Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 09:32
Behavioral task
behavioral1
Sample
958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
14 signatures
150 seconds
General
-
Target
958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
958696db34f63219fc9345a0f74f62ae
-
SHA1
d461e9d74a17327b5ece1f4a763ca144d59145e0
-
SHA256
7252a6dccc6185eab3da2db31e7db995c5dd1fd1950720a57fec026f635b55bf
-
SHA512
22c5179249e91522021bc908b7ccfb87ca1190c250020851e9ca5dfdc0f6e0a164a641de62f6bd59df869d9342c695f97fb9eb308740afee75d8ad4f1226da5e
-
SSDEEP
24576:2gtzxyA65kT+o/NQzGFuzUWZMSWn/5TfdG4yVNEW8gsdorQwPPweMhRGh0xz/Caj:289f/9eNW/5Tfk4GHrbdkuaWA
Score
8/10
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D000036F-A504-F6B0-F0E4-E10460304006} 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D000036F-A504-F6B0-F0E4-E10460304006}\StubPath = "C:\\Windows\\shelll.exe" 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D000036F-A504-F6B0-F0E4-E10460304006}\ = "shar" 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D000036F-A504-F6B0-F0E4-E10460304006}\ComponentID = "shar" 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D000036F-A504-F6B0-F0E4-E10460304006}\Locale = "DE" 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D000036F-A504-F6B0-F0E4-E10460304006}\Version = "6,5,5,3" 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 1656 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2660 shelll.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe Key opened \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine shelll.exe -
resource yara_rule behavioral1/memory/2316-0-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2316-9-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/files/0x000c000000012285-16.dat themida behavioral1/memory/2660-18-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-25-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2316-34-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-36-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-38-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-39-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-41-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-42-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-43-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-45-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-47-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-49-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-51-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-53-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-55-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-57-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-59-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-61-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-63-0x0000000000400000-0x000000000071A000-memory.dmp themida behavioral1/memory/2660-65-0x0000000000400000-0x000000000071A000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\shelll.exe" 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\win.com 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\mswinsck.ocx shelll.exe File opened for modification C:\Windows\shelll.exe.bat 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe File opened for modification C:\Windows\shelll.exe 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe File created C:\Windows\shelll.exe 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe File opened for modification C:\Windows\shelll.exe shelll.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shelll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\mswinsck.ocx" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\mswinsck.ocx, 1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\mswinsck.ocx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe 2660 shelll.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe Token: SeBackupPrivilege 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 2660 shelll.exe 2660 shelll.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2660 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 31 PID 2316 wrote to memory of 2660 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 31 PID 2316 wrote to memory of 2660 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 31 PID 2316 wrote to memory of 2660 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 31 PID 2316 wrote to memory of 2660 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 31 PID 2316 wrote to memory of 2660 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 31 PID 2316 wrote to memory of 2660 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 31 PID 2660 wrote to memory of 2328 2660 shelll.exe 32 PID 2660 wrote to memory of 2328 2660 shelll.exe 32 PID 2660 wrote to memory of 2328 2660 shelll.exe 32 PID 2660 wrote to memory of 2328 2660 shelll.exe 32 PID 2660 wrote to memory of 2328 2660 shelll.exe 32 PID 2660 wrote to memory of 2328 2660 shelll.exe 32 PID 2660 wrote to memory of 2328 2660 shelll.exe 32 PID 2316 wrote to memory of 1656 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 33 PID 2316 wrote to memory of 1656 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 33 PID 2316 wrote to memory of 1656 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 33 PID 2316 wrote to memory of 1656 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 33 PID 2316 wrote to memory of 1656 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 33 PID 2316 wrote to memory of 1656 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 33 PID 2316 wrote to memory of 1656 2316 958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\958696db34f63219fc9345a0f74f62ae_JaffaCakes118.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\shelll.exeC:\Windows\shelll.exe 12⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Windows\mswinsck.ocx"3⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2328
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\shelll.exe.bat2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:1656
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
Filesize
1.5MB
MD5958696db34f63219fc9345a0f74f62ae
SHA1d461e9d74a17327b5ece1f4a763ca144d59145e0
SHA2567252a6dccc6185eab3da2db31e7db995c5dd1fd1950720a57fec026f635b55bf
SHA51222c5179249e91522021bc908b7ccfb87ca1190c250020851e9ca5dfdc0f6e0a164a641de62f6bd59df869d9342c695f97fb9eb308740afee75d8ad4f1226da5e
-
Filesize
209B
MD5caf469c423737d8c85e8a4e23f55ed6b
SHA1294b622f29e4ddace54de8c6d5c36d33f1f07a34
SHA256d2b64ba84be5ab06385dac201a27de1f28ee2ad8bf6a6c162f3e3f5f792b1507
SHA512705347f7efb41a09f9eecfda65b2d30d7ec271323a7db2d1e810ed1354408cabf6b1154c73379603ba82521275b677e1c000620146c182af9585c12b208e8384