Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
16/08/2024, 22:34
Static task
static1
Behavioral task
behavioral1
Sample
a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe
-
Size
172KB
-
MD5
a0339097b9e227d23f532c319f24c58e
-
SHA1
b1bdc6f9017cbb7f4b055f867961926f4c097f8d
-
SHA256
2787e1698813f1eac301106639f183ab383b195ced3a7887d0930fc72b380ff6
-
SHA512
fd7cb1be4dd1d82286aadeb3ceedbaa8c8fba87b9e043476c83f21ef743c911441b5a335acfd031ee775b01060f158ac42f8b40c55c75070ca8afe94ec66dc08
-
SSDEEP
3072:AEFWjrDr63/mznS77zVg7ZSBYfkVoFdRrqo0aRaA/HF673+UWHIfr:krDr63/mzne7uNkVsuaRaU6mHG
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" reg.exe -
Loads dropped DLL 4 IoCs
pid Process 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemDriver = "C:\\Windows\\system32\\explorer.exe" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\MSWINSCK.OCX a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe File created C:\Windows\SysWOW64\explorer.exe a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D} a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX, 1" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1" a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe -
Runs net.exe
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2824 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 30 PID 2416 wrote to memory of 2824 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 30 PID 2416 wrote to memory of 2824 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 30 PID 2416 wrote to memory of 2824 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 30 PID 2416 wrote to memory of 2820 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 31 PID 2416 wrote to memory of 2820 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 31 PID 2416 wrote to memory of 2820 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 31 PID 2416 wrote to memory of 2820 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 31 PID 2416 wrote to memory of 2736 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 32 PID 2416 wrote to memory of 2736 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 32 PID 2416 wrote to memory of 2736 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 32 PID 2416 wrote to memory of 2736 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 32 PID 2416 wrote to memory of 2696 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 33 PID 2416 wrote to memory of 2696 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 33 PID 2416 wrote to memory of 2696 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 33 PID 2416 wrote to memory of 2696 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 33 PID 2416 wrote to memory of 3000 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 34 PID 2416 wrote to memory of 3000 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 34 PID 2416 wrote to memory of 3000 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 34 PID 2416 wrote to memory of 3000 2416 a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe 34 PID 2820 wrote to memory of 2912 2820 cmd.exe 40 PID 2820 wrote to memory of 2912 2820 cmd.exe 40 PID 2820 wrote to memory of 2912 2820 cmd.exe 40 PID 2820 wrote to memory of 2912 2820 cmd.exe 40 PID 2696 wrote to memory of 2804 2696 cmd.exe 41 PID 2696 wrote to memory of 2804 2696 cmd.exe 41 PID 2696 wrote to memory of 2804 2696 cmd.exe 41 PID 2696 wrote to memory of 2804 2696 cmd.exe 41 PID 2824 wrote to memory of 2844 2824 cmd.exe 42 PID 2824 wrote to memory of 2844 2824 cmd.exe 42 PID 2824 wrote to memory of 2844 2824 cmd.exe 42 PID 2824 wrote to memory of 2844 2824 cmd.exe 42 PID 3000 wrote to memory of 2708 3000 cmd.exe 43 PID 3000 wrote to memory of 2708 3000 cmd.exe 43 PID 3000 wrote to memory of 2708 3000 cmd.exe 43 PID 3000 wrote to memory of 2708 3000 cmd.exe 43 PID 2844 wrote to memory of 2584 2844 net.exe 44 PID 2844 wrote to memory of 2584 2844 net.exe 44 PID 2844 wrote to memory of 2584 2844 net.exe 44 PID 2844 wrote to memory of 2584 2844 net.exe 44 PID 2912 wrote to memory of 2592 2912 net.exe 45 PID 2912 wrote to memory of 2592 2912 net.exe 45 PID 2912 wrote to memory of 2592 2912 net.exe 45 PID 2912 wrote to memory of 2592 2912 net.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a0339097b9e227d23f532c319f24c58e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop "Security Center"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\net.exenet stop "Security Center"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Security Center"4⤵
- System Location Discovery: System Language Discovery
PID:2584
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop SharedAccess2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
- System Location Discovery: System Language Discovery
PID:2592
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess" /v Start /t REG_DWORD /d 0x4 /f2⤵
- System Location Discovery: System Language Discovery
PID:2736
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /v Start /t REG_DWORD /d 0x4 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /v Start /t REG_DWORD /d 0x4 /f3⤵
- Modifies security service
- System Location Discovery: System Language Discovery
PID:2804
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v Start /t REG_DWORD /d 0x4 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Services\wscsvc" /v Start /t REG_DWORD /d 0x4 /f3⤵
- Modifies security service
- System Location Discovery: System Language Discovery
PID:2708
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0