Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe
-
Size
484KB
-
MD5
05f95d3cf36891fc733800f3b3ffbfb4
-
SHA1
8897bcc054911642e637028acc5fa8ecafe517fb
-
SHA256
5079781bf327d46ca28fd70481c15bfb7d12b56f98465acae45759be47e424b1
-
SHA512
e5a6ffb1c6af27f0a9c6d6b7a10fecb406e268e0c4af6fadfb2e0e2a11f1e5577a72cb46c2046475af900a955f7969bd6f8e392d5cedf70a2a981d761288361f
-
SSDEEP
12288:XoUld/f2I9JECdYW4/e4Pii15XZSAmKjlafbdDNUQ:X92ILECd0R15XZS3QafpDNUQ
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" LB9c4j3K.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xuego.exe -
Deletes itself 1 IoCs
pid Process 640 cmd.exe -
Executes dropped EXE 8 IoCs
pid Process 2616 LB9c4j3K.exe 2584 xuego.exe 2332 aahost.exe 2456 aahost.exe 2088 bshost.exe 340 csrss.exe 1968 dyhost.exe 1684 ekhost.exe -
Loads dropped DLL 14 IoCs
pid Process 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 2616 LB9c4j3K.exe 2616 LB9c4j3K.exe 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 1684 ekhost.exe 1464 DllHost.exe -
resource yara_rule behavioral1/memory/2456-49-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2456-48-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2456-47-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2456-45-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2456-42-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2456-40-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2780-58-0x0000000000240000-0x0000000000284000-memory.dmp upx -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /i" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /m" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /J" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /y" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /T" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /K" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /q" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /N" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /n" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /E" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /Z" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /s" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /R" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /l" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /x" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /O" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /u" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /G" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /k" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /v" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /P" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /I" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /p" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /c" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /Y" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /b" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /j" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /r" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /X" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /V" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /k" LB9c4j3K.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /e" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /U" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /D" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /H" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /C" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /W" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /M" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /d" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /a" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /o" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /f" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /h" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /t" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /S" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /B" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /z" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /F" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /Q" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /w" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /A" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /L" xuego.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xuego = "C:\\Users\\Admin\\xuego.exe /g" xuego.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2332 set thread context of 2456 2332 aahost.exe 35 PID 2088 set thread context of 2112 2088 bshost.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates processes with tasklist 1 TTPs 3 IoCs
