Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/08/2024, 10:57
Static task
static1
Behavioral task
behavioral1
Sample
95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe
-
Size
544KB
-
MD5
95cf4689c08a836b1bc6ce87fbf1a895
-
SHA1
64ee0a6ffe32e31c96b13ce8be219f8d44300b28
-
SHA256
fd125d57a48c3f167fae13603cd4d4f4c661db870d637f95613625be68a48a88
-
SHA512
bd2bef62cf6ecf1e7a8c5d7b910ae64a7372841207e04d771753faa0f225794ac014b240900e60086be37ae7205af10e723c3be61ff5148585782d3d5ab62115
-
SSDEEP
12288:vQIWT/UzJW8ivxh7vHzgryd4GT1QOoJqbbEUqe9mJd/uB28Rr8O9F8/CwM:vQI+cJHiJRTHnxhUqEhe9suB2C8O9O
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gau5f8p1.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yooos.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation gau5f8p1.exe Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe -
Executes dropped EXE 10 IoCs
pid Process 2548 gau5f8p1.exe 1076 yooos.exe 3220 2des.exe 4472 2des.exe 3520 2des.exe 2772 2des.exe 2908 2des.exe 1400 2des.exe 1852 3des.exe 3136 X -
resource yara_rule behavioral2/memory/4472-47-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4472-50-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4472-49-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/3520-55-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3520-54-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3520-59-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/2772-63-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2908-64-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2772-62-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2772-60-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/4472-58-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/3520-51-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/2908-68-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2908-67-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/4472-81-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2772-88-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2908-89-0x0000000000400000-0x0000000000407000-memory.dmp upx -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 31.193.3.240 Destination IP 31.193.3.240 -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /G" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /Y" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /k" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /C" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /O" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /y" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /K" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /a" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /Z" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /l" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /J" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /g" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /S" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /d" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /H" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /B" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /x" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /T" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /Q" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /b" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /L" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /p" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /h" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /m" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /E" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /P" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /f" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /v" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /t" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /q" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /X" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /s" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /I" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /A" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /n" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /F" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /w" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /o" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /D" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /V" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /U" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /z" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /u" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /x" gau5f8p1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /c" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /R" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /M" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /j" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /N" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /r" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /e" yooos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yooos = "C:\\Users\\Admin\\yooos.exe /i" yooos.