Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 19:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe
-
Size
160KB
-
MD5
5d5be7dd142dc8db0ca31fa92a11679d
-
SHA1
e94fbbe3a30ada943bdf659ae3866ad63c1477c6
-
SHA256
27080635d1991d91b96301df10aed3a4de691b92bbbfd8edfba5c7067ae695be
-
SHA512
d25dedb40bb5395aae14ff3564710fb176eb7d2742f7998d81bd229a48ff193f65a723278b6f9459e037a9b2b4c96788642587666d92d75f3adb1d59befdcdcb
-
SSDEEP
1536:MEBNxaGXzoe8MBZXLXSaDgN6VqttfQ84dFj5OeZedavR5O8wtpCnRKVgbAxr4a6:MeyGXpDrVt8aAda0SBd
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "1" svchost.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts svchost.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwin95.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nisserv.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfgwiz.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defalert.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHttpSrv.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsetup.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvlaunch.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpostinstall.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\syshelp.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet32.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccevtmgr.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppinupdt.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apvxdwin.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guarddog.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rescue.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcm.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcciomon.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup_flowprotector_us.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\advxdwin.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530wtbyb.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmor.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msinfo32.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsave32.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccguide.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wradmin.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fact.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\minilog.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\protectx.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tauscan.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds-3.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HostsChk.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEDFix.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmon016.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nav32_loader.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-nt.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsisetup.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updater.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esafe.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamapp.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldscan.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nprotect.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\programauditor.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup_flowprotector_us.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirus.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-prot95.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssmmc32.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nai_vs_stat.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pccguide.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monsysnt.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmon.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcmserv.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcleaner.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkserv.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\callmsi.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccshtdwn.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npf40_tw_98_nt_me_2k.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trojantrap3.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cpf9x206.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\css1631.exe svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2172 winlogon.exe -
Loads dropped DLL 2 IoCs
pid Process 1992 5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe 1992 5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\NVIDIA Media Center Library = "C:\\Users\\Admin\\Admin1\\winlogon.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NVIDIA Media Center Library = "C:\\Users\\Admin\\Admin1\\winlogon.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2172 set thread context of 2812 2172 winlogon.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://9-y-j-5-8-6-7-y-.7-8-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info/7-g-g-3-b-h-6-0-4-2-k-5-q-w-4-d-w-f-6-8-7-h-k-7-l-3-" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://k-8-m-s-.f-3-h-5-w-m-k-6-y-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info/4-r-d-g-3-1-i-3-1-7-0-c-b-k-8-8-1-q-5-u-1-l-0-m-9-2-3-6-b-a-3-" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://x-y.