Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/08/2024, 08:27
Static task
static1
Behavioral task
behavioral1
Sample
856affc31c3958d297ea725b643655e7_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
856affc31c3958d297ea725b643655e7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
856affc31c3958d297ea725b643655e7_JaffaCakes118.exe
-
Size
556KB
-
MD5
856affc31c3958d297ea725b643655e7
-
SHA1
57c4b6013d8e17a14a4c696c688ba5de68144efe
-
SHA256
dbfa62dbc4e6db7006009e5c59b7e7fb7665d918eadd2f5d73724c9e4f628160
-
SHA512
da4b6de960b5ea975c417074a6aa29ae9a5679f0d5cd34f2752d9636571d2b378648db81d5d128b5acba725dd64388013205e87ecd21dce37b4d0d274cfccb9c
-
SSDEEP
12288:0Z/db/+1xBFf1IfSKyiRVnuDCHFUcYnY/kjDx1anrpukz/niMFP60:0Rd21xB/0Mi/PHFUKcjXgpukeM9
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 42 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Windows\\New\\Newr.exe restart" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Windows\\New\\Newr.exe restart" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1W7A2D2S-S57D-63O0-50IY-830O4LL482CQ}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe restart" svchost.exe -
Executes dropped EXE 39 IoCs
pid Process 2096 Newr.exe 2704 Newr.exe 2688 Newr.exe 2556 Newr.exe 3064 Newr.exe 2764 Newr.exe 796 Newr.exe 332 Newr.exe 2092 Newr.exe 1108 Newr.exe 1656 Newr.exe 1900 Newr.exe 884 Newr.exe 2600 Newr.exe 868 Newr.exe 1968 Newr.exe 2972 Newr.exe 2264 Newr.exe 2340 Newr.exe 1140 Newr.exe 1856 Newr.exe 2152 Newr.exe 2912 Newr.exe 3060 Newr.exe 1744 Newr.exe 2236 Newr.exe 1796 Newr.exe 280 Newr.exe 2680 Newr.exe 1500 Newr.exe 1008 Newr.exe 324 Newr.exe 1632 Newr.exe 868 Newr.exe 1636 Newr.exe 3000 Newr.exe 2840 Newr.exe 2752 Newr.exe 2344 Newr.exe -
Loads dropped DLL 21 IoCs
pid Process 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe -
resource yara_rule behavioral1/memory/2808-11-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/2808-15-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/2808-13-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/2808-23-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/2808-22-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/2808-21-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/2828-28-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/2808-29-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/2808-30-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/2736-56-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/2736-55-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/2736-58-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/2736-54-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/2736-59-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/1924-82-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/1924-80-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/1924-81-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/1924-85-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/1924-86-0x0000000010000000-0x000000001031C000-memory.dmp upx behavioral1/memory/2828-116-0x0000000002540000-0x00000000026E8000-memory.dmp upx behavioral1/memory/2828-146-0x0000000002540000-0x00000000026E8000-memory.dmp upx behavioral1/memory/2828-173-0x0000000002540000-0x00000000026E8000-memory.dmp upx behavioral1/memory/2828-257-0x0000000002540000-0x00000000026E8000-memory.dmp upx behavioral1/memory/2828-285-0x0000000002540000-0x00000000026E8000-memory.dmp upx behavioral1/memory/2828-340-0x0000000002540000-0x00000000026E8000-memory.dmp upx behavioral1/memory/2828-394-0x0000000002540000-0x00000000026E8000-memory.dmp upx behavioral1/memory/2828-547-0x0000000002540000-0x00000000026E8000-memory.dmp upx -
Adds Run key to start application 2 TTPs 62 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\SysWOW64\\svchost.exe" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Users\\Admin\\AppData\\Roaming\\New\\Newr.exe" svchost.exe -
Suspicious use of SetThreadContext 40 IoCs
description pid Process procid_target PID 1684 set thread context of 2796 1684 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 30 PID 2796 set thread context of 2808 2796 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 31 PID 2096 set thread context of 2704 2096 Newr.exe 34 PID 2704 set thread context of 2736 2704 Newr.exe 35 PID 2688 set thread context of 2556 2688 Newr.exe 37 PID 2556 set thread context of 1924 2556 Newr.exe 38 PID 3064 set thread context of 2764 3064 Newr.exe 40 PID 2764 set thread context of 2920 2764 Newr.exe 41 PID 796 set thread context of 332 796 Newr.exe 43 PID 332 set thread context of 2260 332 Newr.exe 44 PID 2092 set thread context of 1108 2092 Newr.exe 46 PID 1108 set thread context of 2508 1108 Newr.exe 47 PID 1656 set thread context of 1900 1656 Newr.exe 49 PID 1900 set thread context of 1644 1900 Newr.exe 50 PID 884 set thread context of 2600 884 Newr.exe 52 PID 2600 set thread context of 2144 2600 Newr.exe 53 PID 868 set thread context of 1968 868 Newr.exe 55 PID 1968 set thread context of 1568 1968 Newr.exe 56 PID 2972 set thread context of 2264 2972 Newr.exe 58 PID 2264 set thread context of 2336 2264 Newr.exe 59 PID 2340 set thread context of 1140 2340 Newr.exe 61 PID 1140 set thread context of 2500 1140 Newr.exe 62 PID 1856 set thread context of 2152 1856 Newr.exe 64 PID 2152 set thread context of 916 2152 Newr.exe 65 PID 2912 set thread context of 3060 2912 Newr.exe 67 PID 3060 set thread context of 2492 3060 Newr.exe 68 PID 1744 set thread context of 2236 1744 Newr.exe 70 PID 2236 set thread context of 2416 2236 Newr.exe 71 PID 1796 set thread context of 280 1796 Newr.exe 73 PID 280 set thread context of 2596 280 Newr.exe 74 PID 2680 set thread context of 1500 2680 Newr.exe 76 PID 1500 set thread context of 2536 1500 Newr.exe 77 PID 1008 set thread context of 324 1008 Newr.exe 79 PID 324 set thread context of 1552 324 Newr.exe 80 PID 1632 set thread context of 868 1632 Newr.exe 82 PID 868 set thread context of 2372 868 Newr.exe 83 PID 1636 set thread context of 3000 1636 Newr.exe 85 PID 3000 set thread context of 2832 3000 Newr.exe 86 PID 2840 set thread context of 2752 2840 Newr.exe 88 PID 2752 set thread context of 2336 2752 Newr.exe 89 -
Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File opened for modification C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe File created C:\Windows\New\Newr.exe svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 62 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Newr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of SetWindowsHookEx 41 IoCs
pid Process 1684 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 2808 svchost.exe 2096 Newr.exe 2736 svchost.exe 2688 Newr.exe 1924 svchost.exe 3064 Newr.exe 2920 svchost.exe 796 Newr.exe 2260 svchost.exe 2092 Newr.exe 2508 svchost.exe 1656 Newr.exe 1644 svchost.exe 884 Newr.exe 2144 svchost.exe 868 Newr.exe 1568 svchost.exe 2972 Newr.exe 2336 svchost.exe 2340 Newr.exe 2500 svchost.exe 1856 Newr.exe 916 svchost.exe 2912 Newr.exe 2492 svchost.exe 1744 Newr.exe 2416 svchost.exe 1796 Newr.exe 2596 svchost.exe 2680 Newr.exe 2536 svchost.exe 1008 Newr.exe 1552 svchost.exe 1632 Newr.exe 2372 svchost.exe 1636 Newr.exe 2832 svchost.exe 2840 Newr.exe 2336 svchost.exe 2344 Newr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2796 1684 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 30 PID 1684 wrote to memory of 2796 1684 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 30 PID 1684 wrote to memory of 2796 1684 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 30 PID 1684 wrote to memory of 2796 1684 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 30 PID 1684 wrote to memory of 2796 1684 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 30 PID 1684 wrote to memory of 2796 1684 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 30 PID 1684 wrote to memory of 2796 1684 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 30 PID 1684 wrote to memory of 2796 1684 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 30 PID 1684 wrote to memory of 2796 1684 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 30 PID 1684 wrote to memory of 2796 1684 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 30 PID 1684 wrote to memory of 2796 1684 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 30 PID 1684 wrote to memory of 2796 1684 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 30 PID 1684 wrote to memory of 2796 1684 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 30 PID 1684 wrote to memory of 2796 1684 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 30 PID 1684 wrote to memory of 2796 1684 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 30 PID 2796 wrote to memory of 2808 2796 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 31 PID 2796 wrote to memory of 2808 2796 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 31 PID 2796 wrote to memory of 2808 2796 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 31 PID 2796 wrote to memory of 2808 2796 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 31 PID 2796 wrote to memory of 2808 2796 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 31 PID 2796 wrote to memory of 2808 2796 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 31 PID 2796 wrote to memory of 2808 2796 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 31 PID 2796 wrote to memory of 2808 2796 856affc31c3958d297ea725b643655e7_JaffaCakes118.exe 31 PID 2808 wrote to memory of 2828 2808 svchost.exe 32 PID 2808 wrote to memory of 2828 2808 svchost.exe 32 PID 2808 wrote to memory of 2828 2808 svchost.exe 32 PID 2808 wrote to memory of 2828 2808 svchost.exe 32 PID 2808 wrote to memory of 2828 2808 svchost.exe 32 PID 2828 wrote to memory of 2096 2828 svchost.exe 33 PID 2828 wrote to memory of 2096 2828 svchost.exe 33 PID 2828 wrote to memory of 2096 2828 svchost.exe 33 PID 2828 wrote to memory of 2096 2828 svchost.exe 33 PID 2096 wrote to memory of 2704 2096 Newr.exe 34 PID 2096 wrote to memory of 2704 2096 Newr.exe 34 PID 2096 wrote to memory of 2704 2096 Newr.exe 34 PID 2096 wrote to memory of 2704 2096 Newr.exe 34 PID 2096 wrote to memory of 2704 2096 Newr.exe 34 PID 2096 wrote to memory of 2704 2096 Newr.exe 34 PID 2096 wrote to memory of 2704 2096 Newr.exe 34 PID 2096 wrote to memory of 2704 2096 Newr.exe 34 PID 2096 wrote to memory of 2704 2096 Newr.exe 34 PID 2096 wrote to memory of 2704 2096 Newr.exe 34 PID 2096 wrote to memory of 2704 2096 Newr.exe 34 PID 2096 wrote to memory of 2704 2096 Newr.exe 34 PID 2096 wrote to memory of 2704 2096 Newr.exe 34 PID 2096 wrote to memory of 2704 2096 Newr.exe 34 PID 2096 wrote to memory of 2704 2096 Newr.exe 34 PID 2704 wrote to memory of 2736 2704 Newr.exe 35 PID 2704 wrote to memory of 2736 2704 Newr.exe 35 PID 2704 wrote to memory of 2736 2704 Newr.exe 35 PID 2704 wrote to memory of 2736 2704 Newr.exe 35 PID 2704 wrote to memory of 2736 2704 Newr.exe 35 PID 2704 wrote to memory of 2736 2704 Newr.exe 35 PID 2704 wrote to memory of 2736 2704 Newr.exe 35 PID 2704 wrote to memory of 2736 2704 Newr.exe 35 PID 2828 wrote to memory of 2688 2828 svchost.exe 36 PID 2828 wrote to memory of 2688 2828 svchost.exe 36 PID 2828 wrote to memory of 2688 2828 svchost.exe 36 PID 2828 wrote to memory of 2688 2828 svchost.exe 36 PID 2688 wrote to memory of 2556 2688 Newr.exe 37 PID 2688 wrote to memory of 2556 2688 Newr.exe 37 PID 2688 wrote to memory of 2556 2688 Newr.exe 37 PID 2688 wrote to memory of 2556 2688 Newr.exe 37 PID 2688 wrote to memory of 2556 2688 Newr.