Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2024, 20:48
Behavioral task
behavioral1
Sample
9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe
-
Size
7.6MB
-
MD5
9fe0f9d108e82b060634334b56454935
-
SHA1
dd194dd7f6cd1e9a8c358c5ec1182c24c6221741
-
SHA256
6f430a6d04f3c421b3fb97b4788d4ff240005dc1b04c5add50a2188c598414b1
-
SHA512
742d3721328b4397d4fbca45f153a052849b3dbb7bbdc9f1ef7677502bb481de008d749a09f2734144f74fef3b562c719cbe00f3f95741c84601d89dbd06854c
-
SSDEEP
196608:i7effIPEsy58doQaTzwZ8Jq3QKnqVtxQnKnqVtxQu9OryfEQdy38doQaoiny/mKx:i7effIPEsy58doQaTzwZ8Jq3QKnqVtxY
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe," 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\spools.exe 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\spools.exe 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\spools.exe 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe -
Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe" 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe" 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe -
ACProtect 1.3x - 1.4x DLL software 4 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x00070000000234f0-15.dat acprotect behavioral2/memory/536-18-0x0000000010000000-0x000000001010B000-memory.dmp acprotect behavioral2/memory/536-19-0x0000000010000000-0x000000001010B000-memory.dmp acprotect behavioral2/memory/1096-36-0x0000000010000000-0x000000001010B000-memory.dmp acprotect -
Loads dropped DLL 2 IoCs
pid Process 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 1096 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/536-0-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/files/0x000500000002327a-5.dat upx behavioral2/files/0x00070000000234f0-15.dat upx behavioral2/memory/536-18-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/memory/536-19-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/memory/536-20-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/files/0x00040000000230ad-21.dat upx behavioral2/memory/1520-33-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1096-34-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/684-35-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1096-36-0x0000000010000000-0x000000001010B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\N: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\N: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\T: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\V: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\K: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\N: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\P: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\E: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\X: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\U: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\X: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\S: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\M: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\J: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\I: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\O: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\W: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\R: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\T: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\V: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\L: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\J: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\N: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\T: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\V: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\P: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\S: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\M: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\S: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\K: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\H: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\P: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\K: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\M: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\H: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\M: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\R: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\U: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\W: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\V: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\Q: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\U: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\W: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\O: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\R: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\J: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\E: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\H: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\L: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\X: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\J: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\U: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\R: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\I: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\Q: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\O: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\H: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\Q: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\O: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\Q: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\P: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\G: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened (read-only) \??\I: 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} reg.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost = "logonui.exe" 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\ftpdll.dll 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ftpdll.dll 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 1520 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 1520 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 1096 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 1096 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 1096 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 536 wrote to memory of 1520 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 89 PID 536 wrote to memory of 1520 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 89 PID 536 wrote to memory of 1520 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 89 PID 536 wrote to memory of 3456 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 91 PID 536 wrote to memory of 3456 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 91 PID 536 wrote to memory of 3456 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 91 PID 536 wrote to memory of 1096 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 92 PID 536 wrote to memory of 1096 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 92 PID 536 wrote to memory of 1096 536 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 92 PID 1520 wrote to memory of 684 1520 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 94 PID 1520 wrote to memory of 684 1520 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 94 PID 1520 wrote to memory of 684 1520 9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\9fe0f9d108e82b060634334b56454935_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\9fe0f9d108e82b060634334b56454935_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe3⤵
- Enumerates connected drives
PID:684
-
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f2⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
PID:3456
-
-
C:\Users\Admin\AppData\Local\Temp\9fe0f9d108e82b060634334b56454935_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\9fe0f9d108e82b060634334b56454935_JaffaCakes118.exe2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1096
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57fb5fa1534dcf77f2125b2403b30a0ee
SHA1365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA25633a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e
-
Filesize
436B
MD5971c514f84bba0785f80aa1c23edfd79
SHA1732acea710a87530c6b08ecdf32a110d254a54c8
SHA256f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA51243dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize174B
MD50d29860ddf3fbd780fe6e99012a94682
SHA1064d713ad506b2bd2acea4274bbdc25f2fe4208a
SHA25676b8cd7ef89f785017d2b664cca2018b2c775cea5d1ff31321b58dade538551e
SHA512956ede3b6c790acf5dca8290839b29374901e73199839a26de3beee138b83e9da26684cb7d7fb0ad70a0a44eb2c69af7dcbb0b4643d2d8bab939ad32c6faa9fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Filesize170B
MD569bfa781b34718fca1505af73d1f076f
SHA124c03f00877fc426af68a2e323592d011e639e5b
SHA25643aee4d8e80c6d86aa392740839849a7c6aeb373ede90b59849d3200218ef511
SHA512003c19b43d778cfeba184ef909b19929933748f9c603bdb669ad16cf0a652b4350d417723007274026da9e389ced38634b09671391ecf586ed69f227eea2094f
-
Filesize
7.6MB
MD5f56c87ae5bd952ebd9b3f4c26acb3312
SHA105de76795dec743d561ab0ab142a60ac3ac05cb9
SHA256cda889a9a489f57723105b20a275cc3467364927aba751d3f4db23cdced8e40d
SHA51241a5916094115433cc89690697ca3c66262aed7da4698f5734813dc25a2479f4f55ed8724eaf70a46a6a11de1f92442b4a68a730eab8b71f11dc5a7a86b57344
-
Filesize
7.6MB
MD5030a7e18ab53a9ad07936ead374170c4
SHA1b9e90b6e05c30649825d21f6ebafc95320d557f3
SHA25636a92318d408d2e4401379891ae5635e15d25fd5e23334e70e08121ad0b5ffc9
SHA512004ed09a0a2e7df2969799db4b3f7bb2caacc84eb2daa89469ddd8ec0db6eb5e1a2c0d9d8d4c7a4786f2f09459a8eefcba92679a73d0eb81c77312bc9a224d05
-
Filesize
5KB
MD5d807aa04480d1d149f7a4cac22984188
SHA1ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9
SHA256eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb
SHA512875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e