Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

01428ce411...18.exe

windows7-x64

10

01428ce411...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    154s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/06/2024, 23:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    01428ce4113dc16b028db712cc0adbc7_JaffaCakes118.exe

  • Size

    127KB

  • MD5

    01428ce4113dc16b028db712cc0adbc7

  • SHA1

    440212bb29e6f8a76be987a0fe6e5a1bdef840f3

  • SHA256

    d09e269588b123102a1c3a75af3350a00836d55e75987931511b1769e626f5bc

  • SHA512

    b6eb9fcb44669295b0bca67ad0ebd9f57d77dbd47b7e60cd3077b9f5457735fb2be6e53ce17dca394f737ad3fe45c1ed20a87066f45824454ae6c00006c01682

  • SSDEEP

    1536:jamlu3hbBGy3G8nhMpD7MUYU6U5jUdPQc+n35KZg8/nouy8Iu:jreMPd/MYjUtQl78vout

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • UAC bypass 3 TTPs 6 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies system executable filetype association 2 TTPs 8 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 31 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 48 IoCs
  • Runs ping.exe 1 TTPs 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\01428ce4113dc16b028db712cc0adbc7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\01428ce4113dc16b028db712cc0adbc7_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Users\Admin\AppData\Local\Temp\01428ce4113dc16b028db712cc0adbc7_JaffaCakes118.exe 
      C:\Users\Admin\AppData\Local\Temp\01428ce4113dc16b028db712cc0adbc7_JaffaCakes118.exe 
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • UAC bypass
      • Disables RegEdit via registry modification
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3480
      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3812
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • UAC bypass
          • Disables RegEdit via registry modification
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2000
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system executable filetype association
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2376
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:1676
            • \??\c:\Documents and Settings\Admin\Application Data\Microsoft\ascg.exe
              "c:\Documents and Settings\Admin\Application Data\Microsoft\ascg.exe" csrss
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Enumerates connected drives
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:3112
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3456
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
              6⤵
              • Modifies WinLogon for persistence
              • Modifies visibility of file extensions in Explorer
              • Modifies visiblity of hidden/system files in Explorer
              • UAC bypass
              • Disables RegEdit via registry modification
              • Event Triggered Execution: Image File Execution Options Injection
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies system executable filetype association
              • Adds Run key to start application
              • Checks whether UAC is enabled
              • Drops file in System32 directory
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2176
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3292
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:4148
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4856
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:2708
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:824
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                  8⤵
                  • Modifies WinLogon for persistence
                  • Modifies visibility of file extensions in Explorer
                  • Modifies visiblity of hidden/system files in Explorer
                  • UAC bypass
                  • Disables RegEdit via registry modification
                  • Event Triggered Execution: Image File Execution Options Injection
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • Checks whether UAC is enabled
                  • Drops file in System32 directory
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:1304
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2732
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetWindowsHookEx
                      PID:3104
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:3264
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetWindowsHookEx
                      PID:1016
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2364
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetWindowsHookEx
                      PID:4208
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • Suspicious use of SetWindowsHookEx
                    PID:1436
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                      10⤵
                      • Modifies WinLogon for persistence
                      • Modifies visibility of file extensions in Explorer
                      • Modifies visiblity of hidden/system files in Explorer
                      • UAC bypass
                      • Disables RegEdit via registry modification
                      • Event Triggered Execution: Image File Execution Options Injection
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Modifies system executable filetype association
                      • Adds Run key to start application
                      • Checks whether UAC is enabled
                      • Drops file in System32 directory
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:4480
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetWindowsHookEx
                        PID:2144
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetWindowsHookEx
                          PID:224
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetWindowsHookEx
                        PID:1376
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetWindowsHookEx
                          PID:904
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in System32 directory
                        • Suspicious use of SetWindowsHookEx
                        PID:548
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetWindowsHookEx
                          PID:1708
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in System32 directory
                        • Suspicious use of SetWindowsHookEx
                        PID:1776
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetWindowsHookEx
                          PID:4632
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in System32 directory
                        • Suspicious use of SetWindowsHookEx
                        PID:3776
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetWindowsHookEx
                          PID:1636
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetWindowsHookEx
                        PID:3624
                      • C:\Windows\SysWOW64\rundll32.exe
                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                        11⤵
                        • Suspicious use of FindShellTrayWindow
                        PID:736
                      • C:\Windows\SysWOW64\ping.exe
                        ping www.duniasex.com -n 65500 -l 1340
                        11⤵
                        • Runs ping.exe
                        PID:4440
                      • C:\Windows\SysWOW64\ping.exe
                        ping www.data0.net -n 65500 -l 1340
                        11⤵
                        • Runs ping.exe
                        PID:4672