pid Process 2604 tasklist.exe 588 tasklist.exe 1276 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2616 LB9c4j3K.exe 2616 LB9c4j3K.exe 2456 aahost.exe 2088 bshost.exe 2088 bshost.exe 2088 bshost.exe 2088 bshost.exe 2584 xuego.exe 2584 xuego.exe 2456 aahost.exe 2584 xuego.exe 2584 xuego.exe 2584 xuego.exe 2456 aahost.exe 2584 xuego.exe 2456 aahost.exe 2456 aahost.exe 2584 xuego.exe 2584 xuego.exe 2584 xuego.exe 2456 aahost.exe 2584 xuego.exe 2456 aahost.exe 2456 aahost.exe 2584 xuego.exe 2584 xuego.exe 2584 xuego.exe 2456 aahost.exe 2456 aahost.exe 2584 xuego.exe 2456 aahost.exe 2584 xuego.exe 2456 aahost.exe 2456 aahost.exe 2584 xuego.exe 2456 aahost.exe 2584 xuego.exe 2456 aahost.exe 2584 xuego.exe 2456 aahost.exe 2584 xuego.exe 2456 aahost.exe 2584 xuego.exe 2456 aahost.exe 2456 aahost.exe 2584 xuego.exe 2456 aahost.exe 2584 xuego.exe 2456 aahost.exe 2584 xuego.exe 2584 xuego.exe 2456 aahost.exe 2456 aahost.exe 2456 aahost.exe 2584 xuego.exe 2456 aahost.exe 2456 aahost.exe 2456 aahost.exe 2584 xuego.exe 2584 xuego.exe 2584 xuego.exe 2456 aahost.exe 2456 aahost.exe 2456 aahost.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2604 tasklist.exe Token: SeDebugPrivilege 2088 bshost.exe Token: SeDebugPrivilege 2088 bshost.exe Token: SeDebugPrivilege 588 tasklist.exe Token: SeDebugPrivilege 1276 tasklist.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 2616 LB9c4j3K.exe 2584 xuego.exe 2332 aahost.exe 1968 dyhost.exe 1684 ekhost.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 340 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2616 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 28 PID 2780 wrote to memory of 2616 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 28 PID 2780 wrote to memory of 2616 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 28 PID 2780 wrote to memory of 2616 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 28 PID 2616 wrote to memory of 2584 2616 LB9c4j3K.exe 29 PID 2616 wrote to memory of 2584 2616 LB9c4j3K.exe 29 PID 2616 wrote to memory of 2584 2616 LB9c4j3K.exe 29 PID 2616 wrote to memory of 2584 2616 LB9c4j3K.exe 29 PID 2616 wrote to memory of 2452 2616 LB9c4j3K.exe 30 PID 2616 wrote to memory of 2452 2616 LB9c4j3K.exe 30 PID 2616 wrote to memory of 2452 2616 LB9c4j3K.exe 30 PID 2616 wrote to memory of 2452 2616 LB9c4j3K.exe 30 PID 2452 wrote to memory of 2604 2452 cmd.exe 32 PID 2452 wrote to memory of 2604 2452 cmd.exe 32 PID 2452 wrote to memory of 2604 2452 cmd.exe 32 PID 2452 wrote to memory of 2604 2452 cmd.exe 32 PID 2780 wrote to memory of 2332 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 34 PID 2780 wrote to memory of 2332 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 34 PID 2780 wrote to memory of 2332 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 34 PID 2780 wrote to memory of 2332 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 34 PID 2332 wrote to memory of 2456 2332 aahost.exe 35 PID 2332 wrote to memory of 2456 2332 aahost.exe 35 PID 2332 wrote to memory of 2456 2332 aahost.exe 35 PID 2332 wrote to memory of 2456 2332 aahost.exe 35 PID 2332 wrote to memory of 2456 2332 aahost.exe 35 PID 2332 wrote to memory of 2456 2332 aahost.exe 35 PID 2332 wrote to memory of 2456 2332 aahost.exe 35 PID 2332 wrote to memory of 2456 2332 aahost.exe 35 PID 2780 wrote to memory of 2088 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 36 PID 2780 wrote to memory of 2088 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 36 PID 2780 wrote to memory of 2088 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 36 PID 2780 wrote to memory of 2088 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 36 PID 2088 wrote to memory of 1180 2088 bshost.exe 21 PID 2088 wrote to memory of 340 2088 bshost.exe 2 PID 2088 wrote to memory of 2112 2088 bshost.exe 37 PID 2088 wrote to memory of 2112 2088 bshost.exe 37 PID 2088 wrote to memory of 2112 2088 bshost.exe 37 PID 2088 wrote to memory of 2112 2088 bshost.exe 37 PID 2088 wrote to memory of 2112 2088 bshost.exe 37 PID 2780 wrote to memory of 1968 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 39 PID 2780 wrote to memory of 1968 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 39 PID 2780 wrote to memory of 1968 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 39 PID 2780 wrote to memory of 1968 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 39 PID 2780 wrote to memory of 1684 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 40 PID 2780 wrote to memory of 1684 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 40 PID 2780 wrote to memory of 1684 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 40 PID 2780 wrote to memory of 1684 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 40 PID 340 wrote to memory of 1204 340 csrss.exe 41 PID 2780 wrote to memory of 640 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 42 PID 2780 wrote to memory of 640 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 42 PID 2780 wrote to memory of 640 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 42 PID 2780 wrote to memory of 640 2780 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe 42 PID 640 wrote to memory of 588 640 cmd.exe 44 PID 640 wrote to memory of 588 640 cmd.exe 44 PID 640 wrote to memory of 588 640 cmd.exe 44 PID 640 wrote to memory of 588 640 cmd.exe 44 PID 2584 wrote to memory of 588 2584 xuego.exe 44 PID 2584 wrote to memory of 588 2584 xuego.exe 44 PID 340 wrote to memory of 1464 340 csrss.exe 45 PID 340 wrote to memory of 2268 340 csrss.exe 46 PID 340 wrote to memory of 2268 340 csrss.exe 46 PID 340 wrote to memory of 2224 340 csrss.exe 47 PID 340 wrote to memory of 2224 340 csrss.exe 47 PID 1684 wrote to memory of 1692 1684 ekhost.exe 48
