Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/08/2024, 22:25
Static task
static1
Behavioral task
behavioral1
Sample
87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe
-
Size
460KB
-
MD5
87ea573002bd2458bc24ea302ade821f
-
SHA1
b1895c282a626738cab83c28458cb9ff5f314ca7
-
SHA256
531eab03314df5ae6c9f5075e63da130c87b7d1cfe8c14251c75152e57519279
-
SHA512
8ecfd2437b05f3d9b22fb9f49117087ae982b5df62ef6b738805af7f4d6f83f15a06c7353d744628bb6394860cb13d8f4ac289ce635a8f862655d3139caef1b9
-
SSDEEP
12288:IlSt6oIHNOhU5O5TYo4XqTig5GSR9CClDDL:IlSt69HNx6T/5xT
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" iBdqphzke5.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pehuv.exe -
Deletes itself 1 IoCs
pid Process 2212 cmd.exe -
Executes dropped EXE 7 IoCs
pid Process 2536 iBdqphzke5.exe 2876 pehuv.exe 2952 astat.exe 2912 astat.exe 2616 dstat.exe 1820 fstat.exe 332 csrss.exe -
Loads dropped DLL 10 IoCs
pid Process 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 2536 iBdqphzke5.exe 2536 iBdqphzke5.exe 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe -
resource yara_rule behavioral1/memory/2912-41-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2912-45-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2912-50-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2912-49-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2912-48-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2912-42-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /G" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /U" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /R" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /D" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /l" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /O" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /S" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /n" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /s" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /m" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /W" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /f" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /q" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /u" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /Y" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /E" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /d" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /x" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /h" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /i" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /z" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /V" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /k" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /v" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /Q" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /A" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /g" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /P" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /r" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /N" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /c" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /I" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /M" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /j" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /a" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /Z" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /p" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /C" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /F" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /T" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /y" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /X" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /L" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /t" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /B" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /e" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /H" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /b" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /k" iBdqphzke5.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /K" pehuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\pehuv = "C:\\Users\\Admin\\pehuv.exe /o" pehuv.