Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 10:57
Static task
static1
Behavioral task
behavioral1
Sample
95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe
-
Size
544KB
-
MD5
95cf4689c08a836b1bc6ce87fbf1a895
-
SHA1
64ee0a6ffe32e31c96b13ce8be219f8d44300b28
-
SHA256
fd125d57a48c3f167fae13603cd4d4f4c661db870d637f95613625be68a48a88
-
SHA512
bd2bef62cf6ecf1e7a8c5d7b910ae64a7372841207e04d771753faa0f225794ac014b240900e60086be37ae7205af10e723c3be61ff5148585782d3d5ab62115
-
SSDEEP
12288:vQIWT/UzJW8ivxh7vHzgryd4GT1QOoJqbbEUqe9mJd/uB28Rr8O9F8/CwM:vQI+cJHiJRTHnxhUqEhe9suB2C8O9O
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\32ed4225\\X" Explorer.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gau5f8p1.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lauuh.exe -
Deletes itself 1 IoCs
pid Process 2116 cmd.exe -
Executes dropped EXE 11 IoCs
pid Process 2704 gau5f8p1.exe 2764 lauuh.exe 2876 2des.exe 3004 2des.exe 2828 2des.exe 1644 2des.exe 2924 2des.exe 2472 2des.exe 2916 3des.exe 336 csrss.exe 1076 X -
Loads dropped DLL 10 IoCs
pid Process 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 2704 gau5f8p1.exe 2704 gau5f8p1.exe 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 2916 3des.exe 2916 3des.exe -
resource yara_rule behavioral1/memory/3004-54-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/3004-58-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/3004-57-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2828-63-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2924-85-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2924-83-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1644-86-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1644-87-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2924-80-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1644-67-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2828-72-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1644-75-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2924-90-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2828-74-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1644-70-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1644-65-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2924-78-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2828-56-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2828-52-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2828-50-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/3004-46-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/3004-43-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/3004-41-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/3004-137-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1644-152-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2924-153-0x0000000000400000-0x0000000000407000-memory.dmp upx -
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /o" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /a" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /R" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /r" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /X" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /n" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /H" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /G" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /s" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /T" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /L" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /K" gau5f8p1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /F" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /k" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /c" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /p" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /V" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /h" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /J" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /C" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /t" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /Q" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /B" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /E" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /I" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /i" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /Y" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /O" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /P" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /q" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /g" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /u" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /w" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /e" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /W" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /v" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /S" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /m" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /Z" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /l" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /M" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /x" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /d" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /z" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /D" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /U" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /f" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /b" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /A" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /y" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /j" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /N" lauuh.