Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 12:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe
Resource
win10v2004-20240729-en
windows10-2004-x64
22 signatures
150 seconds
General
-
Target
70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
70af1a0f5edd633a967b6b424409c016
-
SHA1
c0c8ddc109da87f22126b991ce9aae2a0a666aee
-
SHA256
43d9e3dc473784bc870edcc9507f5626d222217d0e529a03107d45a570615b2f
-
SHA512
1f64e61aee1dfe3fad44ffe56f4b82367644160547dcdebef92ebfe1d335e244650aed4326772fef1fde96cae94895b0bc82b90aa6ff4d91bc9109c9542a2609
-
SSDEEP
12288:xCTPgrnZiJiAaMVkUet7EwBI+APutDrVkP+xnXOBI+AM0u53XC1t:xCTPMAzVkUetVI5ut/VkP+x6IS0u53et
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\explorer.exe\"" 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe, C:\\explorer.exe" huzksf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe, C:\\explorer.exe" 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" huzksf.exe -
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 2 IoCs
pid Process 2792 inf4D2.tmp 756 huzksf.exe -
Loads dropped DLL 8 IoCs
pid Process 1720 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe 1720 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe 1720 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe 1720 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe 2996 WerFault.exe 2996 WerFault.exe 2996 WerFault.exe 2996 WerFault.exe -
Modifies system executable filetype association 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image" 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image" huzksf.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\m = "q.exe" 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\huzksf.exe = "C:\\Documents and Settings\\Admin\\Local Settings\\huzksf.exe" 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created \??\r:\Desktop.ini huzksf.exe File opened for modification \??\v:\Desktop.ini huzksf.exe File created \??\w:\Desktop.ini huzksf.exe File created \??\x:\Desktop.ini huzksf.exe File opened for modification \??\j:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\o:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\c:\Desktop.ini huzksf.exe File created \??\p:\Desktop.ini huzksf.exe File opened for modification \??\e:\Desktop.ini huzksf.exe File opened for modification \??\g:\Desktop.ini huzksf.exe File opened for modification \??\j:\Desktop.ini huzksf.exe File created \??\l:\Desktop.ini huzksf.exe File created \??\l:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\m:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\o:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\w:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\r:\Desktop.ini huzksf.exe File opened for modification \??\t:\Desktop.ini huzksf.exe File opened for modification \??\o:\Desktop.ini huzksf.exe File opened for modification \??\h:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\p:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\z:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\z:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\h:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\v:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\m:\Desktop.ini huzksf.exe File created \??\y:\Desktop.ini huzksf.exe File created \??\n:\Desktop.ini huzksf.exe File created \??\s:\Desktop.ini huzksf.exe File created \??\z:\Desktop.ini huzksf.exe File opened for modification \??\u:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\u:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\q:\Desktop.ini huzksf.exe File created \??\c:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\f:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\k:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\q:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\x:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\y:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\k:\Desktop.ini huzksf.exe File created \??\t:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\i:\Desktop.ini huzksf.exe File created \??\v:\Desktop.ini huzksf.exe File created \??\g:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\l:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\n:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\r:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\f:\Desktop.ini huzksf.exe File opened for modification \??\n:\Desktop.ini huzksf.exe File created \??\u:\Desktop.ini huzksf.exe File opened for modification \??\c:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification C:\Documents and Settings\Admin\Application Data\Mr_CF\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\r:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\e:\Desktop.ini huzksf.exe File opened for modification \??\k:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\s:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\g:\Desktop.ini huzksf.exe File created \??\j:\Desktop.ini huzksf.exe File created \??\h:\Desktop.ini huzksf.exe File opened for modification \??\p:\Desktop.ini huzksf.exe File opened for modification \??\y:\Desktop.ini huzksf.exe File created C:\Documents and Settings\Admin\Application Data\Mr_CF\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\g:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\n:\Desktop.ini 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 42 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\o: huzksf.exe File opened (read-only) \??\r: huzksf.exe File opened (read-only) \??\m: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\w: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\x: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\h: huzksf.exe File opened (read-only) \??