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2840 tasklist.exe 2204 tasklist.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2952 set thread context of 2912 2952 astat.exe 38 PID 1820 set thread context of 2496 1820 fstat.exe 41 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iBdqphzke5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pehuv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fstat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language astat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dstat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2536 iBdqphzke5.exe 2536 iBdqphzke5.exe 2912 astat.exe 2876 pehuv.exe 2912 astat.exe 2876 pehuv.exe 2876 pehuv.exe 2876 pehuv.exe 2876 pehuv.exe 2912 astat.exe 2876 pehuv.exe 2912 astat.exe 2912 astat.exe 2876 pehuv.exe 2876 pehuv.exe 2876 pehuv.exe 2912 astat.exe 2876 pehuv.exe 2912 astat.exe 2912 astat.exe 2876 pehuv.exe 2876 pehuv.exe 2876 pehuv.exe 2912 astat.exe 2912 astat.exe 2876 pehuv.exe 2912 astat.exe 2876 pehuv.exe 2912 astat.exe 2912 astat.exe 2876 pehuv.exe 2912 astat.exe 2876 pehuv.exe 2912 astat.exe 2876 pehuv.exe 2912 astat.exe 2876 pehuv.exe 2912 astat.exe 2876 pehuv.exe 2912 astat.exe 2912 astat.exe 2876 pehuv.exe 2912 astat.exe 2876 pehuv.exe 2912 astat.exe 2876 pehuv.exe 2876 pehuv.exe 2912 astat.exe 2912 astat.exe 2912 astat.exe 2876 pehuv.exe 2912 astat.exe 2912 astat.exe 2912 astat.exe 2876 pehuv.exe 2876 pehuv.exe 2876 pehuv.exe 2912 astat.exe 2912 astat.exe 2912 astat.exe 2876 pehuv.exe 2912 astat.exe 2912 astat.exe 2912 astat.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2840 tasklist.exe Token: SeDebugPrivilege 1820 fstat.exe Token: SeDebugPrivilege 1820 fstat.exe Token: SeDebugPrivilege 2204 tasklist.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 2536 iBdqphzke5.exe 2876 pehuv.exe 2952 astat.exe 2616 dstat.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 332 csrss.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2536 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 30 PID 2524 wrote to memory of 2536 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 30 PID 2524 wrote to memory of 2536 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 30 PID 2524 wrote to memory of 2536 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 30 PID 2536 wrote to memory of 2876 2536 iBdqphzke5.exe 32 PID 2536 wrote to memory of 2876 2536 iBdqphzke5.exe 32 PID 2536 wrote to memory of 2876 2536 iBdqphzke5.exe 32 PID 2536 wrote to memory of 2876 2536 iBdqphzke5.exe 32 PID 2536 wrote to memory of 2344 2536 iBdqphzke5.exe 33 PID 2536 wrote to memory of 2344 2536 iBdqphzke5.exe 33 PID 2536 wrote to memory of 2344 2536 iBdqphzke5.exe 33 PID 2536 wrote to memory of 2344 2536 iBdqphzke5.exe 33 PID 2344 wrote to memory of 2840 2344 cmd.exe 35 PID 2344 wrote to memory of 2840 2344 cmd.exe 35 PID 2344 wrote to memory of 2840 2344 cmd.exe 35 PID 2344 wrote to memory of 2840 2344 cmd.exe 35 PID 2524 wrote to memory of 2952 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 37 PID 2524 wrote to memory of 2952 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 37 PID 2524 wrote to memory of 2952 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 37 PID 2524 wrote to memory of 2952 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 37 PID 2952 wrote to memory of 2912 2952 astat.exe 38 PID 2952 wrote to memory of 2912 2952 astat.exe 38 PID 2952 wrote to memory of 2912 2952 astat.exe 38 PID 2952 wrote to memory of 2912 2952 astat.exe 38 PID 2952 wrote to memory of 2912 2952 astat.exe 38 PID 2952 wrote to memory of 2912 2952 astat.exe 38 PID 2952 wrote to memory of 2912 2952 astat.exe 38 PID 2952 wrote to memory of 2912 2952 astat.exe 38 PID 2524 wrote to memory of 2616 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 39 PID 2524 wrote to memory of 2616 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 39 PID 2524 wrote to memory of 2616 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 39 PID 2524 wrote to memory of 2616 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 39 PID 2524 wrote to memory of 1820 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 40 PID 2524 wrote to memory of 1820 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 