Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2024, 03:52
Static task
static1
Behavioral task
behavioral1
Sample
6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe
-
Size
256KB
-
MD5
6a25ac6cb56675a00eaef59fa44126ff
-
SHA1
33ce275fefa3cf530ebd19ad45eb63955b7739a9
-
SHA256
b41a84f48eca6b5925c74d04f2e112858d01eacd4b1e7fe4c66c31b94463e717
-
SHA512
3d6c95521d9ee2a8fd9653be1a6bf2a91af466efb3dab4d98d114af0a36948d65401925291407315d05683794a09667cadacce55a1deaedefd0b8d6e01656094
-
SSDEEP
6144:+7RPGkG+2O01WQY4MyTjGMT8N00lFKgOLpE4dFbbxGo:+7RekGLO0CyvGMT8N00GlDM
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pmuEma.exe Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tiaba.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation pmuEma.exe Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe -
Executes dropped EXE 8 IoCs
pid Process 2000 pmuEma.exe 4700 2gal.exe 1692 tiaba.exe 852 2gal.exe 3636 2gal.exe 4856 2gal.exe 1144 2gal.exe 2448 2gal.exe -
resource yara_rule behavioral2/memory/852-50-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/852-47-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/852-52-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/3636-58-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3636-60-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3636-57-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3636-54-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4856-68-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1144-69-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/1144-71-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4856-66-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/4856-65-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1144-63-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4856-61-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/852-74-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4856-80-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1144-81-0x0000000000400000-0x0000000000407000-memory.dmp upx -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /Q" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /s" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /v" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /H" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /e" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /O" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /t" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /i" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /T" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /M" pmuEma.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /I" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /Z" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /n" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /K" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /j" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /x" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /Y" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /F" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /L" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /J" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /y" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /f" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /m" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /W" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /M" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /A" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /q" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /a" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /h" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /C" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /l" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /k" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /S" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /c" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /g" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /X" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /E" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /p" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /u" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /P" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /w" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /b" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /z" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /U" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /N" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /B" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /D" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /G" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /o" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /r" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /R" tiaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tiaba = "C:\\Users\\Admin\\tiaba.exe /V" tiaba.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2gal.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2gal.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2312 tasklist.exe 1560 tasklist.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 4700 set thread context of 852 4700 2gal.exe 96 PID 4700 set thread context of 3636 4700 2gal.exe 97 PID 4700 set thread context of 4856 4700 2gal.exe 98 PID 4700 set thread context of 1144 4700 2gal.exe 99 PID 4700 set thread context of 2448 4700 2gal.exe 100 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3080 2448 WerFault.exe 100 -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tiaba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pmuEma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2gal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2gal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2gal.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2000 pmuEma.exe 2000 pmuEma.exe 2000 pmuEma.exe 2000 pmuEma.exe 3636 2gal.exe 3636 2gal.exe 4856 2gal.exe 4856 2gal.exe 1692 tiaba.exe 1692 tiaba.exe 1692 tiaba.exe 1692 tiaba.exe 3636 2gal.exe 3636 2gal.exe 1692 tiaba.exe 1692 tiaba.exe 4856 2gal.exe 4856 2gal.exe 1692 tiaba.exe 1692 tiaba.exe 1692 tiaba.exe 1692 tiaba.exe 1692 tiaba.exe 1692 tiaba.exe 3636 2gal.exe 3636 2gal.exe 3636 2gal.exe 3636 2gal.exe 3636 2gal.exe 3636 2gal.exe 1692 tiaba.exe 1692 tiaba.exe 1692 tiaba.exe 1692 tiaba.exe 1692 tiaba.exe 1692 tiaba.exe 3636 2gal.exe 3636 2gal.exe 1692 tiaba.exe 1692 tiaba.exe 3636 2gal.exe 3636 2gal.exe 1692 tiaba.exe 1692 tiaba.exe 3636 2gal.exe 3636 2gal.exe 1692 tiaba.exe 1692 tiaba.exe 1692 tiaba.exe 1692 tiaba.exe 3636 2gal.exe 3636 2gal.exe 1692 tiaba.exe 1692 tiaba.exe 3636 2gal.exe 3636 2gal.exe 1692 tiaba.exe 1692 tiaba.exe 3636 2gal.exe 3636 2gal.exe 3636 2gal.exe 3636 2gal.exe 3636 2gal.exe 3636 2gal.