bitsadmin.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\clip.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\fontview.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\ieUnatt.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\finger.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\relog.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\cmmon32.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\msdt.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SysWOW64\perfmon.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Windows Defender\NisSrv.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\winhlp32.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.26100.1150_none_e61570904a993a97\r\ielowutil.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_4.0.15912.0_none_fcd20f3bc43afbcc\AddInProcess32.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\mavinject.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.26100.1591_none_e9f27dc23b0bf8db\FileHistory.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.26100.1591_none_53c210db32c306cd\r\PickerHost.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\TiFileFetcher.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sort_31bf3856ad364e35_10.0.26100.1150_none_47a573c9c96cd2e9\sort.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.0_none_98d146a6029264ee\vbc.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\r\WDAGNetDiag.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.26100.1591_none_dcb2480c8ab03707\r\desktopimgdownldr.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\cmstp.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sort_31bf3856ad364e35_10.0.26100.1150_none_47a573c9c96cd2e9\r\sort.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.26100.1591_none_c055032b96806f80\wscadminui.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.26100.1150_none_c83b3d886b00dded\ieinstal.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.26100.1150_none_88a9016fd4655cfd\DisplaySwitch.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\msil_inspectvhddialog_31bf3856ad364e35_10.0.26100.1_none_131779f41084e8ab\InspectVhdDialog.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_824861107299001b\r\imecfmui.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_c8bf902cd831831a\CasPol.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.26100.1_none_91c8eae9745a351d\SystemPropertiesRemote.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.26100.1742_none_227796ba348ec62b\r\MoUsoCoreWorker.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1591_none_4593139f0a8d3490\r\fontdrvhost.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_userexperience-oobe_31bf3856ad364e35_10.0.26100.1591_none_54983d2d7a4908c4\r\OOBE\OobeHostApp.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_14427ce57d177902\r\Magnify.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.26100.1_none_c492cc5e99915bfb\CastSrv.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_acf5850f76c86db8\WPDShextAutoplay.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\x86_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15912.0_none_c07bc1454a24c3d8\csc.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.355_none_d6930f2587043445\vbc.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.26100.1591_none_c6fec8639b4d0909\sfc.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.26100.1742_none_d0e5d15b0fe45285\r\vmwp.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netcfg_31bf3856ad364e35_10.0.26100.1150_none_ac162c2f01636f98\r\netcfg.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\UpgradeResultsUI.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\runexehelper.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15912.0_none_b4e0bc75d19eec35\ngen.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-more_31bf3856ad364e35_10.0.26100.1_none_b3a2a31db5fc0bbd\more.com- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-ux_31bf3856ad364e35_10.0.26100.1_none_b4b86b7122033aff\wmpnscfg.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.26100.1591_none_2bcc571573c94745\IMESEARCH.EXE- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.26100.1_none_6c5f8b350c999f6d\gpscript.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.26100.1_none_dc671a88c37dde08\tabcal.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.26100.1_none_6b60acbaf3301f6c\_isdel.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\mode.com- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15912.355_none_7944a4ca9ef8c9af\aspnet_regiis.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..tofservice-oposhost_31bf3856ad364e35_10.0.26100.1_none_84152c97a6cd932c\OposHost.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1301_none_970881ba6260e29a\r\StartMenuExperienceHost.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinprocess_31bf3856ad364e35_10.0.26100.1_none_2d8ad328b5479b73\AddInProcess.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.26100.1150_none_37adcb75a8302256\r\WindowsActionDialog.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.26100.1591_none_9c7590519bc81879\r\vfpctrl.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audit-component_31bf3856ad364e35_10.0.26100.1_none_a3abe7a4df6b292a\AuditShD.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-upprinterinstaller_31bf3856ad364e35_10.0.26100.1150_none_4ef2fca3d76b94b2\UPPrinterInstaller.exe- jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b32eede014278b65dcd74e5037a49b30b3fd87a974ce362076c74c8f41af19cb.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3696
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 1.2MB
- SHA256 43af658ec1bec3036e5bf1c8eb427ba2ec830e98cf788992da343d32b7d6990f
- MD5 58d17b37dafa3288e2d5e924dcf9dccc
- SHA1 c02a7b3d5b586093dbfd6bffaedde62fd8e703e9
- SHA512 c358c46afb1744751925517b4cddb8004f0e95234890db7a89d279ea4bcca37a7312738af76e4c8933058b0619bbfdbe9f64478ce38b83d3c3adf693e672b527
- SSDEEP 12288:4bdfK6Qr8vaa81soeyezSC6v/ciLKK3kg5aqghpSy1TIPxTmqCLwKzu/T:4pi6La7/ezSC6vUyD/aqgrvWx6q8wyub
- TLSH T184450925F5B88333D0B2D0B9C5E66A9AFE7230425B3089CB4246976C3E277E6C535739
- MD5 SHA1 SHA512 SSDEEP TLSH