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lauuh = "C:\\Users\\Admin\\lauuh.exe /K" lauuh.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2des.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 2des.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2976 tasklist.exe 304 tasklist.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2876 set thread context of 3004 2876 2des.exe 32 PID 2876 set thread context of 2828 2876 2des.exe 33 PID 2876 set thread context of 1644 2876 2des.exe 34 PID 2876 set thread context of 2924 2876 2des.exe 35 PID 2876 set thread context of 2472 2876 2des.exe 36 PID 2916 set thread context of 2304 2916 3des.exe 44 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lauuh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2des.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3des.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gau5f8p1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2des.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2des.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \registry\machine\Software\Classes\Interface\{21240613-e5f7-3097-7118-07a5e49ca0cc} 3des.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21240613-e5f7-3097-7118-07a5e49ca0cc}\u = "188" 3des.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{21240613-e5f7-3097-7118-07a5e49ca0cc}\cid = "5220998068124207595" 3des.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2704 gau5f8p1.exe 2704 gau5f8p1.exe 2828 2des.exe 1644 2des.exe 2764 lauuh.exe 2916 3des.exe 2916 3des.exe 2916 3des.exe 2916 3des.exe 2764 lauuh.exe 1076 X 2828 2des.exe 1644 2des.exe 2764 lauuh.exe 2764 lauuh.exe 2764 lauuh.exe 2764 lauuh.exe 2828 2des.exe 2828 2des.exe 2828 2des.exe 2764 lauuh.exe 2764 lauuh.exe 2764 lauuh.exe 2828 2des.exe 2764 lauuh.exe 2828 2des.exe 2764 lauuh.exe 2828 2des.exe 2764 lauuh.exe 2764 lauuh.exe 2828 2des.exe 2764 lauuh.exe 2828 2des.exe 2764 lauuh.exe 2828 2des.exe 2828 2des.exe 2828 2des.exe 2764 lauuh.exe 2764 lauuh.exe 2828 2des.exe 2764 lauuh.exe 2828 2des.exe 2828 2des.exe 2764 lauuh.exe 2764 lauuh.exe 2828 2des.exe 2828 2des.exe 2764 lauuh.exe 2828 2des.exe 2828 2des.exe 2764 lauuh.exe 2828 2des.exe 2764 lauuh.exe 2764 lauuh.exe 2828 2des.exe 2828 2des.exe 2764 lauuh.exe 2828 2des.exe 2828 2des.exe 2828 2des.exe 2764 lauuh.exe 2828 2des.exe 2764 lauuh.exe 2764 lauuh.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2976 tasklist.exe Token: SeDebugPrivilege 2916 3des.exe Token: SeDebugPrivilege 2916 3des.exe Token: SeDebugPrivilege 304 tasklist.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 2704 gau5f8p1.exe 2764 lauuh.exe 2876 2des.exe 3004 2des.exe 2924 2des.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 336 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2704 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 29 PID 3012 wrote to memory of 2704 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 29 PID 3012 wrote to memory of 2704 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 29 PID 3012 wrote to memory of 2704 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 29 PID 2704 wrote to memory of 2764 2704 gau5f8p1.exe 30 PID 2704 wrote to memory of 2764 2704 gau5f8p1.exe 30 PID 2704 wrote to memory of 2764 2704 gau5f8p1.exe 30 PID 2704 wrote to memory of 2764 2704 gau5f8p1.exe 30 PID 3012 wrote to memory of 2876 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 31 PID 3012 wrote to memory of 2876 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 31 PID 3012 wrote to memory of 2876 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 31 PID 3012 wrote to memory of 2876 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 31 PID 2876 wrote to memory of 3004 2876 2des.exe 32 PID 2876 wrote to memory of 3004 2876 2des.exe 32 PID 2876 wrote to memory of 3004 2876 2des.exe 32 PID 2876 wrote to memory of 3004 2876 2des.exe 32 PID 2876 wrote to memory of 3004 2876 2des.exe 32 PID 2876 wrote to memory of 3004 2876 2des.exe 32 PID 2876 wrote to memory of 3004 2876 2des.exe 32 PID 2876 wrote to memory of 3004 2876 2des.exe 32 PID 2876 wrote to memory of 2828 2876 2des.exe 33 PID 2876 wrote to memory of 2828 2876 2des.exe 33 PID 2876 wrote to memory of 2828 2876 2des.exe 33 PID 2876 wrote to memory of 2828 2876 2des.exe 33 PID 2876 wrote to memory of 2828 2876 2des.exe 33 PID 2876 wrote to memory of 2828 2876 2des.exe 33 PID 2876 wrote to memory of 2828 2876 2des.exe 