                      • C:\Windows\SysWOW64\ping.exe
                        ping www.rasasayang.com.my -n 65500 -l 1340
                        11⤵
                        • Runs ping.exe
                        PID:1724
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                    9⤵
                    • Loads dropped DLL
                    PID:2264
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                      10⤵
                      • Loads dropped DLL
                      PID:1736
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                    9⤵
                      PID:3176
                    • C:\Windows\SysWOW64\rundll32.exe
                      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                      9⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:4976
                    • C:\Windows\SysWOW64\ping.exe
                      ping www.duniasex.com -n 65500 -l 1340
                      9⤵
                      • Runs ping.exe
                      PID:3196
                    • C:\Windows\SysWOW64\ping.exe
                      ping www.data0.net -n 65500 -l 1340
                      9⤵
                      • Runs ping.exe
                      PID:4468
                    • C:\Windows\SysWOW64\ping.exe
                      ping www.rasasayang.com.my -n 65500 -l 1340
                      9⤵
                      • Runs ping.exe
                      PID:1992
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:1584
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    PID:4516
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:872
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    PID:1160
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4332
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                  7⤵
                  • Suspicious use of FindShellTrayWindow
                  PID:1708
                • C:\Windows\SysWOW64\ping.exe
                  ping www.duniasex.com -n 65500 -l 1340
                  7⤵
                  • Runs ping.exe
                  PID:2508
                • C:\Windows\SysWOW64\ping.exe
                  ping www.data0.net -n 65500 -l 1340
                  7⤵
                  • Runs ping.exe
                  PID:3464
                • C:\Windows\SysWOW64\ping.exe
                  ping www.rasasayang.com.my -n 65500 -l 1340
                  7⤵
                  • Runs ping.exe
                  PID:2364
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2508
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:2720
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Suspicious use of SetWindowsHookEx
              PID:4780
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:3028
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Suspicious use of SetWindowsHookEx
              PID:4644
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:2184
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2928
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
              5⤵
              • Suspicious use of FindShellTrayWindow
              PID:5040
            • C:\Windows\SysWOW64\ping.exe
              ping www.duniasex.com -n 65500 -l 1340
              5⤵
              • Runs ping.exe
              PID:3456
            • C:\Windows\SysWOW64\ping.exe
              ping www.data0.net -n 65500 -l 1340
              5⤵
              • Runs ping.exe
              PID:4108
            • C:\Windows\SysWOW64\ping.exe
              ping www.rasasayang.com.my -n 65500 -l 1340
              5⤵
              • Runs ping.exe
              PID:3028
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4516
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:3224
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:5068
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:1620
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious use of SetWindowsHookEx
          PID:2636
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:872
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious use of SetWindowsHookEx
          PID:4904
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
            4⤵
            • Modifies WinLogon for persistence
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Disables RegEdit via registry modification
            • Event Triggered Execution: Image File Execution Options Injection
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system executable filetype association
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in System32 directory
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1676
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\csrss.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Suspicious use of SetWindowsHookEx
              PID:4976
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe 
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:5116
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\smss.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Suspicious use of SetWindowsHookEx
              PID:3108
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\smss.exe 
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:2956
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\lsass.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2284
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\lsass.exe 
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:1428
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\services.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Suspicious use of SetWindowsHookEx
              PID:1176
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\services.exe 
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:3908
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\winlogon.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2876
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe 
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:2092
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:4156
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
              5⤵
              • Suspicious use of FindShellTrayWindow
              PID:4512
            • C:\Windows\SysWOW64\ping.exe
              ping www.duniasex.com -n 65500 -l 1340
              5⤵
              • Runs ping.exe
              PID:1288
            • C:\Windows\SysWOW64\ping.exe
              ping www.data0.net -n 65500 -l 1340
              5⤵
              • Runs ping.exe
              PID:2432
            • C:\Windows\SysWOW64\ping.exe
              ping www.rasasayang.com.my -n 65500 -l 1340
              5⤵
              • Runs ping.exe
              PID:4740
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~\Paraysutki_VM_Community
          3⤵
          • Drops file in System32 directory
          PID:1776
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
          3⤵
          • Suspicious use of FindShellTrayWindow
          PID:2172
        • C:\Windows\SysWOW64\ping.exe
          ping www.duniasex.com -n 65500 -l 1340
          3⤵
          • Runs ping.exe
          PID:4652
        • C:\Windows\SysWOW64\ping.exe
          ping www.data0.net -n 65500 -l 1340
          3⤵
          • Runs ping.exe
          PID:464
        • C:\Windows\SysWOW64\ping.exe
          ping www.rasasayang.com.my -n 65500 -l 1340
          3⤵
          • Runs ping.exe
          PID:4352
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3488 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:4524

