Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 13:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe
-
Size
140KB
-
MD5
162c4353341d051b56846e3ba5bfe3f7
-
SHA1
cc954332519cdf44aa3d0f41713099d9c875e7d6
-
SHA256
34afc45610acd3da38d3e0dce2188c4e497e022c4a9c682835e1d0dad8db3377
-
SHA512
3e542b971cfb84465e70ae13c0ba93e8582aaab429982ff6eed106e5801ba2e563fd8c107baa9081adc602b120ed7362dc9cd3f5c58bbf22b36a05bb9e636832
-
SSDEEP
1536:YPqQV/AQGO9pfU+TGTrhfMgVatRsa6FFjbsg0vea52eGs7Wcp0yJGmhZoJb1i+:bPYp5TGvlM9D0+7ea5FoyJxoXi+
Score
10/10
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" ceryfcs.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" ceryfcs.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ceryfcs.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP_1.kxp ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AST.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NPFMntor.exe ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPF.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctor.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\upiea.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KsLoader.exe ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\irsetup.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\upiea.exe ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQSC.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscanx.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQKav.exe ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AST.exe ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvDetect.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shcfg32.exe ceryfcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe\Debugger = "C:\\Program Files\\Common Files\\Microsoft Shared\\axngnwx.exe" ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe ceryfcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe ceryfcs.exe -
Deletes itself 1 IoCs
pid Process 2624 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2188 ceryfcs.exe 2388 axngnwx.exe -
Loads dropped DLL 4 IoCs
pid Process 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 42 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: axngnwx.exe File opened (read-only) \??\y: axngnwx.exe File opened (read-only) \??\h: ceryfcs.exe File opened (read-only) \??\l: ceryfcs.exe File opened (read-only) \??\y: ceryfcs.exe File opened (read-only) \??\i: axngnwx.exe File opened (read-only) \??\t: axngnwx.exe File opened (read-only) \??\m: ceryfcs.exe File opened (read-only) \??\x: ceryfcs.exe File opened (read-only) \??\m: axngnwx.exe File opened (read-only) \??\j: axngnwx.exe File opened (read-only) \??\z: axngnwx.exe File opened (read-only) \??\q: ceryfcs.exe File opened (read-only) \??\w: ceryfcs.exe File opened (read-only) \??\z: ceryfcs.exe File opened (read-only) \??\g: axngnwx.exe File opened (read-only) \??\l: axngnwx.exe File opened (read-only) \??\r: axngnwx.exe File opened (read-only) \??\e: ceryfcs.exe File opened (read-only) \??\i: ceryfcs.exe File opened (read-only) \??\o: ceryfcs.exe File opened (read-only) \??\s: ceryfcs.exe File opened (read-only) \??\v: ceryfcs.exe File opened (read-only) \??\e: axngnwx.exe File opened (read-only) \??\o: axngnwx.exe File opened (read-only) \??\u: axngnwx.exe File opened (read-only) \??\v: axngnwx.exe File opened (read-only) \??\t: ceryfcs.exe File opened (read-only) \??\n: axngnwx.exe File opened (read-only) \??\q: axngnwx.exe File opened (read-only) \??\x: axngnwx.exe File opened (read-only) \??\n: ceryfcs.exe File opened (read-only) \??\r: ceryfcs.exe File opened (read-only) \??\k: axngnwx.exe File opened (read-only) \??\s: axngnwx.exe File opened (read-only) \??\w: axngnwx.exe File opened (read-only) \??\g: ceryfcs.exe File opened (read-only) \??\j: ceryfcs.exe File opened (read-only) \??\k: ceryfcs.exe File opened (read-only) \??\p: ceryfcs.exe File opened (read-only) \??\u: ceryfcs.exe File opened (read-only) \??\h: axngnwx.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\c:\autorun.inf ceryfcs.exe File created \??\c:\autorun.inf ceryfcs.exe File opened for modification \??\f:\autorun.inf ceryfcs.exe File created \??\f:\autorun.inf ceryfcs.exe -
Drops file in Program Files directory 26 IoCs
description ioc Process File opened for modification C:\Program Files\dld.dat ceryfcs.exe File created C:\Program Files\2Bhosts.exe axngnwx.exe File created C:\Program Files\3CWindowsXP-KB284302.exe axngnwx.exe File created C:\Program Files\Common Files\System\ceryfcs.exe 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\axngnwx.exe axngnwx.exe File opened for modification C:\Program Files\meex.exe axngnwx.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared ceryfcs.exe File created C:\Program Files\3.hiv axngnwx.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\axngnwx.exe 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\axngnwx.exe 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe File created C:\Program Files\1.hiv ceryfcs.exe File opened for modification C:\Program Files\Common Files\System\gtlrunx.inf ceryfcs.exe File created C:\Program Files\5EWindowsXP-KB284304.exe axngnwx.exe File created C:\Program Files\2.hiv ceryfcs.exe File opened for modification C:\Program Files\Common Files\System ceryfcs.