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2312 tasklist.exe Token: SeDebugPrivilege 1560 tasklist.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3620 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 2000 pmuEma.exe 4700 2gal.exe 1692 tiaba.exe 852 2gal.exe 1144 2gal.exe -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 3620 wrote to memory of 2000 3620 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 86 PID 3620 wrote to memory of 2000 3620 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 86 PID 3620 wrote to memory of 2000 3620 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 86 PID 3620 wrote to memory of 4700 3620 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 92 PID 3620 wrote to memory of 4700 3620 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 92 PID 3620 wrote to memory of 4700 3620 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 92 PID 2000 wrote to memory of 1692 2000 pmuEma.exe 93 PID 2000 wrote to memory of 1692 2000 pmuEma.exe 93 PID 2000 wrote to memory of 1692 2000 pmuEma.exe 93 PID 2000 wrote to memory of 1124 2000 pmuEma.exe 94 PID 2000 wrote to memory of 1124 2000 pmuEma.exe 94 PID 2000 wrote to memory of 1124 2000 pmuEma.exe 94 PID 4700 wrote to memory of 852 4700 2gal.exe 96 PID 4700 wrote to memory of 852 4700 2gal.exe 96 PID 4700 wrote to memory of 852 4700 2gal.exe 96 PID 4700 wrote to memory of 852 4700 2gal.exe 96 PID 4700 wrote to memory of 852 4700 2gal.exe 96 PID 4700 wrote to memory of 852 4700 2gal.exe 96 PID 4700 wrote to memory of 852 4700 2gal.exe 96 PID 4700 wrote to memory of 852 4700 2gal.exe 96 PID 4700 wrote to memory of 3636 4700 2gal.exe 97 PID 4700 wrote to memory of 3636 4700 2gal.exe 97 PID 4700 wrote to memory of 3636 4700 2gal.exe 97 PID 4700 wrote to memory of 3636 4700 2gal.exe 97 PID 4700 wrote to memory of 3636 4700 2gal.exe 97 PID 4700 wrote to memory of 3636 4700 2gal.exe 97 PID 4700 wrote to memory of 3636 4700 2gal.exe 97 PID 4700 wrote to memory of 3636 4700 2gal.exe 97 PID 4700 wrote to memory of 4856 4700 2gal.exe 98 PID 4700 wrote to memory of 4856 4700 2gal.exe 98 PID 4700 wrote to memory of 4856 4700 2gal.exe 98 PID 4700 wrote to memory of 4856 4700 2gal.exe 98 PID 4700 wrote to memory of 4856 4700 2gal.exe 98 PID 4700 wrote to memory of 4856 4700 2gal.exe 98 PID 4700 wrote to memory of 4856 4700 2gal.exe 98 PID 4700 wrote to memory of 4856 4700 2gal.exe 98 PID 4700 wrote to memory of 1144 4700 2gal.exe 99 PID 4700 wrote to memory of 1144 4700 2gal.exe 99 PID 4700 wrote to memory of 1144 4700 2gal.exe 99 PID 4700 wrote to memory of 1144 4700 2gal.exe 99 PID 4700 wrote to memory of 1144 4700 2gal.exe 99 PID 4700 wrote to memory of 1144 4700 2gal.exe 99 PID 4700 wrote to memory of 1144 4700 2gal.exe 99 PID 4700 wrote to memory of 1144 4700 2gal.exe 99 PID 4700 wrote to memory of 2448 4700 2gal.exe 100 PID 4700 wrote to memory of 2448 4700 2gal.exe 100 PID 4700 wrote to memory of 2448 4700 2gal.exe 100 PID 4700 wrote to memory of 2448 4700 2gal.exe 100 PID 1124 wrote to memory of 2312 1124 cmd.exe 102 PID 1124 wrote to memory of 2312 1124 cmd.exe 102 PID 1124 wrote to memory of 2312 1124 cmd.exe 102 PID 3620 wrote to memory of 4488 3620 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 105 PID 3620 wrote to memory of 4488 3620 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 105 PID 3620 wrote to memory of 4488 3620 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe 105 PID 4488 wrote to memory of 1560 4488 cmd.exe 107 PID 4488 wrote to memory of 1560 4488 cmd.exe 107 PID 4488 wrote to memory of 1560 4488 cmd.exe 107 PID 1692 wrote to memory of 1560 1692 tiaba.exe 107 PID 1692 wrote to memory of 1560 1692 tiaba.exe 107 PID 1692 wrote to memory of 1560 1692 tiaba.exe 107 PID 1692 wrote to memory of 1560 1692 tiaba.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\pmuEma.exeC:\Users\Admin\pmuEma.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\tiaba.exe"C:\Users\Admin\tiaba.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del pmuEma.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2312
-
-
-
-
C:\Users\Admin\2gal.exeC:\Users\Admin\2gal.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\2gal.exe"C:\Users\Admin\2gal.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:852
-
-
C:\Users\Admin\2gal.exe"C:\Users\Admin\2gal.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3636
-
-
C:\Users\Admin\2gal.exe"C:\Users\Admin\2gal.exe"3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:4856
-
-
C:\Users\Admin\2gal.exe"C:\Users\Admin\2gal.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1144
-
-
C:\Users\Admin\2gal.exe"C:\Users\Admin\2gal.exe"3⤵
- Executes dropped EXE
PID:2448 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 804⤵
- Program crash
PID:3080
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 6a25ac6cb56675a00eaef59fa44126ff_JaffaCakes118.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2448 -ip 24481⤵PID:752
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5b87ba20f00e6a88f59b4553cea7b9d1f
SHA11ed552e7b9f746eb15c9c28375757a37e22d6b01
SHA256dcb0fe1a43622940710ddfb0092310b4dbec0e33734ca4f821e3e0676c856c20
SHA512f836240e5540a8b3d7492251a9bb2fecd7264418aa8815c3a4efd1dc4691cc5c17d5ce29bf3083397e16255236484cb702cdf0c18ba8c73a6c9b380d7f1f2864
-
Filesize
228KB
MD5ad9cc8240daec36c262060e8e8b56883
SHA1c04edbee2e80d1be34ef66cbda894c17bd19ffec
SHA256baf38692de9b19c79fc98686a16f8f557b6cd6cf483669b589e4f7ed84e9ed24
SHA5120a3a0f52aa77a5bc9f38aba3114fcf5a93f3d12a533afb98c3a9688e5364edec6929105e2962f3ce7b0798ac4bc6e5f6619929d428e563f0aa2fea1aacb2d05b
-
Filesize
228KB
MD5aaaa1e32df6c502fcd98b73303cf3d7e
SHA164cd9ea147823093c46b169f63000240e0cd926c
SHA25680770c498f5de0fbf58667c0f30b928b62fe3a0573bf7bb3a70596c9ee2f3984
SHA5129fb19144d8a41c59317c97ec324989806e8036052bf95850e0685aa84807f2113b5a381461b33b6bc9e845a3dac737f714d957cf3cdb936500a1d7a2960b22ab