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Event Triggered Execution

      2
      T1546

      Change Default File Association

      1
      T1546.001

      Image File Execution Options Injection

      1
      T1546.012

      Privilege Escalation

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Event Triggered Execution

      2
      T1546

      Change Default File Association

      1
      T1546.001

      Image File Execution Options Injection

      1
      T1546.012

      Defense Evasion

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Hide Artifacts

      2
      T1564

      Hidden Files and Directories

      2
      T1564.001

      Impair Defenses

      1
      T1562

      Disable or Modify Tools

      1
      T1562.001

      Modify Registry

      8
      T1112

      Credential Access

      Discovery

      Peripheral Device Discovery

      1
      T1120

      Query Registry

      1
      T1012

      Remote System Discovery

      1
      T1018

      System Information Discovery

      3
      T1082

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Inhibit System Recovery

      1
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\01428ce4113dc16b028db712cc0adbc7_JaffaCakes118.exe 
        Filesize

        50KB

        MD5

        69beac0954c38e170a6db8c50fe6a055

        SHA1

        2b16d43fa9c5d042a030b9267846cf254d47da75

        SHA256

        2f850319eb8dcefbd7d7c2f405c9b5a9e76ca7ebda34751017e2f23c01a00e8e

        SHA512

        c219d6d014898394116b1b19ac330143396af470198334f01b2944049b5bb9fe2c5febfcb040ff6ed2e75416908b7089ff0261b7c7c2029a60c3cae8a01666a1

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\ascg.exe
        Filesize

        76KB

        MD5

        b6699adb3f80ba8fb5970579a17e4485

        SHA1

        8b1d979c51a0a4cb0167ca23edf7dfbb3f043ce6

        SHA256

        df78609b9ac9e1725a3822336159658ea4f7ac378300cb58ffba8cae173bdab3

        SHA512

        3df063dc6e6001b7d3b4bf51833681c6a5dba8aa47c23c13422b073863ed5588cd43b4a32d82201fe32878c5c94ae6c67735b8ae549ad67bd4685a6ebfd2e10b

        Download Submit

      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\MSVBVM60.DLL
        Filesize

        1.4MB

        MD5

        25f62c02619174b35851b0e0455b3d94

        SHA1

        4e8ee85157f1769f6e3f61c0acbe59072209da71

        SHA256

        898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

        SHA512

        f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

        Download Submit

      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\csrss.exe
        Filesize

        127KB

        MD5

        b7561334a03cbcfbf3c598f1d1b4d08f

        SHA1

        55174703a9e97c191f3c8fe7dde764135d92012d

        SHA256

        56557c49d5470599a3d65a25759708bd5011f27640cc65242b40fc3666839ab9

        SHA512

        67c24a01431290e6da5c8ebd76c7961b8986ab93dee69a7a16481039c63fe540f69da92f7b6fbeeeb9cced4d05691f68ca32b402bcf2635cfb0e0b0b154dbdb0

        Download Submit

      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
        Filesize

        127KB

        MD5

        01428ce4113dc16b028db712cc0adbc7

        SHA1

        440212bb29e6f8a76be987a0fe6e5a1bdef840f3

        SHA256

        d09e269588b123102a1c3a75af3350a00836d55e75987931511b1769e626f5bc

        SHA512

        b6eb9fcb44669295b0bca67ad0ebd9f57d77dbd47b7e60cd3077b9f5457735fb2be6e53ce17dca394f737ad3fe45c1ed20a87066f45824454ae6c00006c01682

        Download Submit

      • \??\c:\windows\SysWOW64\maxtrox.txt
        Filesize

        8B

        MD5

        24865ca220aa1936cbac0a57685217c5

        SHA1

        37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

        SHA256

        841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

        SHA512

        c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

        Download Submit

      • memory/224-253-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/872-255-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/904-262-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1016-197-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1016-201-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1160-378-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1304-269-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1304-404-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1428-312-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1620-237-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1636-314-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1676-406-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1676-359-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1676-93-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1708-278-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1736-390-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2000-403-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2000-210-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2092-345-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2176-244-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2176-408-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2184-362-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2184-368-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2708-162-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2720-331-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2720-334-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2956-299-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/3028-346-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/3104-188-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/3112-417-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/3112-427-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/3112-425-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/3112-243-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/3112-418-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/3112-413-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/3112-414-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/3112-426-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/3112-394-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/3112-416-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/3112-415-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/3224-227-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/3480-145-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/3480-412-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/3480-7-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/3908-328-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4148-150-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4148-146-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4208-217-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4480-410-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4480-308-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4516-366-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4632-292-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/5116-287-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download