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2des.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2des.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 4080 tasklist.exe 2340 tasklist.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 3220 set thread context of 4472 3220 2des.exe 93 PID 3220 set thread context of 3520 3220 2des.exe 94 PID 3220 set thread context of 2772 3220 2des.exe 95 PID 3220 set thread context of 2908 3220 2des.exe 96 PID 3220 set thread context of 1400 3220 2des.exe 97 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 820 1400 WerFault.exe 97 -
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2des.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3des.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2des.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2des.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gau5f8p1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yooos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2548 gau5f8p1.exe 2548 gau5f8p1.exe 2548 gau5f8p1.exe 2548 gau5f8p1.exe 3520 2des.exe 3520 2des.exe 2772 2des.exe 2772 2des.exe 1852 3des.exe 1852 3des.exe 3136 X 3136 X 1076 yooos.exe 1076 yooos.exe 1076 yooos.exe 1076 yooos.exe 1076 yooos.exe 1076 yooos.exe 3520 2des.exe 3520 2des.exe 1076 yooos.exe 1076 yooos.exe 2772 2des.exe 2772 2des.exe 1076 yooos.exe 1076 yooos.exe 1076 yooos.exe 1076 yooos.exe 1076 yooos.exe 1076 yooos.exe 3520 2des.exe 3520 2des.exe 1076 yooos.exe 1076 yooos.exe 3520 2des.exe 3520 2des.exe 3520 2des.exe 3520 2des.exe 1076 yooos.exe 1076 yooos.exe 1076 yooos.exe 1076 yooos.exe 1076 yooos.exe 1076 yooos.exe 3520 2des.exe 3520 2des.exe 3520 2des.exe 3520 2des.exe 1076 yooos.exe 1076 yooos.exe 3520 2des.exe 3520 2des.exe 1076 yooos.exe 1076 yooos.exe 1076 yooos.exe 1076 yooos.exe 3520 2des.exe 3520 2des.exe 1076 yooos.exe 1076 yooos.exe 3520 2des.exe 3520 2des.exe 1076 yooos.exe 1076 yooos.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4080 tasklist.exe Token: SeDebugPrivilege 1852 3des.exe Token: SeDebugPrivilege 1852 3des.exe Token: SeDebugPrivilege 2340 tasklist.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1320 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 2548 gau5f8p1.exe 1076 yooos.exe 3220 2des.exe 4472 2des.exe 2908 2des.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1320 wrote to memory of 2548 1320 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 87 PID 1320 wrote to memory of 2548 1320 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 87 PID 1320 wrote to memory of 2548 1320 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 87 PID 2548 wrote to memory of 1076 2548 gau5f8p1.exe 88 PID 2548 wrote to memory of 1076 2548 gau5f8p1.exe 88 PID 2548 wrote to memory of 1076 2548 gau5f8p1.exe 88 PID 2548 wrote to memory of 1456 2548 gau5f8p1.exe 89 PID 2548 wrote to memory of 1456 2548 gau5f8p1.exe 89 PID 2548 wrote to memory of 1456 2548 gau5f8p1.exe 89 PID 1320 wrote to memory of 3220 1320 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 91 PID 1320 wrote to memory of 3220 1320 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 91 PID 1320 wrote to memory of 3220 1320 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 91 PID 1456 wrote to memory of 4080 1456 cmd.exe 92 PID 1456 wrote to memory of 4080 1456 cmd.exe 92 PID 1456 wrote to memory of 4080 1456 cmd.exe 92 PID 3220 wrote to memory of 4472 3220 2des.exe 93 PID 3220 wrote to memory of 4472 3220 2des.exe 93 PID 3220 wrote to memory of 4472 3220 2des.exe 93 PID 3220 wrote to memory of 4472 3220 2des.exe 93 PID 3220 wrote to memory of 4472 3220 2des.exe 93 PID 3220 wrote to memory of 4472 3220 2des.exe 93 PID 3220 wrote to memory of 4472 3220 2des.exe 93 PID 3220 wrote to memory of 4472 3220 2des.exe 93 PID 3220 wrote to memory of 3520 3220 2des.exe 94 PID 3220 wrote to memory of 3520 3220 2des.exe 94 PID 3220 wrote to memory of 3520 3220 2des.exe 94 PID 3220 wrote to memory of 3520 3220 2des.exe 94 PID 3220 wrote to memory of 3520 3220 2des.exe 