Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 14:46
Static task
static1
Behavioral task
behavioral1
Sample
e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe
-
Size
127KB
-
MD5
e2c610a8dc66be4914ef40cc90fd26c1
-
SHA1
4ff62851b7e7b101c7e63e5fd63312f7a4baba23
-
SHA256
c065e85103fef84d4c006b7c564871c4b998d87e3e3a5537eb3fd3de1ebdd9cc
-
SHA512
bab0fcebd69387a4a50d07747e8f3d4e2e3e438eb89d428c6aaef1eaa4b9ad148279bab1483d89cfde3887da287bf90b260895c604da54f0acb5d9c6114cd8ff
-
SSDEEP
3072:U09K6zz00dhADwdZxn7z1itdQ8GyzBcIG274bZhzQmeCrg34bfkg:xBdP/As8GyzBT4Zhjecg3UM
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3568 trivax1.Bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1440-3-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3568-14-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/1440-36-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3568-111-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\trivax1.Bin.exe = "C:\\trivax1.Bin\\trivax1.Bin.exe" trivax1.Bin.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Internet Explorer\PhishingFilter trivax1.Bin.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" trivax1.Bin.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ShownServiceDownBalloon = "0" trivax1.Bin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Software\Microsoft\Internet Explorer\Recovery trivax1.Bin.exe Set value (int) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\ClearBrowsingHistoryOnExit = "0" trivax1.Bin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe 3568 trivax1.Bin.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe Token: SeDebugPrivilege 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe Token: SeDebugPrivilege 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe Token: SeDebugPrivilege 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe Token: SeDebugPrivilege 3568 trivax1.Bin.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1440 wrote to memory of 3528 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 57 PID 1440 wrote to memory of 624 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 5 PID 1440 wrote to memory of 684 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 7 PID 1440 wrote to memory of 792 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 8 PID 1440 wrote to memory of 800 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 9 PID 1440 wrote to memory of 808 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 10 PID 1440 wrote to memory of 908 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 11 PID 1440 wrote to memory of 960 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 12 PID 1440 wrote to memory of 60 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 13 PID 1440 wrote to memory of 396 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 14 PID 1440 wrote to memory of 700 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 15 PID 1440 wrote to memory of 1040 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 16 PID 1440 wrote to memory of 1048 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 17 PID 1440 wrote to memory of 1056 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 18 PID 1440 wrote to memory of 1064 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 19 PID 1440 wrote to memory of 1188 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 20 PID 1440 wrote to memory of 1224 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 21 PID 1440 wrote to memory of 1268 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 22 PID 1440 wrote to memory of 1336 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 23 PID 1440 wrote to memory of 1396 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 24 PID 1440 wrote to memory of 1448 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 25 PID 1440 wrote to memory of 1472 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 26 PID 1440 wrote to memory of 1484 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 27 PID 1440 wrote to memory of 1508 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 28 PID 1440 wrote to memory of 1596 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 29 PID 1440 wrote to memory of 1668 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 30 PID 1440 wrote to memory of 1720 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 31 PID 1440 wrote to memory of 1784 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 32 PID 1440 wrote to memory of 1876 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 33 PID 1440 wrote to memory of 1976 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 34 PID 1440 wrote to memory of 1984 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 35 PID 1440 wrote to memory of 1756 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 36 PID 1440 wrote to memory of 1912 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 37 PID 1440 wrote to memory of 2068 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 38 PID 1440 wrote to memory of 2124 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 39 PID 1440 wrote to memory of 2168 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 40 PID 1440 wrote to memory of 2240 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 41 PID 1440 wrote to memory of 2348 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 42 PID 1440 wrote to memory of 2484 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 43 PID 1440 wrote to memory of 2492 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 44 PID 1440 wrote to memory of 2696 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 45 PID 1440 wrote to memory of 2732 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 46 PID 1440 wrote to memory of 2752 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 47 PID 1440 wrote to memory of 2800 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 48 PID 1440 wrote to memory of 2812 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 49 PID 1440 wrote to memory of 2840 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 50 PID 1440 wrote to memory of 2848 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 51 PID 1440 wrote to memory of 2936 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 52 PID 1440 wrote to memory of 388 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 53 PID 1440 wrote to memory of 2928 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 54 PID 1440 wrote to memory of 3444 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 56 PID 1440 wrote to memory of 3528 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 57 PID 1440 wrote to memory of 3680 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 58 PID 1440 wrote to memory of 3864 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 59 PID 1440 wrote to memory of 4004 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 60 PID 1440 wrote to memory of 4076 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 61 PID 1440 wrote to memory of 1356 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 62 PID 1440 wrote to memory of 4016 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 63 PID 1440 wrote to memory of 2440 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 65 PID 1440 wrote to memory of 4224 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 68 PID 1440 wrote to memory of 4472 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 69 PID 1440 wrote to memory of 1480 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 70 PID 1440 wrote to memory of 5028 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 71 PID 1440 wrote to memory of 4344 1440 e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe 72
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:624
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:792
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:60
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:684
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:808
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:2928
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3864
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:4004
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4076
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:1356
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4016
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:2440
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:5028
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:4672
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵PID:4144
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe2⤵PID:4440
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:972
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:32
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:64
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding2⤵PID:4392
-
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding2⤵PID:3596
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc1⤵PID:700
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1040
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1048
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1056
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1064
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1188
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2936
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1224
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1268
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1448
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1508
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2696
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1596
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1668
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1720
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1784
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1876
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1976
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1984
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1756
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:1912
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2068
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2168
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2240
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2348
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2492
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2732
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2752
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2800
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2812
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2840
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:388
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3444
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e2c610a8dc66be4914ef40cc90fd26c1_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\trivax1.Bin\trivax1.Bin.exe"C:\trivax1.Bin\trivax1.Bin.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3680
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:4224
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:4472
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:4344
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4764
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:4412
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:1560
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 5737bb2e655e283517c3e784f92845f8 s0gY+OTzDEKHMLrlCGNZVw.0.1.0.0.01⤵PID:4388
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:1504
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:1736
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:2528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:1968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD5e2c610a8dc66be4914ef40cc90fd26c1
SHA14ff62851b7e7b101c7e63e5fd63312f7a4baba23
SHA256c065e85103fef84d4c006b7c564871c4b998d87e3e3a5537eb3fd3de1ebdd9cc
SHA512bab0fcebd69387a4a50d07747e8f3d4e2e3e438eb89d428c6aaef1eaa4b9ad148279bab1483d89cfde3887da287bf90b260895c604da54f0acb5d9c6114cd8ff