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\axngnwx.exe ceryfcs.exe File created C:\Program Files\4DWindowsXP-KB284303.exe axngnwx.exe File opened for modification C:\Program Files\Common Files\System\ceryfcs.exe 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe File created C:\Program Files\meex.exe axngnwx.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\gtlrunx.inf axngnwx.exe File created C:\Program Files\1AWindowsXP-KB284301.exe axngnwx.exe File opened for modification C:\Program Files\Common Files\System\ceryfcs.exe axngnwx.exe File created C:\Program Files\Common Files\System\gtlrunx.inf ceryfcs.exe File created C:\Program Files\4.hiv axngnwx.exe File opened for modification C:\Program Files\Common Files\System\ceryfcs.exe ceryfcs.exe File created C:\Program Files\Common Files\Microsoft Shared\gtlrunx.inf axngnwx.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe 2388 axngnwx.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2188 ceryfcs.exe Token: SeRestorePrivilege 2188 ceryfcs.exe Token: SeBackupPrivilege 2188 ceryfcs.exe Token: SeRestorePrivilege 2188 ceryfcs.exe Token: SeBackupPrivilege 2388 axngnwx.exe Token: SeRestorePrivilege 2388 axngnwx.exe Token: SeBackupPrivilege 2388 axngnwx.exe Token: SeRestorePrivilege 2388 axngnwx.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe 2188 ceryfcs.exe 2388 axngnwx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2188 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 28 PID 2168 wrote to memory of 2188 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 28 PID 2168 wrote to memory of 2188 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 28 PID 2168 wrote to memory of 2188 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 28 PID 2168 wrote to memory of 2388 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 29 PID 2168 wrote to memory of 2388 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 29 PID 2168 wrote to memory of 2388 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 29 PID 2168 wrote to memory of 2388 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 29 PID 2168 wrote to memory of 2728 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 30 PID 2168 wrote to memory of 2728 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 30 PID 2168 wrote to memory of 2728 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 30 PID 2168 wrote to memory of 2728 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 30 PID 2168 wrote to memory of 2744 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 31 PID 2168 wrote to memory of 2744 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 31 PID 2168 wrote to memory of 2744 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 31 PID 2168 wrote to memory of 2744 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 31 PID 2168 wrote to memory of 2640 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 33 PID 2168 wrote to memory of 2640 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 33 PID 2168 wrote to memory of 2640 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 33 PID 2168 wrote to memory of 2640 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 33 PID 2168 wrote to memory of 2624 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 34 PID 2168 wrote to memory of 2624 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 34 PID 2168 wrote to memory of 2624 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 34 PID 2168 wrote to memory of 2624 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 34 PID 2168 wrote to memory of 2804 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 37 PID 2168 wrote to memory of 2804 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 37 PID 2168 wrote to memory of 2804 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 37 PID 2168 wrote to memory of 2804 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 37 PID 2168 wrote to memory of 2896 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 39 PID 2168 wrote to memory of 2896 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 39 PID 2168 wrote to memory of 2896 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 39 PID 2168 wrote to memory of 2896 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 39 PID 2168 wrote to memory of 2632 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 40 PID 2168 wrote to memory of 2632 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 40 PID 2168 wrote to memory of 2632 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 40 PID 2168 wrote to memory of 2632 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 40 PID 2168 wrote to memory of 2808 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 41 PID 2168 wrote to memory of 2808 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 41 PID 2168 wrote to memory of 2808 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 41 PID 2168 wrote to memory of 2808 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 41 PID 2168 