Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 14:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe
-
Size
48KB
-
MD5
afa11e19fb3ec24a5749e40c0f098ef3
-
SHA1
03c7a8d2546bf278fe68a50fe4939588d6780524
-
SHA256
68b10c65645819bd5f12e080ab5f5eb4b0d90989d7b11629815361c322e5bd77
-
SHA512
99e8c42248879460decda53156a203d76c419e2bdae103f57a12d4577744272ed5de21d61f7d46d3afb91b02125164f60c1b1c8106b33224afe9953fd41283f3
-
SSDEEP
384:/TOvZce/+Pje/KLe/Le/tfF15m7T9P6xOFsiNm2XB/4251re/tfF17e/7e/KCe/s:/Kx9fvq5n0p/tNm2XBwOS5nC6mE
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Symantec\LiveUpdate\LUALL.EXE afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp1.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\topGradRepeat.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp5.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img13.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img14.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img16.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img18.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\default_thumb.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp1.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-t..flicklearningwizard_31bf3856ad364e35_6.1.7600.16385_none_69769fd78b751ad3\FlickAnimation.avi.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img13.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp3.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\ASPdotNET_logo.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\help.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img17.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img15.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img15.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\default_thumb.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp2.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp4.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\darkBlue_GRAD.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\topGradRepeat.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img16.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img18.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\ASPdotNET_logo.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp3.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp6.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp5.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp6.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img17.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\help.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp2.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\security_watermark.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_253e8c58002c48e1\Tulip.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\security_watermark.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-t..flicklearningwizard_31bf3856ad364e35_6.1.7600.16385_none_69769fd78b751ad3\FlickAnimation.avi.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\darkBlue_GRAD.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe File created \??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg.exe afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 37 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c00310000000000e858f67c10204c6f63616c00380008000400efbee858877be858f67c2a000000050200000000020000000000000000000000000000004c006f00630061006c00000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7400310000000000e858877b1100557365727300600008000400efbeee3a851ae858877b2a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a0031000000000014593775102054656d700000360008000400efbee858877b145937752a00000006020000000002000000000000000000000000000000540065006d007000000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5200310000000000e858877b122041707044617461003c0008000400efbee858877be858877b2a000000f20100000000020000000000000000000000000000004100700070004400610074006100000016000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = a4003100000000001459377512004146413131457e3100008c0008000400efbe14593775145937752a000000496d0100000008000000000000000000000000000000610066006100310031006500310039006600620033006500630032003400610035003700340039006500340030006300300066003000390038006500660033005f004a006100660066006100430061006b00650073003100310038006c00000018000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c00310000000000e8586982100041646d696e00380008000400efbee858877be85869822a000000e7010000000003000000000000000000000000000000410064006d0069006e00000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2152 afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2152 wrote to memory of 2504 2152 afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe 31 PID 2152 wrote to memory of 2504 2152 afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe 31 PID 2152 wrote to memory of 2504 2152 afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe 31 PID 2152 wrote to memory of 2504 2152 afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\explorer.exeexplorer afa11e19fb3ec24a5749e40c0f098ef3_JaffaCakes118l2⤵
- System Location Discovery: System Language Discovery
PID:2504
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2792
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD555a07c5a65cf58d3d7024f96730172d2
SHA18a0227fd704da40c7a0f74ecc2ec09d75e721b45
SHA2564c8272568f8839271c2ee0589898ce84d5c7d091a743edd2c19f0529b37741d5
SHA5124799d78f6a5ee31f66cd61b5453e1cd792a8355ff8bfb522c0295ba77c453c93e6f1bfe27a2c6627ccb8cb4cd7d0c0828bbec7b1e07e17d5576665580ea72824