33 PID 2876 wrote to memory of 2828 2876 2des.exe 33 PID 2876 wrote to memory of 1644 2876 2des.exe 34 PID 2876 wrote to memory of 1644 2876 2des.exe 34 PID 2876 wrote to memory of 1644 2876 2des.exe 34 PID 2876 wrote to memory of 1644 2876 2des.exe 34 PID 2876 wrote to memory of 1644 2876 2des.exe 34 PID 2876 wrote to memory of 1644 2876 2des.exe 34 PID 2876 wrote to memory of 1644 2876 2des.exe 34 PID 2876 wrote to memory of 1644 2876 2des.exe 34 PID 2876 wrote to memory of 2924 2876 2des.exe 35 PID 2876 wrote to memory of 2924 2876 2des.exe 35 PID 2876 wrote to memory of 2924 2876 2des.exe 35 PID 2876 wrote to memory of 2924 2876 2des.exe 35 PID 2876 wrote to memory of 2924 2876 2des.exe 35 PID 2876 wrote to memory of 2924 2876 2des.exe 35 PID 2876 wrote to memory of 2924 2876 2des.exe 35 PID 2876 wrote to memory of 2924 2876 2des.exe 35 PID 2876 wrote to memory of 2472 2876 2des.exe 36 PID 2876 wrote to memory of 2472 2876 2des.exe 36 PID 2876 wrote to memory of 2472 2876 2des.exe 36 PID 2876 wrote to memory of 2472 2876 2des.exe 36 PID 2876 wrote to memory of 2472 2876 2des.exe 36 PID 2704 wrote to memory of 1564 2704 gau5f8p1.exe 37 PID 2704 wrote to memory of 1564 2704 gau5f8p1.exe 37 PID 2704 wrote to memory of 1564 2704 gau5f8p1.exe 37 PID 2704 wrote to memory of 1564 2704 gau5f8p1.exe 37 PID 3012 wrote to memory of 2916 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 39 PID 3012 wrote to memory of 2916 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 39 PID 3012 wrote to memory of 2916 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 39 PID 3012 wrote to memory of 2916 3012 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 39 PID 1564 wrote to memory of 2976 1564 cmd.exe 40 PID 1564 wrote to memory of 2976 1564 cmd.exe 40 PID 1564 wrote to memory of 2976 1564 cmd.exe 40 PID 1564 wrote to memory of 2976 1564 cmd.exe 40 PID 2764 wrote to memory of 2976 2764 lauuh.exe 40 PID 2764 wrote to memory of 2976 2764 lauuh.exe 40 PID 2916 wrote to memory of 1196 2916 3des.exe 20
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:336
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies WinLogon for persistence
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\gau5f8p1.exeC:\Users\Admin\gau5f8p1.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\lauuh.exe"C:\Users\Admin\lauuh.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del gau5f8p1.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
-
-
C:\Users\Admin\2des.exeC:\Users\Admin\2des.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3004
-
-
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2828
-
-
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1644
-
-
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2924
-
-
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"4⤵
- Executes dropped EXE
PID:2472
-
-
-
C:\Users\Admin\3des.exeC:\Users\Admin\3des.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\32ed4225\X*0*bc*b78b49eb*31.193.3.240:534⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1076
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2304
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2116 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:304
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:1696
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD51149c1bd71248a9d170e4568fb08df30
SHA16f77f183d65709901f476c5d6eebaed060a495f9
SHA256c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1
SHA5129e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459
-
Filesize
132KB
MD5da081a5c83e9130e96acb301295bb14b
SHA14e46aa4b39ea48c86838432e2724d7d3c508ab01
SHA2567ff325379204c4ab4a2a8cd60f5299eba0582c4fe52014689fd69008d1154646
SHA51246c1c1f0121bb1cd75656461a0e8044b665dc3601a79053516f7092b8230fb08be91eca4da1933d0719a78cf91699d1f6e641d06b3f21cdc5f3d97bcc9b381e1
-
Filesize
286KB
MD5cb278b7760c080ea4f57aea471f0f674
SHA12c052b2db7a196d127c2b84b62563d0c98ec0413
SHA25674cb6a456be0e9bad997e8c97475c47ab27c40d3627484f7b38a86bd01c78930
SHA512dbdf6a95b53a53f3a3dd929e0b1d63d512c00e9d28bf2f05c3e63707f0208f4f311adc637bb97a9d05bdb6bad9d6c7021aeec8c99ffe7033212e7763d4046bd3
-
Filesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
Filesize
252KB
MD53e152747de87d4674484a003398db051
SHA182557817b08eb981afa68701092d9f6e0d71ef79
SHA2561d5897272a1b899ce244d0863e9cf743adf4a9f5838bed75b7fc6a6e31a9da3e
SHA512dd726c743cac5696bf225d4b8d5cfa7b28f218eb6e7f2325e4f75d3cc4539e417210d477bafbcd82e7eb9e7b4e8ce20ae6ad30e2e7d36d949223bed0c78dcfa7
-
Filesize
252KB
MD5256cb90920413fd1a3fc7cdac7bd875e
SHA1fee8b71c28f05450b4b6fc9e827848306d2ba10f
SHA25643630bf880f09d10c9c997822f1fdd1a720bcabd368c0b01b1184fc6aa5294e5
SHA512cd09319bd92caea94e1d2b554f2e9af8dedcff7f19193b093b7c560817002964c02a15829547ae9e66ab60ccbd3894f961f94e21e820f7c3111e91d24ce56602
-
Filesize
2KB
MD50aea8f4a7e1249d8371b302cfeee61bc
SHA1d6b56649e7cfeb4f5e99d8b02f647d3829eb6bfb
SHA256e16f78b590bc5107fca8d426de5f638974bd11d492d98e28ce5c1f732bc8558c
SHA5125c120746c4596f4a978d81d08dcc729c8dd847d3a0db0a65dbf082139b0e462360367ac796199e75b2777d13034cb87cd4d3d653be211af1180cab763552cb75