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:340
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:864
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵PID:2268
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\LB9c4j3K.exeC:\Users\Admin\LB9c4j3K.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\xuego.exe"C:\Users\Admin\xuego.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del LB9c4j3K.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
-
-
-
C:\Users\Admin\aahost.exeC:\Users\Admin\aahost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\aahost.exe"C:\Users\Admin\aahost.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2456
-
-
-
C:\Users\Admin\bshost.exeC:\Users\Admin\bshost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:2112
-
-
-
C:\Users\Admin\dyhost.exeC:\Users\Admin\dyhost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1968
-
-
C:\Users\Admin\ekhost.exeC:\Users\Admin\ekhost.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del ekhost.exe4⤵PID:1692
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1276
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 05f95d3cf36891fc733800f3b3ffbfb4_JaffaCakes118.exe3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:588
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1204
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
- Loads dropped DLL
PID:1464
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:2224
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140KB
MD593ea44e078cb0477614729636866a84b
SHA1f9752413d48fd98a77cfce8fff04a7a0d72c26d8
SHA256c16c3df8b6b4187e04a6abb49a15eb02ccefdce86068960ab3afeb088bf4ba27
SHA512351bafb9dc5395a9cd1393b76cba405312a5d85a59e5b1c0e891c2de1343b2bc2765a40077e4155fbd9a5578db3be66ace35e27ff02cb32f813ba01db4fc1113
-
Filesize
764KB
MD5e381b04abf596ed1573154cd41f418dc
SHA12ad1df7bebf1e4c0715adbf76c8c14b9162edf2e
SHA25602b08664fcc196f15ff0e33e7ed43e9e78af7b564e3f7c5388dd7d0267905fe6
SHA51244307e60bdc804b3abe710a21e2268960dcc9d29671cf8ce723e40721b6b38ae338c49cd1b9cfd4fa8fa4f644cc80414baeb70f136f39f73833f8373f8180858
-
Filesize
53KB
MD54d7cde615a0f534bd5e359951829554b
SHA1c885d00d9000f2a5dbc78f6193a052b36f4fe968
SHA256414fdf9bdcae5136c1295d6d24740c50a484acd81f1f7d0fb5d5c138607cb80a
SHA51233d632f9fbb694440a1ca568c90518784278efd1dc9ee2b57028149d56ebe1f7346d5b59dcfafee2eeaa10091dda05f48958e909d6bfc891e037ae1cfbd048d4
-
Filesize
2KB
MD55efa0f3ed6c37fe52385126cab0d9fbe
SHA1082afb8bccb8366106b29e729df868ed8fb26b56
SHA2567dc7d2122d3784e92bf1d05e03356397827caf61a56d03728d214e4e9c12b1c1
SHA5125d07cd34e0b0e43c824c764c839c71d03f23b34d775db24b4a1fefa60f2f541d6f696f76d6554f0011caeedd309ad074278e3ea45a0904a0f90b2f0637c9f4f9
-
Filesize
212KB
MD5fa0eb2a8b561ea9afc6a51709ff0d7de
SHA14ef5265f5b5bb1a4857e7668f132405c799da155
SHA25699ecfb1bb7cdb1e8dd609e60b10d5346b90284172c854b6234631212dd501c4f
SHA5120e8b194cb0e65429b84ac32a0fa131d072f7f425804df192d7a90a7ec6eb7ce9991716ce5a9ca3bcd106181076832d5fa7d6f9cbe67fc80a427ef7980beb75c6
-
Filesize
260KB
MD5bbc0a2fe1284778896b57ffc5701aefa
SHA16b9a0106b82c63265936ce728a858d258c8f6b14
SHA25692fad55bc5c7438d0f36501581b4b958efba2fbe5db02b97093a79b8a19645a0
SHA5128a17a1ed99a99a270191684b0337836531934b8717e78481815fd18767a172e6d7cf89488926dd2ea1b9e9ccaf53afd29c6925beaeb2fa7fa918be0e416be930
-
Filesize
48KB
MD5d46eb4bf816ed9978636de7955245323
SHA1c474df60a83302e0d010d11dcebd7cdb3cc22866
SHA2562ae9b936feeade89c9074c379efedd21d15a1cf247207afe5381f437e41ca4bd
SHA512e46a604a96345b1b6800cb22c8c870dfa62dbdd8bd5b6ff43ddce9b080d1af180db498dad23561c0116b4dadbc44617b26840e67bc0afde01439e4c70632d7ef
-
Filesize
24KB
MD59fe0e5252dc24fc1788b0d8b26026807
SHA121e3063a0fac1157b9707861048c5f7fbd070ceb
SHA2569c99c968d969c2d5c1570c6066957d726bc19ffe9e0562242ce1bf79514c1b40
SHA512613f5c821dfcef8124ecb7c9b118cda14be4d72a26f1a21ffde81c4d8aae4f315740d66c298e5963b0647f0ecd9e2d63d9bbb8df4e0c731019896e7ac0391d5c
-
Filesize
212KB
MD593f29666dddb72ab2e47c5ede809bd14
SHA1ca8d2edb6a7991b7ce319d056c6cb292684f4941
SHA256813a572160d6332a1df92b5208e5bfe420feef4bbd997c186b35df98f3990478
SHA512cb039fb1a907a3b56e8d20ab078fd9abc68edc6d03450e6fab709d4f3be4d64f74b561fdc15f86243e0db0612b9f7954bc9ab247dc2633ebdaff657bbe443f0b
-
Filesize
4KB
MD5878f9b6da85cb98fcbdf6abd1730a32f
SHA1343007e658ea541f4680b4edf4513e69e1cc18a6
SHA25675b5a460ed6f47fca8ec1bcd8a11b22f24fb33de4d5f307b851ad20c7f831b7d
SHA5125425844e34ad5e717b08830020526f5c9465f654f3e9e29967b2983d5cb8dc225be2b89cd29a8e4cc99fcfc99e05556f66eefa0539283ab4569e603413a37293
-
Filesize
5KB
MD59d7ec1e355ac35cbe6991721ef5ae3b8
SHA1c35a00bd35c6e4a7516b93947be08ead966347e8
SHA25668a3cec42215323100398a8eb2cbb37da7d58fe0fa9c6312e954e0f50a95ca98
SHA512b7c4be28d8e179974672205a50e72fa1ec9e2e8170b3b8ee763e1751a3397c35afec7a72c88f0a79a8566749b2af1ff054660a96c3a6d6508c545d316a035dc0