Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 00:57
Static task
static1
Behavioral task
behavioral1
Sample
a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe
-
Size
124KB
-
MD5
a09c0fad3033777e3051d6aee28e22f2
-
SHA1
f262f770a2fd61034101961cf7e59f436e5ec4e2
-
SHA256
4baef42f07124b819866990e97745c2d44a95340fa0a54b8d4eddf7f2a30086c
-
SHA512
26d85b626767686ef0967f00dc4e223efbf979664c6f11fad656b96730d2b81e4078c7de4c168bce9b5892bb487377aea8f72c65535a8a31895d0ca96e6efa7a
-
SSDEEP
3072:Q9gg2CUptT76YtFD0PvqM28GSff3KDRZHt5HX00C9L:6/Ur6YtaPDj455k0a
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2112 trivax1.Bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3424-2-0x0000000000400000-0x0000000000477000-memory.dmp upx behavioral2/memory/3424-3-0x0000000000400000-0x0000000000477000-memory.dmp upx behavioral2/memory/3424-9-0x0000000000400000-0x0000000000477000-memory.dmp upx behavioral2/memory/2112-13-0x0000000000400000-0x0000000000477000-memory.dmp upx behavioral2/memory/2112-15-0x0000000000400000-0x0000000000477000-memory.dmp upx behavioral2/memory/2112-19-0x0000000000400000-0x0000000000477000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\trivax1.Bin.exe = "C:\\trivax1.Bin\\trivax1.Bin.exe" trivax1.Bin.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trivax1.Bin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" trivax1.Bin.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ShownServiceDownBalloon = "0" trivax1.Bin.exe Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\PhishingFilter trivax1.Bin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Microsoft\Internet Explorer\Recovery trivax1.Bin.exe Set value (int) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\ClearBrowsingHistoryOnExit = "0" trivax1.Bin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe 2112 trivax1.Bin.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe Token: SeDebugPrivilege 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe Token: SeDebugPrivilege 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe Token: SeDebugPrivilege 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe Token: SeDebugPrivilege 2112 trivax1.Bin.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3424 wrote to memory of 3516 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 56 PID 3424 wrote to memory of 616 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 5 PID 3424 wrote to memory of 668 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 7 PID 3424 wrote to memory of 788 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 8 PID 3424 wrote to memory of 796 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 9 PID 3424 wrote to memory of 800 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 10 PID 3424 wrote to memory of 908 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 11 PID 3424 wrote to memory of 968 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 12 PID 3424 wrote to memory of 384 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 13 PID 3424 wrote to memory of 408 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 14 PID 3424 wrote to memory of 904 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 15 PID 3424 wrote to memory of 1004 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 16 PID 3424 wrote to memory of 1084 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 17 PID 3424 wrote to memory of 1092 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 18 PID 3424 wrote to memory of 1128 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 19 PID 3424 wrote to memory of 1212 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 20 PID 3424 wrote to memory of 1256 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 21 PID 3424 wrote to memory of 1304 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 22 PID 3424 wrote to memory of 1336 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 23 PID 3424 wrote to memory of 1424 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 24 PID 3424 wrote to memory of 1516 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 25 PID 3424 wrote to memory of 1536 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 26 PID 3424 wrote to memory of 1556 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 27 PID 3424 wrote to memory of 1636 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 28 PID 3424 wrote to memory of 1680 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 29 PID 3424 wrote to memory of 1736 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 30 PID 3424 wrote to memory of 1756 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 31 PID 3424 wrote to memory of 1812 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 32 PID 3424 wrote to memory of 1868 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 33 PID 3424 wrote to memory of 1880 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 34 PID 3424 wrote to memory of 1960 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 35 PID 3424 wrote to memory of 2000 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 36 PID 3424 wrote to memory of 1668 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 37 PID 3424 wrote to memory of 1772 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 38 PID 3424 wrote to memory of 2096 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 39 PID 3424 wrote to memory of 2160 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 40 PID 3424 wrote to memory of 2316 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 41 PID 3424 wrote to memory of 2396 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 42 PID 3424 wrote to memory of 2400 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 43 PID 3424 wrote to memory of 2636 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 44 PID 3424 wrote to memory of 2696 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 45 PID 3424 wrote to memory of 2708 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 46 PID 3424 wrote to memory of 2724 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 47 PID 3424 wrote to memory of 2736 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 48 PID 3424 wrote to memory of 2772 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 49 PID 3424 wrote to memory of 2840 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 50 PID 3424 wrote to memory of 3028 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 51 PID 3424 wrote to memory of 3056 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 52 PID 3424 wrote to memory of 772 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 53 PID 3424 wrote to memory of 3412 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 55 PID 3424 wrote to memory of 3516 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 56 PID 3424 wrote to memory of 3628 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 57 PID 3424 wrote to memory of 3808 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 58 PID 3424 wrote to memory of 3896 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 59 PID 3424 wrote to memory of 3964 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 60 PID 3424 wrote to memory of 4048 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 61 PID 3424 wrote to memory of 3604 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 62 PID 3424 wrote to memory of 3948 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 65 PID 3424 wrote to memory of 836 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 66 PID 3424 wrote to memory of 5108 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 68 PID 3424 wrote to memory of 2436 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 69 PID 3424 wrote to memory of 1512 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 70 PID 3424 wrote to memory of 3720 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 71 PID 3424 wrote to memory of 1552 3424 a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe 72
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:800
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:384
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:788
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:3056
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3808
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3896
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3964
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:4048
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3604
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:3720
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:1744
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵PID:1828
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:1804
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca2⤵PID:1492
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:3540
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4540
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4888
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding2⤵PID:1704
-
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding2⤵PID:4980
-
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding2⤵PID:1928
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:4012
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵PID:2828
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}2⤵PID:4104
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:2632
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:968
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:408
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:904
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1004
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1084
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1128
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:3028
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1212
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1256
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1304
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1424
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2772
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1516
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1536
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1556
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1636
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1680
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1736
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1756
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1812
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1868
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1880
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:2000
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:1772
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2096
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2160
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2316
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2400
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2696
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2708
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2724
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2736
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2840
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:772
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3412
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a09c0fad3033777e3051d6aee28e22f2_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\trivax1.Bin\trivax1.Bin.exe"C:\trivax1.Bin\trivax1.Bin.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3628
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:3948
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:836
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:5108
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:2436
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1512
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:1552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:1468
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe fc74bdbe9d90e415b4e349973fcb59d4 iKbUUAf9B0qlFjTRDWXdNg.0.1.0.0.01⤵PID:4132
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:3524
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:676
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:1160
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD596f4ed1e6523ea5fd57e457fe8e12977
SHA19c48d689c0d46dd4b30f3441715a384014993be2
SHA2563e017d7f2bcc0fa41a28f1403d006ab19e46c209b276151c0e53ebda7fe50f64
SHA51251f9c662f29090a940a6d231e8bf607f43368f73e415edc3138b2ae5f47ab7fb8c96f460e0c822549923c33077c2794aa01586941cecf0f2be739f096a351a08
-
Filesize
124KB
MD5a09c0fad3033777e3051d6aee28e22f2
SHA1f262f770a2fd61034101961cf7e59f436e5ec4e2
SHA2564baef42f07124b819866990e97745c2d44a95340fa0a54b8d4eddf7f2a30086c
SHA51226d85b626767686ef0967f00dc4e223efbf979664c6f11fad656b96730d2b81e4078c7de4c168bce9b5892bb487377aea8f72c65535a8a31895d0ca96e6efa7a