-4-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info/g-0-9-1-j-i-1-7-2-2-2-k-1-q-f-6-0-4-z-c-8-3-t-5-d-1-l-e-n-r-5-c-1-n-1-y-k-g-6-2-b-p-q-x-0-y-5-y-9-w-0-7-i-t-8-7-2-b-5-6-1-z-2-1-r-a-6-6-v-2-8-e-b-a-9-3-y-3-1-8-p-5-5-o-2-3-q-5-6-1-6-e-t-5-e-x-z-v-r-5-8-p-8-8-4-v-3-0-" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://0-f-7-8-q-h.-9-k-1-n-o-q-8-s-4-6-r-9-o-z-j-t-8-0-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info/a-6-t-3-p-9-x-f-8-l-v-a-m-0-c-2-b-q-1-6-c-1-6-" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://y-9-f-w-t-p-v-t-x-3-c-a-k-s-l.-4-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info/0-s-e-q-7-r-x-e-1-b-u-q-r-2-2-7-8-4-d-h-y-2-2-s-n-9-z-m-6-2-4-5-w-6-h-1-d-0-2-8-v-c-i-6-9-8-6-q-q-0-q-k-v-w-7-9-r-3-9-3-y-u-a-g-6-i-g-4-5-4-9-e-o-4-v-y-g-9-n-r-n-4-d-l-w-q-7-8-0-2-9-r-k-c-1-e-s-b-3-7-2-1-i-2-5-3-m-8-x-9-0-c-7-9-8-p-g-v-5-s-t-u-3-t-3-j-2-q-2-a-7-i-k-4-p-l-c-1-o-6-d-c-p-1-5-9-1-e-g-7-j-t-1-h-2-u-9-8-3-u-4-n-w-4-i-4-z-9-4-z-3-m-e-o-3-a-h-n-b-4-e-n-l-2-l-0-x-0-l-8-7-z-6-7-7-3-2-5-7-9-u-e-9-6-2-6-n-a-b-9-a-o-f-l-b-j-y-e-" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://y-9-f-w-t-p-v-t-x-3-c-a-k-s-l.-4-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info/0-s-e-q-7-r-x-e-1-b-u-q-r-2-2-7-8-4-d-h-y-2-2-s-n-9-z-m-6-2-4-5-w-6-h-1-d-0-2-8-v-c-i-6-9-8-6-q-q-0-q-k-v-w-7-9-r-3-9-3-y-u-a-g-6-i-g-4-5-4-9-e-o-4-v-y-g-9-n-r-n-4-d-l-w-q-7-8-0-2-9-r-k-c-1-e-s-b-3-7-2-1-i-2-5-3-m-8-x-9-0-c-7-9-8-p-g-v-5-s-t-u-3-t-3-j-2-q-2-a-7-i-k-4-p-l-c-1-o-6-d-c-p-1-5-9-1-e-g-7-j-t-1-h-2-u-9-8-3-u-4-n-w-4-i-4-z-9-4-z-3-m-e-o-3-a-h-n-b-4-e-n-l-2-l-0-x-0-l-8-7-z-6-7-7-3-2-5-7-9-u-e-9-6-2-6-n-a-b-9-a-o-f-l-b-j-y-e-" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://9-0-9-3-6-5-8-j-1-3-c-7-t-5-0-q-l-w-b-h-3-.7-6-n-2-x-4-0-b-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info/0-p-w-c-6-y-8-k-r-y-3-1-2-p-2-1-o-4-v-q-8-7-7-h-j-4-x-3-6-k-5-i-d-8-h-3-3-b-1-y-0-q-1-0-v-h-a-0-m-0-p-w-b-z-1-8-3-o-h-s-4-g-v-7-l-y-9-6-p-4-3-4-c-2-6-x-j-i-3-y-7-p-6-1-w-r-7-k-d-q-o-e-3-p-t-g-f-0-0-0-5-n-7-f-f-w-2-0-g-b-l-1-p-3-3-7-n-b-r-3-c-9-0-b-s-s-6-f-r-m-x-9-m-3-7-4-5-x-d-s-q-q-6-x-g-5-y-9-2-4-2-x-l-7-8-5-7-w-s-v-c-l-s-m-q-h-l-j-4-o-n-c-8-j-d-l-z-3-o-y-3-z-q-3-k-i-j-8-r-g-e-i-7-f-s-z-h-5-1-2-c-b-6-m-b-n-e-a-0-1-5-0-1-0-1-u-2-w-t-" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://b.-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info/i-g-7-r-2-0-2-7-f-4-r-3-2-8-n-6-2-l-m-u-x-i-8-c-4-g-3-8-7-0-d-l-7-z-6-j-r-r-2-h-7-b-f-s-5-i-r-m-8-d-w-2-6-h-w-c-b-d-w-8-n-1-7-5-m-f-5-2-w-n-g-" svchost.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://3-r-s-1-2-r-.f-5-8-3-9-7-8-d-2-2-6-e-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info/2-9-i-k-m-j-0-2-v-7-7-8-q-l-7-2-o-s-c-0-1-1-z-1-2-4-c-a-o-t-2-n-0-9-q-y-5-s-8-d-2-3-w-2-0-u-t-a-k-x-2-p-k-9-9-p-m-3-i-z-9-p-s-i-m-l-0-o-m-0-o-1-u-4-7-u-9-e-2-9-a-6-5-3-q-9-9-2-z-7-i-e-9-5-u-4-7-q-9-5-5-6-3-m-u-3-m-t-5-w-m-3-p-i-k-5-d-g-1-3-a-e-3-9-7-a-s-e-1-7-i-0-0-7-q-m-l-2-4-3-1-c-r-k-3-0-a-n-1-d-9-2-w-r-7-n-p-1-s-6-y-c-r-4-f-5-n-j-a-l-u-x-x-d-0-l-r-b-p-m-9-9-5-f-t-5-s-c-8-e-c-2-i-8-c-z-f-j-" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://6-q-4-3-d-y-o-2-w-1-r.-f-x-i-4-5-2-m-6-n-9-x-4-1-a-w-0-p-o-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info/m-5-6-9-g-m-i-3-v-1-c-n-w-d-r-3-i-8-p-d-2-h-4-8-d-s-t-9-3-v-9-5-v-l-4-2-3-y-o-3-1-7-q-q-m-9-z-5-a-7-7-b-4-r-d-6-u-p-g-m-1-8-2-3-9-z-a-j-r-v-7-o-2-o-1-g-4-v-h-o-p-4-8-9-a-6-" svchost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1992 5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe Token: SeDebugPrivilege 1992 5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe Token: SeDebugPrivilege 2172 winlogon.exe Token: SeBackupPrivilege 2812 svchost.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1992 5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe 2172 winlogon.exe 2812 svchost.exe 2812 svchost.exe 2812 svchost.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2172 1992 5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe 30 PID 1992 wrote to memory of 2172 1992 5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe 30 PID 1992 wrote to memory of 2172 1992 5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe 30 PID 1992 wrote to memory of 2172 1992 5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe 30 PID 2172 wrote to memory of 2812 2172 winlogon.exe 31 PID 2172 wrote to memory of 2812 2172 winlogon.exe 31 PID 2172 wrote to memory of 2812 2172 winlogon.exe 31 PID 2172 wrote to memory of 2812 2172 winlogon.exe 31 PID 2172 wrote to memory of 2812 2172 winlogon.exe 31 PID 2172 wrote to memory of 2812 2172 winlogon.exe 31 PID 2172 wrote to memory of 2812 2172 winlogon.exe 31 PID 2172 wrote to memory of 2812 2172 winlogon.exe 31 PID 2172 wrote to memory of 2812 2172 winlogon.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d5be7dd142dc8db0ca31fa92a11679d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\Admin1\winlogon.exe"C:\Users\Admin\Admin1\winlogon.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\svchost.exe03⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2812
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD55d5be7dd142dc8db0ca31fa92a11679d
SHA1e94fbbe3a30ada943bdf659ae3866ad63c1477c6
SHA25627080635d1991d91b96301df10aed3a4de691b92bbbfd8edfba5c7067ae695be
SHA512d25dedb40bb5395aae14ff3564710fb176eb7d2742f7998d81bd229a48ff193f65a723278b6f9459e037a9b2b4c96788642587666d92d75f3adb1d59befdcdcb