\m: huzksf.exe File opened (read-only) \??\k: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\j: huzksf.exe File opened (read-only) \??\n: huzksf.exe File opened (read-only) \??\p: huzksf.exe File opened (read-only) \??\t: huzksf.exe File opened (read-only) \??\x: huzksf.exe File opened (read-only) \??\r: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\u: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\e: huzksf.exe File opened (read-only) \??\g: huzksf.exe File opened (read-only) \??\k: huzksf.exe File opened (read-only) \??\v: huzksf.exe File opened (read-only) \??\z: huzksf.exe File opened (read-only) \??\o: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\q: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\t: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\y: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\l: huzksf.exe File opened (read-only) \??\i: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\l: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\z: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\i: huzksf.exe File opened (read-only) \??\e: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\g: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\h: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\p: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\w: huzksf.exe File opened (read-only) \??\y: huzksf.exe File opened (read-only) \??\n: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\s: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\q: huzksf.exe File opened (read-only) \??\s: huzksf.exe File opened (read-only) \??\u: huzksf.exe File opened (read-only) \??\j: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened (read-only) \??\v: 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 64 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\e:\Autorun.inf huzksf.exe File opened for modification \??\g:\Autorun.inf huzksf.exe File created \??\j:\Autorun.inf huzksf.exe File created \??\y:\Autorun.inf huzksf.exe File created \??\z:\Autorun.inf huzksf.exe File created \??\t:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\v:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\r:\Autorun.inf huzksf.exe File created \??\v:\Autorun.inf huzksf.exe File created \??\c:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\i:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\j:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\l:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\r:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\o:\Autorun.inf huzksf.exe File opened for modification \??\r:\Autorun.inf huzksf.exe File opened for modification \??\u:\Autorun.inf huzksf.exe File opened for modification \??\c:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\g:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\i:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\k:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\n:\Autorun.inf huzksf.exe File created \??\f:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\o:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\l:\Autorun.inf huzksf.exe File created \??\t:\Autorun.inf huzksf.exe File created \??\h:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\u:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\y:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\w:\Autorun.inf huzksf.exe File opened for modification \??\l:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\q:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\g:\Autorun.inf huzksf.exe File opened for modification \??\o:\Autorun.inf huzksf.exe File opened for modification \??\t:\Autorun.inf huzksf.exe File created \??\e:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\g:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\j:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\n:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\v:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\y:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\c:\Autorun.inf huzksf.exe File created \??\f:\Autorun.inf huzksf.exe File created \??\m:\Autorun.inf huzksf.exe File opened for modification \??\v:\Autorun.inf huzksf.exe File opened for modification \??\z:\Autorun.inf huzksf.exe File created \??\p:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\w:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\x:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\l:\Autorun.inf huzksf.exe File created \??\w:\Autorun.inf huzksf.exe File opened for modification \??\e:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\m:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\o:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\s:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\h:\Autorun.inf huzksf.exe File created \??\p:\Autorun.inf huzksf.exe File opened for modification \??\y:\Autorun.inf huzksf.exe File opened for modification \??\f:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\m:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created \??\q:\Autorun.inf 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification \??\c:\Autorun.inf huzksf.exe File created \??\i:\Autorun.inf huzksf.exe File opened for modification \??\i:\Autorun.inf huzksf.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\Mr_CoolFace.scr 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Mr_CoolFace.scr 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created C:\Windows\SysWOW64\msvbvm60.dll huzksf.exe File created C:\Windows\SysWOW64\msvbvm60.dll 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File created C:\Windows\SysWOW64\q.exe 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\q.exe 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files\Common Files\Mutation.bat huzksf.exe File created C:\Program Files\Common Files\_cmd.exe huzksf.exe File created C:\Program Files\Common Files\N0TEPAD.exe huzksf.exe File created C:\Program Files\Common Files\kalkulator.exe huzksf.exe File created C:\Program Files\Common Files\tskmgr.exe huzksf.exe File created C:\Program Files\Common Files\reged1t.exe huzksf.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Negeri Serumpun Sebalai .pif .bat .com .scr .exe 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2996 756 WerFault.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inf4D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language huzksf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe -
Modifies Control Panel 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\SCRNSAVE.EXE = "MR_COO~1.SCR" 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60" 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\SCRNSAVE.EXE = "MR_COO~1.SCR" huzksf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" huzksf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60" huzksf.exe -
Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image" 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "JPEG Image" 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\ = "Princess Document" 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image" huzksf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "JPEG Image" huzksf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\ = "Princess Document" huzksf.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1720 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe 1720 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2792 1720 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe 30 PID 1720 wrote to memory of 2792 1720 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe 30 PID 1720 wrote to memory of 2792 1720 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe 30 PID 1720 wrote to memory of 2792 1720 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe 30 PID 1720 wrote to memory of 756 1720 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe 32 PID 1720 wrote to memory of 756 1720 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe 32 PID 1720 wrote to memory of 756 1720 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe 32 PID 1720 wrote to memory of 756 1720 70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe 32 PID 756 wrote to memory of 2996 756 huzksf.exe 33 PID 756 wrote to memory of 2996 756 huzksf.exe 33 PID 756 wrote to memory of 2996 756 huzksf.exe 33 PID 756 wrote to memory of 2996 756 huzksf.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\70af1a0f5edd633a967b6b424409c016_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\inf4D2.tmpC:\Users\Admin\AppData\Local\Temp\inf4D2.tmp2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2792
-
-
C:\Documents and Settings\Admin\Local Settings\huzksf.exe"C:\Documents and Settings\Admin\Local Settings\huzksf.exe"2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Modifies system executable filetype association
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 4523⤵
- Loads dropped DLL
- Program crash
PID:2996
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD570af1a0f5edd633a967b6b424409c016
SHA1c0c8ddc109da87f22126b991ce9aae2a0a666aee
SHA25643d9e3dc473784bc870edcc9507f5626d222217d0e529a03107d45a570615b2f
SHA5121f64e61aee1dfe3fad44ffe56f4b82367644160547dcdebef92ebfe1d335e244650aed4326772fef1fde96cae94895b0bc82b90aa6ff4d91bc9109c9542a2609
-
Filesize
97B
MD5e0b7531a87635a0a11dbd9edc02c7bed
SHA174a50849add50351da332164cbf0ae74a43ce8fe
SHA25620e16cf8b48b2bf3adc59251e7dc293c39eb87922d267a768a403fb76f13d765
SHA512e6cbf6e11ad29d17c219ca44ebbcb43adb76bef3d688f38e43520faded492caff162e249bd477f5441858a26eb567c3f70be3cf3cc181a2fb62aaae4efd23c67
-
Filesize
6B
MD5ec6d94b09549985c04cff9abf86160c5
SHA1494c48927a9453d9f3bead98e70a04d7c9a1fd88
SHA256306a4c0586330df230773a5a1fd7548fe2f81777fc302f2c1d8b32822d4da292
SHA5124072d0b19497115bebd7bc073ca1a6059853829b07b9f42b1a5e88d18753d0b07f562a6925ef9c0a844c7574a20a21b39cd0f50c4985db4b445bc3536175a29a
-
Filesize
212B
MD5ca815edf2e481dd83bd0cff16caaf7a7
SHA1523fa767fac1b4061762c0262d4bc09a1fa7dddf
SHA256f2566afa47cadf4017f82ee80f11355989fd722fbbbbed1954392bbe2aa2b352
SHA512cef1cf04432326393cd700b6c9c4d3d816a61505a3ba99bafc935ffd52a78635130a752d091dd6511d9781ac9458a404bcfc69ca0cdec55da418b3b8bf9dace2
-
Filesize
631B
MD55313060d847a33c356e4e8e286e3de73
SHA1d2b5e89f1fbb96895371e1cde7997ff76814ea9e
SHA256ee482ee2540efc03f1cba611170096f68e14fd4d39bdc8650f3ef6900799fafc
SHA5128c90a8fd5372dadfe95df1deb07bbd14355620dd067b2cce58f76230e2f99129daf65ddc056cab0902ab2b70a4b838a484f62f37b0436e21a963dd1156f551b0
-
Filesize
1B
MD56f8f57715090da2632453988d9a1501b
SHA16b0d31c0d563223024da45691584643ac78c96e8
SHA25662c66a7a5dd70c3146618063c344e531e6d4b59e379808443ce962b3abd63c5a
SHA512f14aae6a0e050b74e4b7b9a5b2ef1a60ceccbbca39b132ae3e8bf88d3a946c6d8687f3266fd2b626419d8b67dcf1d8d7c0fe72d4919d9bd05efbd37070cfb41a
-
Filesize
1B
MD5e1671797c52e15f763380b45e841ec32
SHA158e6b3a414a1e090dfc6029add0f3555ccba127f
SHA2563f79bb7b435b05321651daefd374cdc681dc06faa65e374e38337b88ca046dea
SHA51287c568e037a5fa50b1bc911e8ee19a77c4dd3c22bce9932f86fdd8a216afe1681c89737fada6859e91047eece711ec16da62d6ccb9fd0de2c51f132347350d8c
-
Filesize
117KB
MD59c45d38b74634c9ded60bec640c5c3ca
SHA179d03b17ce9e7ff9595253a402efb856b0888ea0
SHA256bcff89311d792f6428468e813ac6929a346a979f907071c302f418d128eaaf41
SHA5121afa4ac8d5d9c7913d536f158573c669795bad449df0132f87dcc91f6ffcae989ed1c7cec6b4f6f75d3a8bd60a65e15eaa22afea7df7dee46cf40e093bb29a08