Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24/07/2024, 03:52
Static task
static1
Behavioral task
behavioral1
Sample
6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe
-
Size
256KB
-
MD5
6a25ac6cb56675a00eaef59fa44126ff
-
SHA1
33ce275fefa3cf530ebd19ad45eb63955b7739a9
-
SHA256
b41a84f48eca6b5925c74d04f2e112858d01eacd4b1e7fe4c66c31b94463e717
-
SHA512
3d6c95521d9ee2a8fd9653be1a6bf2a91af466efb3dab4d98d114af0a36948d65401925291407315d05683794a09667cadacce55a1deaedefd0b8d6e01656094
-
SSDEEP
6144:+7RPGkG+2O01WQY4MyTjGMT8N00lFKgOLpE4dFbbxGo:+7RekGLO0CyvGMT8N00GlDM
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pmuEma.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fafug.exe -
Deletes itself 1 IoCs
pid Process 2856 cmd.exe -
Executes dropped EXE 8 IoCs
pid Process 1980 pmuEma.exe 2124 fafug.exe 2896 2gal.exe 3016 2gal.exe 2948 2gal.exe 2616 2gal.exe 2344 2gal.exe 1108 2gal.exe -
Loads dropped DLL 6 IoCs
pid Process 2228 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 2228 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 1980 pmuEma.exe 1980 pmuEma.exe 2228 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 2228 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/3016-41-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/3016-48-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/3016-46-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/3016-43-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2948-63-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2948-62-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2948-61-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2948-60-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/3016-59-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2344-86-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2616-87-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2616-73-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2616-70-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2616-85-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2616-84-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2344-82-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2344-79-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2344-77-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2344-90-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2616-68-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2948-54-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2948-52-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/3016-95-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2616-99-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2344-100-0x0000000000400000-0x0000000000407000-memory.dmp upx -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /Q" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /g" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /m" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /T" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /F" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /H" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /M" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /a" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /v" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /S" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /p" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /A" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /n" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /e" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /i" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /Z" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /z" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /X" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /P" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /x" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /k" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /t" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /y" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /l" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /V" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /w" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /d" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /G" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /I" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /s" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /E" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /K" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /J" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /o" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /Y" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /O" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /W" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /f" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /s" pmuEma.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /C" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /R" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /L" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /N" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /r" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /b" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /j" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /U" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /u" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /h" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /c" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /B" fafug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\fafug = "C:\\Users\\Admin\\fafug.exe /q" fafug.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2gal.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 2gal.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2884 tasklist.exe 3000 tasklist.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 2896 set thread context of 3016 2896 2gal.exe 36 PID 2896 set thread context of 2948 2896 2gal.exe 37 PID 2896 set thread context of 2616 2896 2gal.exe 38 PID 2896 set thread context of 2344 2896 2gal.exe 39 PID 2896 set thread context of 1108 2896 2gal.exe 40 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fafug.