Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 08:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe
-
Size
188KB
-
MD5
66c910db68b98751290cdb4d6835da7f
-
SHA1
9a6e817e398795da5fc0de48f30a6f446da5ecc7
-
SHA256
74a6bf982d64547e7a290503c8bf80708df7f749a35bbb5168b8119b9f950a2e
-
SHA512
e7ac6f4ca3910ac1538b981f6087bd2507ef7fadbf0db2e86dec557dfb425c60697e780762289b0dd954f7711ec58f3768676a579d99722fc910031b8cdc4cd6
-
SSDEEP
3072:Z/FDc0Cbdss/q+RxKd9u1Wb/4/8uL6suQ14Zvop4lhdPupdoK0QCcLq2XrDmQt:fc4+RId9ui/4UuOjQuomhupdoK0QCcLX
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4868 WScript.Exe -
Executes dropped EXE 1 IoCs
pid Process 3660 Program Files1FM7G3.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\d.ico 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\t.ico 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "457840000" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "460808562" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102be01bdddcda01 IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0057e71bdddcda01 IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "457840000" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000649d859bceaf064fbc4c5252037c707f00000000020000000000106600000001000020000000678fc7349c4e32bea8f80cef3cadfa65ae670234f669fd30f55081e297119c82000000000e800000000200002000000033cb4f421389f55124042a9c38648bcf5585684cbe640e8d370bdd1dacf9d44a20000000e62b2f61e8814116d6a56b28e4105e731ec6de2e3d529db8d7f8e16f01e7105840000000693912a3108cdf9bccbd97b05decc7cd3646d53216eb66abca83e9946ebf927c8c9492da97f1270402db62efb6ea5d8cedc81760345eb955ee18332376002b8c IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31120605" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{46E7AF1F-48D0-11EF-9D1F-C605466CACCF} = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31120605" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000649d859bceaf064fbc4c5252037c707f0000000002000000000010660000000100002000000042aa89409c593f4a3a1fea950d2debc1c877b7387422b02818b824867ab37ddd000000000e800000000200002000000006f53e30c6827ece455a4b59dbc2caeac893bb492225e50f6c4810e27ae064ea20000000768c0d9be53e75cb6ef3bf209ccd6e435a473c9818c17e6f4018914973322df9400000002b1a250e15b9af0fb49ccf17107e7ae0ac58b3899ace57ec16ba6f04fa810a57ae825cf381f0456b1289aeb13cfd781de1cec402a9cf3104b4ce1039633c5d12 IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428489460" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31120605" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.exe -
Modifies registry class 60 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,130" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command\ = "IEXPLORE.EXE http://www.loliso.com/?1193" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\ 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htb 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.h35 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hli\ 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.h35\ = "h35" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hyx\ = "hyx" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon\ = "c:\\Program Files\\Common Files\\d.ico" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hpf 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hyx 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hdh\ = "hdh" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command\ = "IEXPLORE.EXE http://taobao.loliso.com/?1193" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\ 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hdh 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\ 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\h35\shell\open\command\ = "IEXPLORE.EXE http://www.t17t.com/?1193" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hpf 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\shell\open\command\ = "IEXPLORE.EXE http://www.henbucuo.com/?1193" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hli 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hdh 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\DefaultIcon 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,41" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon\ = "c:\\Program Files\\Common Files\\t.ico" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\shell\open\command\ = "IEXPLORE.EXE http://www.piaofang.net/?1193" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell\open\command\ = "IEXPLORE.EXE http://www.d91d.com/?1193" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\DefaultIcon 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hli\shell\open\command 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hdh\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE,0" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\ 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hpf\DefaultIcon\ = "%SystemRoot%\\SysWow64\\SHELL32.dll,139" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htb\ 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htb\shell\open\command 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htb\ = "htb" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\h35\DefaultIcon 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hyx\shell 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hpf\ = "hpf" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hli\ = "hli" 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4864 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe 3660 Program Files1FM7G3.exe 2208 IEXPLORE.exe 2208 IEXPLORE.exe 3108 IEXPLORE.EXE 3108 IEXPLORE.EXE 3108 IEXPLORE.EXE 3108 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4864 wrote to memory of 3660 4864 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe 87 PID 4864 wrote to memory of 3660 4864 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe 87 PID 4864 wrote to memory of 3660 4864 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe 87 PID 3660 wrote to memory of 2208 3660 Program Files1FM7G3.exe 93 PID 3660 wrote to memory of 2208 3660 Program Files1FM7G3.exe 93 PID 2208 wrote to memory of 3108 2208 IEXPLORE.exe 94 PID 2208 wrote to memory of 3108 2208 IEXPLORE.exe 94 PID 2208 wrote to memory of 3108 2208 IEXPLORE.exe 94 PID 4864 wrote to memory of 4868 4864 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe 95 PID 4864 wrote to memory of 4868 4864 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe 95 PID 4864 wrote to memory of 4868 4864 66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\66c910db68b98751290cdb4d6835da7f_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\Program Files1FM7G3.exe"c:\Program Files1FM7G3.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/vplay.php3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3108
-
-
-
-
C:\Windows\SysWOW64\WScript.ExeWScript.Exe jies.bak.vbs2⤵
- Deletes itself
PID:4868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5dc836c8f50af98c6ee14406dbe413dbd
SHA1482cd345eb9a9da3482ccea5d690481847432e6d
SHA2561b866ca32649463789bb7822accd5d5a2f35366c4cce82094766951a847cc760
SHA51230ea534f6e069582c2c04b95551ec35a9bf9858dc5be63f0d9158d2801da422d729a1c31d353395cdff3f008ae2f8fb8dab00e10e13160e051ffbdbc997e49d2
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
450B
MD5183925c527aefe488a03e1d645ef8a1d
SHA152d67fe7586c37c3f9c21d140f3b55281675be04
SHA2564474a711e1dcdf6c36ab7c3d02b685a83187b872dcb58eb425750d497a5ddb97
SHA5125a08b94ccb0634a814e2dca6797108d20b2171c4b3eda09a0abee4e9c54f5500309393756aaff5fc18041e791801535d0c8a5bf10b03cc8432eb00fa71bc3121