wrote to memory of 2544 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 43 PID 2168 wrote to memory of 2544 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 43 PID 2168 wrote to memory of 2544 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 43 PID 2168 wrote to memory of 2544 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 43 PID 2168 wrote to memory of 3008 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 44 PID 2168 wrote to memory of 3008 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 44 PID 2168 wrote to memory of 3008 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 44 PID 2168 wrote to memory of 3008 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 44 PID 2168 wrote to memory of 2688 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 46 PID 2168 wrote to memory of 2688 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 46 PID 2168 wrote to memory of 2688 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 46 PID 2168 wrote to memory of 2688 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 46 PID 2168 wrote to memory of 2572 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 49 PID 2168 wrote to memory of 2572 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 49 PID 2168 wrote to memory of 2572 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 49 PID 2168 wrote to memory of 2572 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 49 PID 2168 wrote to memory of 2536 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 51 PID 2168 wrote to memory of 2536 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 51 PID 2168 wrote to memory of 2536 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 51 PID 2168 wrote to memory of 2536 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 51 PID 2168 wrote to memory of 2568 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 52 PID 2168 wrote to memory of 2568 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 52 PID 2168 wrote to memory of 2568 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 52 PID 2168 wrote to memory of 2568 2168 162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe 52 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "145" ceryfcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files\Common Files\System\ceryfcs.exe"C:\Program Files\Common Files\System\ceryfcs.exe"2⤵
- Modifies security service
- Modifies visiblity of hidden/system files in Explorer
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- System policy modification
PID:2188
-
-
C:\Program Files\Common Files\Microsoft Shared\axngnwx.exe"C:\Program Files\Common Files\Microsoft Shared\axngnwx.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2388
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2728
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2744
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2640
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵
- Deletes itself
PID:2624
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2804
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2896
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2632
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2808
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2544
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:3008
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2688
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2572
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2536
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2568
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2588
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2228
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:3032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:1800
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:1264
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2616
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2836
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2756
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2868
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\162c4353341d051b56846e3ba5bfe3f7_JaffaCakes118.exe"2⤵PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88B
MD5bcd8edb015ddc9e31e8e1b4657c3df43
SHA1d320e044bc0ed73e557a885a1a47714b8c85200e
SHA25637646c67c0e8429e6fbfc56678a20fd311cb48d0cb19bb5097078968f0673f37
SHA5122a1497b35930c516a0f5bf75be460eff986b08d2ed0331dd702be5533b88198a59a41f39252809ef83b455bcf4d07ab0d9723494e8008a9578d0509a643cd6cc
-
Filesize
140KB
MD5162c4353341d051b56846e3ba5bfe3f7
SHA1cc954332519cdf44aa3d0f41713099d9c875e7d6
SHA25634afc45610acd3da38d3e0dce2188c4e497e022c4a9c682835e1d0dad8db3377
SHA5123e542b971cfb84465e70ae13c0ba93e8582aaab429982ff6eed106e5801ba2e563fd8c107baa9081adc602b120ed7362dc9cd3f5c58bbf22b36a05bb9e636832
-
Filesize
169B
MD597ef95b3768e84a09bb60f7122947d97
SHA1de692b4087b65477916a9b78a8354e0e67f986d0
SHA256e79be8b1b38b506013c39f826fc63dd6c1d835443460ef297dcf86a12fa42012
SHA512765c04440b0a0e8ee6d26657d4d1923c87ec86668bbd0b4c85d6fc821f9b118ec412c63b95b9adc5ca53a0374d553a00f67159460b5ecbdcf55b0452fee2fbf4