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2gal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2gal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pmuEma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2gal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1980 pmuEma.exe 1980 pmuEma.exe 2948 2gal.exe 2616 2gal.exe 2124 fafug.exe 2124 fafug.exe 2948 2gal.exe 2124 fafug.exe 2616 2gal.exe 2124 fafug.exe 2124 fafug.exe 2124 fafug.exe 2948 2gal.exe 2124 fafug.exe 2948 2gal.exe 2948 2gal.exe 2124 fafug.exe 2124 fafug.exe 2948 2gal.exe 2124 fafug.exe 2948 2gal.exe 2124 fafug.exe 2948 2gal.exe 2124 fafug.exe 2124 fafug.exe 2948 2gal.exe 2124 fafug.exe 2948 2gal.exe 2124 fafug.exe 2948 2gal.exe 2948 2gal.exe 2948 2gal.exe 2124 fafug.exe 2124 fafug.exe 2948 2gal.exe 2124 fafug.exe 2948 2gal.exe 2948 2gal.exe 2124 fafug.exe 2124 fafug.exe 2948 2gal.exe 2948 2gal.exe 2124 fafug.exe 2948 2gal.exe 2948 2gal.exe 2124 fafug.exe 2948 2gal.exe 2124 fafug.exe 2124 fafug.exe 2948 2gal.exe 2948 2gal.exe 2124 fafug.exe 2948 2gal.exe 2948 2gal.exe 2948 2gal.exe 2124 fafug.exe 2948 2gal.exe 2124 fafug.exe 2124 fafug.exe 2948 2gal.exe 2124 fafug.exe 2948 2gal.exe 2948 2gal.exe 2124 fafug.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2884 tasklist.exe Token: SeDebugPrivilege 3000 tasklist.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2228 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 1980 pmuEma.exe 2124 fafug.exe 2896 2gal.exe 3016 2gal.exe 2344 2gal.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2228 wrote to memory of 1980 2228 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 30 PID 2228 wrote to memory of 1980 2228 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 30 PID 2228 wrote to memory of 1980 2228 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 30 PID 2228 wrote to memory of 1980 2228 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 30 PID 1980 wrote to memory of 2124 1980 pmuEma.exe 31 PID 1980 wrote to memory of 2124 1980 pmuEma.exe 31 PID 1980 wrote to memory of 2124 1980 pmuEma.exe 31 PID 1980 wrote to memory of 2124 1980 pmuEma.exe 31 PID 1980 wrote to memory of 2816 1980 pmuEma.exe 32 PID 1980 wrote to memory of 2816 1980 pmuEma.exe 32 PID 1980 wrote to memory of 2816 1980 pmuEma.exe 32 PID 1980 wrote to memory of 2816 1980 pmuEma.exe 32 PID 2228 wrote to memory of 2896 2228 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 34 PID 2228 wrote to memory of 2896 2228 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 34 PID 2228 wrote to memory of 2896 2228 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 34 PID 2228 wrote to memory of 2896 2228 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 34 PID 2816 wrote to memory of 2884 2816 cmd.exe 35 PID 2816 wrote to memory of 2884 2816 cmd.exe 35 PID 2816 wrote to memory of 2884 2816 cmd.exe 35 PID 2816 wrote to memory of 2884 2816 cmd.exe 35 PID 2896 wrote to memory of 3016 2896 2gal.exe 36 PID 2896 wrote to memory of 3016 2896 2gal.exe 36 PID 2896 wrote to memory of 3016 2896 2gal.exe 36 PID 2896 wrote to memory of 3016 2896 2gal.exe 36 PID 2896 wrote to memory of 3016 2896 2gal.exe 36 PID 2896 wrote to memory of 3016 2896 2gal.exe 36 PID 2896 wrote to memory of 3016 2896 2gal.exe 36 PID 2896 wrote to memory of 3016 2896 2gal.exe 36 PID 2896 wrote to memory of 2948 2896 2gal.exe 37 PID 2896 wrote to memory of 2948 2896 2gal.exe 37 PID 2896 wrote to memory of 2948 2896 2gal.exe 37 PID 2896 wrote to memory of 2948 2896 2gal.exe 37 PID 2896 wrote to memory of 2948 2896 2gal.exe 37 PID 2896 wrote to memory of 2948 2896 2gal.exe 37 PID 2896 wrote to memory of 2948 2896 2gal.exe 37 PID 2896 wrote to memory of 2948 2896 2gal.exe 37 PID 2896 wrote to memory of 2616 2896 2gal.exe 38 PID 2896 wrote to memory of 2616 2896 2gal.exe 38 PID 2896 wrote to memory of 2616 2896 2gal.exe 38 PID 2896 wrote to memory of 2616 2896 2gal.exe 38 PID 2896 wrote to memory of 2616 2896 2gal.exe 38 PID 2896 wrote to memory of 2616 2896 2gal.exe 38 PID 2896 wrote to memory of 2616 2896 2gal.exe 38 PID 2896 wrote to memory of 2616 2896 2gal.exe 38 PID 2896 wrote to memory of 2344 2896 2gal.exe 39 PID 2896 wrote to memory of 2344 2896 2gal.exe 39 PID 2896 wrote to memory of 2344 2896 2gal.exe 39 PID 2896 wrote to memory of 2344 2896 2gal.exe 39 PID 2896 wrote to memory of 2344 2896 2gal.exe 39 PID 2896 wrote to memory of 2344 2896 2gal.exe 39 PID 2896 wrote to memory of 2344 2896 2gal.exe 39 PID 2896 wrote to memory of 2344 2896 2gal.exe 39 PID 2896 wrote to memory of 1108 2896 2gal.exe 40 PID 2896 wrote to memory of 1108 2896 2gal.exe 40 PID 2896 wrote to memory of 1108 2896 2gal.exe 40 PID 2896 wrote to memory of 1108 2896 2gal.exe 40 PID 2896 wrote to memory of 1108 2896 2gal.exe 40 PID 2228 wrote to memory of 2856 2228 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 42 PID 2228 wrote to memory of 2856 2228 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 42 PID 2228 wrote to memory of 2856 2228 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 42 PID 2228 wrote to memory of 2856 2228 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 42 PID 2856 wrote to memory of 3000 2856 cmd.exe 44 PID 2856 wrote to memory of 3000 2856 cmd.exe 44 PID 2856 wrote to memory of 3000 2856 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\pmuEma.exeC:\Users\Admin\pmuEma.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\fafug.exe"C:\Users\Admin\fafug.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2124
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del pmuEma.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
-
-
C:\Users\Admin\2gal.exeC:\Users\Admin\2gal.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\2gal.exe"C:\Users\Admin\2gal.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3016
-
-
C:\Users\Admin\2gal.exe"C:\Users\Admin\2gal.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2948
-
-
C:\Users\Admin\2gal.exe"C:\Users\Admin\2gal.exe"3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2616
-
-
C:\Users\Admin\2gal.exe"C:\Users\Admin\2gal.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2344
-
-
C:\Users\Admin\2gal.exe"C:\Users\Admin\2gal.exe"3⤵
- Executes dropped EXE
PID:1108
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5b87ba20f00e6a88f59b4553cea7b9d1f
SHA11ed552e7b9f746eb15c9c28375757a37e22d6b01
SHA256dcb0fe1a43622940710ddfb0092310b4dbec0e33734ca4f821e3e0676c856c20
SHA512f836240e5540a8b3d7492251a9bb2fecd7264418aa8815c3a4efd1dc4691cc5c17d5ce29bf3083397e16255236484cb702cdf0c18ba8c73a6c9b380d7f1f2864
-
Filesize
228KB
MD5492634ec45870d712797905758d098e8
SHA1e8d38ee2a6a6971dfe57296665422a77950ccac4
SHA2564456befe201b5c7e1eb79af2da3be347b928a3c27ea5c507a998c91644771a8d
SHA512efae548a33320b8b8620b231c8f06513b2bca005608450eb6f4c27aeecc64e96be96e36ede5337ae83f452277cc0f69d2723ab221500622de42fbf2b83142a34
-
Filesize
228KB
MD5ad9cc8240daec36c262060e8e8b56883
SHA1c04edbee2e80d1be34ef66cbda894c17bd19ffec
SHA256baf38692de9b19c79fc98686a16f8f557b6cd6cf483669b589e4f7ed84e9ed24
SHA5120a3a0f52aa77a5bc9f38aba3114fcf5a93f3d12a533afb98c3a9688e5364edec6929105e2962f3ce7b0798ac4bc6e5f6619929d428e563f0aa2fea1aacb2d05b