Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/08/2024, 23:14
Static task
static1
Behavioral task
behavioral1
Sample
83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe
-
Size
240KB
-
MD5
83ef1d799261ed45ad00488f7210639c
-
SHA1
71e28eb94341a1d8c77d159d95c72e1f3ea62705
-
SHA256
9894be6e64187c5b681d5c0505b02d19926ff67ecce0f6f7bb4d94c28689b7e6
-
SHA512
9cd5623190ab4f1f1f8daacd3ff80cb3e9b28b890f030b56659333a86c65246d22d962aae8aa8b0a86574fc707c96b2ca59d71253123209b6526c53ccd4f5ce2
-
SSDEEP
6144:tZy5BoKvoyi7NGm9yCqSwDvQkqj+pyvBM790:jYe0LT0K8tj+Es0
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x00080000000234ba-40.dat acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 1.exe -
Executes dropped EXE 2 IoCs
pid Process 1124 1.exe 1248 Svchost.exe -
Loads dropped DLL 4 IoCs
pid Process 1312 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe 1248 Svchost.exe 512 regsvr32.exe 1248 Svchost.exe -
resource yara_rule behavioral2/files/0x00080000000234b0-18.dat upx behavioral2/memory/1124-20-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1248-35-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/files/0x00080000000234ba-40.dat upx behavioral2/memory/1124-32-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1248-49-0x0000000010000000-0x0000000010014000-memory.dmp upx behavioral2/memory/1248-50-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1248-52-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1248-54-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1248-55-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1248-57-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1248-59-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1248-61-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1248-63-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1248-65-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1248-67-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1248-69-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1248-71-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1248-73-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1248-75-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral2/memory/1248-77-0x0000000000400000-0x0000000000458000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EQPRjDl = "\"C:\\Windows\\Svchost.exe\"" 1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\S2BcJ = "\"C:\\Windows\\Svchost.exe\"" 1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kfUWnY = "\"C:\\Windows\\Svchost.exe\"" Svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TBPD3 = "\"C:\\Windows\\Svchost.exe\"" Svchost.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mswinsck.ocx Svchost.exe File opened for modification C:\Windows\SysWOW64\win.com 1.exe File opened for modification C:\Windows\SysWOW64\zlib.dll Svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2252 set thread context of 1312 2252 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe 84 -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Svchost.exe 1.exe File created C:\Windows\Svchost.exe 1.exe File opened for modification C:\Windows\Svchost.exe Svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3136 1312 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx, 1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1124 1.exe 1124 1.exe 1124 1.exe 1124 1.exe 1124 1.exe 1124 1.exe 1124 1.exe 1124 1.exe 1124 1.exe 1124 1.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2252 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe 1312 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe 1124 1.exe 1248 Svchost.exe 1248 Svchost.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2252 wrote to memory of 1312 2252 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe 84 PID 2252 wrote to memory of 1312 2252 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe 84 PID 2252 wrote to memory of 1312 2252 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe 84 PID 2252 wrote to memory of 1312 2252 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe 84 PID 2252 wrote to memory of 1312 2252 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe 84 PID 2252 wrote to memory of 1312 2252 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe 84 PID 2252 wrote to memory of 1312 2252 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe 84 PID 2252 wrote to memory of 1312 2252 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe 84 PID 1312 wrote to memory of 4048 1312 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe 86 PID 1312 wrote to memory of 4048 1312 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe 86 PID 1312 wrote to memory of 1124 1312 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe 92 PID 1312 wrote to memory of 1124 1312 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe 92 PID 1312 wrote to memory of 1124 1312 83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe 92 PID 1124 wrote to memory of 3036 1124 1.exe 94 PID 1124 wrote to memory of 3036 1124 1.exe 94 PID 1124 wrote to memory of 3036 1124 1.exe 94 PID 1124 wrote to memory of 1248 1124 1.exe 95 PID 1124 wrote to memory of 1248 1124 1.exe 95 PID 1124 wrote to memory of 1248 1124 1.exe 95 PID 1248 wrote to memory of 512 1248 Svchost.exe 96 PID 1248 wrote to memory of 512 1248 Svchost.exe 96 PID 1248 wrote to memory of 512 1248 Svchost.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\83ef1d799261ed45ad00488f7210639c_JaffaCakes118.exe"3⤵PID:4048
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 4883⤵
- Program crash
PID:3136
-
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"4⤵PID:3036
-
-
C:\Windows\Svchost.exeC:\Windows\Svchost.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\system32\mswinsck.ocx"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:512
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1312 -ip 13121⤵PID:2556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
150KB
MD58a6ae017f002a7d9bd39cc4755ee8771
SHA17de6f53904a48956f8e2ecf91c5dd20b9e7b46f5
SHA256e97f9845b38daae0d5b495cee21afa8ca20476c4122523256ee44ddb79715356
SHA5121b9253013afebe61a685470a508ebae409311f8230cb65182fc16d8ed68bbaa891edad0e1a36401d878c46044df203c715c5c47acb70290a278d71d3818b6662
-
Filesize
625KB
MD5358611b92e360a749054fdc7b6b076ea
SHA1d6d2224161fee024ab3767a81ed57f7e57d0c1ce
SHA25679782a87dfd093a0e4196d6f0aa4d46a55c0290f6145f5f8fa60e53c540f89b4
SHA5120986c84ed52b42b3aeb96479032e188165d1fa1d5c7018e240b444e03eb6317365ea51fc0233263f7e97f099cd3ca3094ab0b177c0405816bc800b41f42523ad
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
Filesize
27KB
MD5200d52d81e9b4b05fa58ce5fbe511dba
SHA1c0d809ee93816d87388ed4e7fd6fca93d70294d2
SHA256d4fe89dc2e7775f4ef0dfc70ed6999b8f09635326e05e08a274d464d1814c617
SHA5127b1df70d76855d65cf246051e7b9f7119720a695d41ace1eb00e45e93e6de80d083b953269166bdee7137dbd9f3e5681e36bb036f151cea383c10d82957f39c5