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\856affc31c3958d297ea725b643655e7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\856affc31c3958d297ea725b643655e7_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\856affc31c3958d297ea725b643655e7_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\856affc31c3958d297ea725b643655e7_JaffaCakes118.exe2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2736
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2556 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1924
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3064 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2920
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:796 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:332 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2260
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2092 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1108 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2508
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1656 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1900 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1644
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:884 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2600 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2144
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:868 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1968 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1568
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2972 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2264 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2336
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2340 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1140 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2500
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1856 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2152 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:916
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2912 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3060 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2492
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1744 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2236 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2416
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1796 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:280 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2596
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2680 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1500 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2536
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1008 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:324 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1552
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1632 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:868 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2372
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1636 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3000 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2832
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2840 -
C:\Windows\New\Newr.exeC:\Windows\New\Newr.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2752 -
C:\Windows\SysWOW64\svchost.exesvchost.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2336
-
-
-
-
C:\Windows\New\Newr.exe"C:\Windows\New\Newr.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2344
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
556KB
MD556d7aa988f8509e39604afa54d9cfbb4
SHA19a9d5e84b40d4d29ee0d25d0c36730e1789fd39e
SHA256674c510f6bc3233ac0879b5d073b7fc38a642e861d6f9cadb3188bc4c1a69359
SHA5127707278bc21f700c022b2edec88ee8d0b268310837350fb1997f48a4919c87d8a9ca5e8f6b28cc23341a0e73e6b4fbf3b2ab82648984f84d28c0f576aea40876
-
Filesize
556KB
MD539dcd1a9131b83475945a2a06aea620a
SHA1476c1456fb750a6317178471d5b40f497135eae1
SHA256ea5ca7dc8a597f8afd3accc2691f729be01823f533b9e6a49bc4496ce4c290e9
SHA51253530fd6329fa02611ceb3347bb7e68356b6bb5152eedf96cca43006b393dcaa1567dec26eed4da846dc8f0548915c43948b1039efc513c594308dbdaeb99ac7
-
Filesize
556KB
MD5da1854ddf68bc2861e92963ec5df86c3
SHA10a906286463525d01cb3c669baf744bcbb7d187c
SHA2563edfb01beec4ffad8c2a72609c58d8f93fe137f30cfc72513802e50e117abd94
SHA5123922fe296c4bd39fed2e902707ed216e0934bb5511f2074ab165d318bf5a08b27c3a5c73afdb745a8174b8023d504fa13f7951e7dbc676825fd723ba90edd79f
-
Filesize
556KB
MD5856affc31c3958d297ea725b643655e7
SHA157c4b6013d8e17a14a4c696c688ba5de68144efe
SHA256dbfa62dbc4e6db7006009e5c59b7e7fb7665d918eadd2f5d73724c9e4f628160
SHA512da4b6de960b5ea975c417074a6aa29ae9a5679f0d5cd34f2752d9636571d2b378648db81d5d128b5acba725dd64388013205e87ecd21dce37b4d0d274cfccb9c