Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 15:08
Behavioral task
behavioral1
Sample
a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe
-
Size
7.9MB
-
MD5
a308028fe9c823d9bb024211413f129d
-
SHA1
98c5d905b522e75720615bfc15cebe5e464ee6a3
-
SHA256
2ea7eb4a63ec451f3683a5450a7e93ca96a60917a83e0ed081b2ee06095b9916
-
SHA512
abfe7087b68e51bcc569e44850f5633c8d0125f39a7d171e2b6d9d58d5c0c156ac53e724ba403abe0dc5d3af63cb9f48e05a966f4e0b2d72575cea3d64d12e95
-
SSDEEP
196608:i7effIPEsy58doQaTxLhQyZbIly38doQalArdfehQM2gsyVCQlXI1G8do8a888Fh:i7effIPEsy58doQaTxLhQyZbIly38do6
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe," a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe -
Drops file in Drivers directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\spools.exe a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\spools.exe a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\spools.exe a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\spools.exe a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe -
Sets service image path in registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe" a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe" a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe" a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe -
ACProtect 1.3x - 1.4x DLL software 6 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x00090000000234ab-9.dat acprotect behavioral2/memory/3680-12-0x0000000010000000-0x000000001010B000-memory.dmp acprotect behavioral2/memory/3680-16-0x0000000010000000-0x000000001010B000-memory.dmp acprotect behavioral2/memory/4604-31-0x0000000010000000-0x000000001010B000-memory.dmp acprotect behavioral2/memory/1360-43-0x0000000010000000-0x000000001010B000-memory.dmp acprotect behavioral2/memory/1360-45-0x0000000010000000-0x000000001010B000-memory.dmp acprotect -
Loads dropped DLL 3 IoCs
pid Process 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 4604 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 1360 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/3680-0-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/files/0x000d00000001e4f6-6.dat upx behavioral2/files/0x00090000000234ab-9.dat upx behavioral2/memory/3680-12-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/memory/3680-16-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/memory/3680-17-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/files/0x000600000001e551-19.dat upx behavioral2/memory/4604-31-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/memory/4604-32-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/4020-33-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/3588-34-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1360-43-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/memory/1360-44-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/4864-46-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1360-45-0x0000000010000000-0x000000001010B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\X: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\E: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\K: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\J: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\Q: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\V: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\Q: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\K: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\P: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\G: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\W: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\W: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\R: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\N: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\N: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\R: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\L: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\N: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\P: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\M: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\P: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\X: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\Q: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\K: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\O: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\U: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\G: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\H: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\E: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\L: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\O: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\S: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\W: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\I: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\P: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\W: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\G: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\X: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\V: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\S: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\R: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\J: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\T: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\T: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\T: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\O: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\V: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\H: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\U: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\T: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\M: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\G: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\K: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\T: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\X: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\S: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\U: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\M: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\I: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\V: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\N: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\P: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened (read-only) \??\J: a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects reg.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost = "logonui.exe" a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ftpdll.dll a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ftpdll.dll a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe File created C:\Windows\SysWOW64\ftpdll.dll a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2308 3680 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 4020 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 4020 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 4020 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 4020 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 4604 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 4604 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 4604 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 1360 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3680 wrote to memory of 4020 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 89 PID 3680 wrote to memory of 4020 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 89 PID 3680 wrote to memory of 4020 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 89 PID 3680 wrote to memory of 1668 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 91 PID 3680 wrote to memory of 1668 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 91 PID 3680 wrote to memory of 1668 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 91 PID 3680 wrote to memory of 4604 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 92 PID 3680 wrote to memory of 4604 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 92 PID 3680 wrote to memory of 4604 3680 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 92 PID 4020 wrote to memory of 3588 4020 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 97 PID 4020 wrote to memory of 3588 4020 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 97 PID 4020 wrote to memory of 3588 4020 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 97 PID 3588 wrote to memory of 1360 3588 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 103 PID 3588 wrote to memory of 1360 3588 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 103 PID 3588 wrote to memory of 1360 3588 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 103 PID 4020 wrote to memory of 4864 4020 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 106 PID 4020 wrote to memory of 4864 4020 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 106 PID 4020 wrote to memory of 4864 4020 a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\a308028fe9c823d9bb024211413f129d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\a308028fe9c823d9bb024211413f129d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\a308028fe9c823d9bb024211413f129d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe4⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1360
-
-
-
C:\Users\Admin\AppData\Local\Temp\a308028fe9c823d9bb024211413f129d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe3⤵
- Enumerates connected drives
PID:4864
-
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f2⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
PID:1668
-
-
C:\Users\Admin\AppData\Local\Temp\a308028fe9c823d9bb024211413f129d_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\a308028fe9c823d9bb024211413f129d_JaffaCakes118.exe2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4604
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 18322⤵
- Program crash
PID:2308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3680 -ip 36801⤵PID:3444
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57fb5fa1534dcf77f2125b2403b30a0ee
SHA1365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA25633a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e
-
Filesize
436B
MD5971c514f84bba0785f80aa1c23edfd79
SHA1732acea710a87530c6b08ecdf32a110d254a54c8
SHA256f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA51243dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize174B
MD5bc08458972b7a105b10493bb1b5c0912
SHA177db744abd2db9d4ffca53c5f29585f47f3f1bba
SHA256dc14cd2c87b8ca4a3190d173fb422920e76251589f5dc536f3309b8eab228391
SHA512876f909e158ad86448b93f8a694a75085059549456c6332325a80f105b4bb2315f28cb870a1e8f3f8d455ee5cba89a6da66389b971246fc944e60b2ae598f6a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Filesize170B
MD543b47e621307a35c5e50701da911b328
SHA18afddb9e8ba3ec4955a5c1aec39a57731368b132
SHA256418e152626c9ddb8fc4bcd65c31dcb7a5236b1c49593bb6ab26ce6e66bc96643
SHA512d9d4a62fa968a539e613ea6dc5d66bde82e1ea77937b0cc0dca959a931e35f43f2f39b4ec6b0654ed7b2abe2f6820a47af7ba33a93e98adf90ad621c92069481
-
Filesize
7.9MB
MD50aec8db6ad3ae554e62b2a73b172521d
SHA10fdec429ae8768a2226c3099953e629e8a29adcb
SHA25652347572f3f8b8282d8ef18a89419a644ff068de5bd024c699a0310cc56d483a
SHA51296275afc56262e12f834c70fc86ff1961febf8cae57b80b5e52343e2495a6b207659f87e1b0b4c90c9fb0cafc9663f31aefd5dd3fe89d1d69927650764563869
-
Filesize
7.9MB
MD5ed33d9928784abaf5baf6bc992cf4c49
SHA149218e80a75c982140d8b56244b1389625ad18b6
SHA2561a14b83327fd1c9edac67b665c8c829ba55ad234975169fabfff69f69b727730
SHA512d9e3639e48d73f11b71118bd86609a2344c83c33908f8fb88aa780405abe35fe74e9241fe242591294bb3db2d39f430ca72ce31fb93266985795ab0a1702fe1c
-
Filesize
5KB
MD5d807aa04480d1d149f7a4cac22984188
SHA1ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9
SHA256eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb
SHA512875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e