94 PID 3220 wrote to memory of 3520 3220 2des.exe 94 PID 3220 wrote to memory of 3520 3220 2des.exe 94 PID 3220 wrote to memory of 3520 3220 2des.exe 94 PID 3220 wrote to memory of 2772 3220 2des.exe 95 PID 3220 wrote to memory of 2772 3220 2des.exe 95 PID 3220 wrote to memory of 2772 3220 2des.exe 95 PID 3220 wrote to memory of 2772 3220 2des.exe 95 PID 3220 wrote to memory of 2772 3220 2des.exe 95 PID 3220 wrote to memory of 2772 3220 2des.exe 95 PID 3220 wrote to memory of 2772 3220 2des.exe 95 PID 3220 wrote to memory of 2772 3220 2des.exe 95 PID 3220 wrote to memory of 2908 3220 2des.exe 96 PID 3220 wrote to memory of 2908 3220 2des.exe 96 PID 3220 wrote to memory of 2908 3220 2des.exe 96 PID 3220 wrote to memory of 2908 3220 2des.exe 96 PID 3220 wrote to memory of 2908 3220 2des.exe 96 PID 3220 wrote to memory of 2908 3220 2des.exe 96 PID 3220 wrote to memory of 2908 3220 2des.exe 96 PID 3220 wrote to memory of 2908 3220 2des.exe 96 PID 3220 wrote to memory of 1400 3220 2des.exe 97 PID 3220 wrote to memory of 1400 3220 2des.exe 97 PID 3220 wrote to memory of 1400 3220 2des.exe 97 PID 3220 wrote to memory of 1400 3220 2des.exe 97 PID 1320 wrote to memory of 1852 1320 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 104 PID 1320 wrote to memory of 1852 1320 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 104 PID 1320 wrote to memory of 1852 1320 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 104 PID 1852 wrote to memory of 3136 1852 3des.exe 105 PID 1852 wrote to memory of 3136 1852 3des.exe 105 PID 3136 wrote to memory of 2104 3136 X 106 PID 3136 wrote to memory of 2104 3136 X 106 PID 3136 wrote to memory of 2104 3136 X 106 PID 1320 wrote to memory of 4928 1320 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 109 PID 1320 wrote to memory of 4928 1320 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 109 PID 1320 wrote to memory of 4928 1320 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe 109 PID 4928 wrote to memory of 2340 4928 cmd.exe 111 PID 4928 wrote to memory of 2340 4928 cmd.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\gau5f8p1.exeC:\Users\Admin\gau5f8p1.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\yooos.exe"C:\Users\Admin\yooos.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1076
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del gau5f8p1.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4080
-
-
-
-
C:\Users\Admin\2des.exeC:\Users\Admin\2des.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4472
-
-
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3520
-
-
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2772
-
-
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2908
-
-
C:\Users\Admin\2des.exe"C:\Users\Admin\2des.exe"3⤵
- Executes dropped EXE
PID:1400 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 804⤵
- Program crash
PID:820
-
-
-
-
C:\Users\Admin\3des.exeC:\Users\Admin\3des.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\173e05a9\X*0*bc*699ee06a*31.193.3.240:533⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵
- Modifies registry class
PID:2104
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 95cf4689c08a836b1bc6ce87fbf1a895_JaffaCakes118.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1400 -ip 14001⤵PID:1212
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD5da081a5c83e9130e96acb301295bb14b
SHA14e46aa4b39ea48c86838432e2724d7d3c508ab01
SHA2567ff325379204c4ab4a2a8cd60f5299eba0582c4fe52014689fd69008d1154646
SHA51246c1c1f0121bb1cd75656461a0e8044b665dc3601a79053516f7092b8230fb08be91eca4da1933d0719a78cf91699d1f6e641d06b3f21cdc5f3d97bcc9b381e1
-
Filesize
286KB
MD5cb278b7760c080ea4f57aea471f0f674
SHA12c052b2db7a196d127c2b84b62563d0c98ec0413
SHA25674cb6a456be0e9bad997e8c97475c47ab27c40d3627484f7b38a86bd01c78930
SHA512dbdf6a95b53a53f3a3dd929e0b1d63d512c00e9d28bf2f05c3e63707f0208f4f311adc637bb97a9d05bdb6bad9d6c7021aeec8c99ffe7033212e7763d4046bd3
-
Filesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
Filesize
252KB
MD53e152747de87d4674484a003398db051
SHA182557817b08eb981afa68701092d9f6e0d71ef79
SHA2561d5897272a1b899ce244d0863e9cf743adf4a9f5838bed75b7fc6a6e31a9da3e
SHA512dd726c743cac5696bf225d4b8d5cfa7b28f218eb6e7f2325e4f75d3cc4539e417210d477bafbcd82e7eb9e7b4e8ce20ae6ad30e2e7d36d949223bed0c78dcfa7
-
Filesize
252KB
MD5cb8c11187d520f150435b32bb38c2265
SHA1271422100f80121ff8ca340b7b7f2150650facf2
SHA25697db452fed4997206f809aadfbeee61ab50c4809984ea634f0a3705c71c7b6d5
SHA5125688f2abd2ad5816d7d32dbbe07f9a9ec27e2b5c5b1fa58448f960bea7dc6fa98beca445354c1c1f9e7ae6a22b5f9d094cc7dd166dcfcb287b0b7c41dd2ee60c