40 PID 2524 wrote to memory of 1820 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 40 PID 2524 wrote to memory of 1820 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 40 PID 1820 wrote to memory of 1212 1820 fstat.exe 21 PID 1820 wrote to memory of 332 1820 fstat.exe 2 PID 1820 wrote to memory of 2496 1820 fstat.exe 41 PID 1820 wrote to memory of 2496 1820 fstat.exe 41 PID 1820 wrote to memory of 2496 1820 fstat.exe 41 PID 1820 wrote to memory of 2496 1820 fstat.exe 41 PID 1820 wrote to memory of 2496 1820 fstat.exe 41 PID 2524 wrote to memory of 2212 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 43 PID 2524 wrote to memory of 2212 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 43 PID 2524 wrote to memory of 2212 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 43 PID 2524 wrote to memory of 2212 2524 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe 43 PID 2212 wrote to memory of 2204 2212 cmd.exe 45 PID 2212 wrote to memory of 2204 2212 cmd.exe 45 PID 2212 wrote to memory of 2204 2212 cmd.exe 45 PID 2212 wrote to memory of 2204 2212 cmd.exe 45 PID 2876 wrote to memory of 2204 2876 pehuv.exe 45 PID 2876 wrote to memory of 2204 2876 pehuv.exe 45 PID 332 wrote to memory of 844 332 csrss.exe 13
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:844
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\iBdqphzke5.exeC:\Users\Admin\iBdqphzke5.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\pehuv.exe"C:\Users\Admin\pehuv.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del iBdqphzke5.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
-
-
C:\Users\Admin\astat.exeC:\Users\Admin\astat.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\astat.exe"C:\Users\Admin\astat.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2912
-
-
-
C:\Users\Admin\dstat.exeC:\Users\Admin\dstat.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2616
-
-
C:\Users\Admin\fstat.exeC:\Users\Admin\fstat.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2496
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 87ea573002bd2458bc24ea302ade821f_JaffaCakes118.exe3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD54d7cde615a0f534bd5e359951829554b
SHA1c885d00d9000f2a5dbc78f6193a052b36f4fe968
SHA256414fdf9bdcae5136c1295d6d24740c50a484acd81f1f7d0fb5d5c138607cb80a
SHA51233d632f9fbb694440a1ca568c90518784278efd1dc9ee2b57028149d56ebe1f7346d5b59dcfafee2eeaa10091dda05f48958e909d6bfc891e037ae1cfbd048d4
-
Filesize
2KB
MD55b5fd1653bd0e42afb3d06db224163e7
SHA1b3dd821eb82a5ae7504c2c7d9ece4ef823952e38
SHA2560c6f2f90d61085ca8f2454aa82f3b129b629c1773f7c27fb8601dd2affd6bd2c
SHA512dfdd2dbda6486a34b15298388d1de1e3d24f28f5cb1fe2c46e8e978849cf9cee92842ab5ec28be294de8a2d6d736a3632b3f45bfa222495d1254093b286c888b
-
Filesize
60KB
MD587c6498966e3f85fac743c89050aa312
SHA105c165c34cbfa14e4925c33ace81992b0f50a2b5
SHA25630c8328585e41968aff773da16cedbe590dcefd293c7fa74a69c557ecbf2c3c5
SHA512740f7159ee78f73e57c92e583b8c4f97c5dd49b68b9c321da976d7e318819daa28e8dfc76e95e1e3ccee643dc464324c40b481d1849863e287d826adb577b420
-
Filesize
36KB
MD5b6da847084e39e0cecf175c32c91b4bb
SHA1fbfd9494fabed5220cdf01866ff088fe7adc535b
SHA256065781e8a55cf59cb926d5950e0039e19b50b1e081023404fbff4d7a32fc9cbe
SHA51259d372ea36904cd48c99f2f34740c22004b35c5e5dada2417813b0463292af19e4aa5ba4552cc443da373e40ba03a1f7906019a567806806f5972c202a31d9d2
-
Filesize
271KB
MD534353cf7e1d1b10bcbbcae0745110535
SHA12fb471681daac6f6d66477b7772025da4f58c508
SHA256b2d7a66e2d10d8943e48d6f3ad75237ff379e82ab0101a620406c4569be1d959
SHA5127404f82abfabd21d6f2a88b55f6f0ff886bb0a1f16a9d45c6883d74daa26451f862a10a78646c549c3a3264ba4bd9fb44949d470493af895973dd05a0ec311e6
-
Filesize
244KB
MD5a4cdb62cf4866a17e742e7e9cc73d237
SHA130d94f8e872455ac569949ac4c768d0a0cdfbba7
SHA256c741d649bf5b72fbe97470820ce994ce29b153baae14af10c3a2a9adc3098b32
SHA512c4447f95565d3e5dc0ef7712382325280bedf127ac682f85f4043b586afb4188633f2c73277595eb31fe45d992107492f42c82a71f448286a9cb8fac4bfb3671
-
Filesize
244KB
MD5f317b130c9f4e47d633d6a20d26cc282
SHA1745bcbe5c914ad7a8aea270d18f5edbf95a892b4
SHA256bf7a96fc85e2a0dc3e5c61508fed099df10f46299bb25b093898eea5648e40da
SHA51216842119bc7209fd7388c209a3ef862fdacb0f1f43a253456251cc31d03f867e02bbd5b58663e812a118493c0efe740bb334cf4c26dde5164174c26a70f1e5fa