Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 15:49
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
25 signatures
150 seconds
General
-
Target
c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe
-
Size
512KB
-
MD5
c11192dc6211e591dca1454c40404a7d
-
SHA1
809c6aa8d2232d7bd79e82af9c6344ed093a8527
-
SHA256
f2967282fa56e471a8df2ec0fda6d88b4fb44db6833d8952050c8bf72511b7e6
-
SHA512
b59214b9b4b0453ae7ce5b7d67a021fb0804f8da20d903b85813d9ed6075a5d14b2b9b0bcb483ea81caa737dd57607524e8917c25eb58151b9ccc5be48e3cbee
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj65:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5S
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" vvhhgsgyzc.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vvhhgsgyzc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" vvhhgsgyzc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" vvhhgsgyzc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" vvhhgsgyzc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" vvhhgsgyzc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" vvhhgsgyzc.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vvhhgsgyzc.exe -
Executes dropped EXE 5 IoCs
pid Process 2012 vvhhgsgyzc.exe 2576 jhcdthpnbjsrjtf.exe 1608 lvexkazu.exe 2796 gairbmoykoebi.exe 2892 lvexkazu.exe -
Loads dropped DLL 5 IoCs
pid Process 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2012 vvhhgsgyzc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" vvhhgsgyzc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" vvhhgsgyzc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" vvhhgsgyzc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" vvhhgsgyzc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" vvhhgsgyzc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" vvhhgsgyzc.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\equzgyzd = "vvhhgsgyzc.exe" jhcdthpnbjsrjtf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gamegzov = "jhcdthpnbjsrjtf.exe" jhcdthpnbjsrjtf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "gairbmoykoebi.exe" jhcdthpnbjsrjtf.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: lvexkazu.exe File opened (read-only) \??\g: vvhhgsgyzc.exe File opened (read-only) \??\v: vvhhgsgyzc.exe File opened (read-only) \??\e: lvexkazu.exe File opened (read-only) \??\h: lvexkazu.exe File opened (read-only) \??\l: lvexkazu.exe File opened (read-only) \??\v: lvexkazu.exe File opened (read-only) \??\k: lvexkazu.exe File opened (read-only) \??\q: lvexkazu.exe File opened (read-only) \??\x: lvexkazu.exe File opened (read-only) \??\b: lvexkazu.exe File opened (read-only) \??\j: lvexkazu.exe File opened (read-only) \??\z: lvexkazu.exe File opened (read-only) \??\e: lvexkazu.exe File opened (read-only) \??\s: lvexkazu.exe File opened (read-only) \??\l: vvhhgsgyzc.exe File opened (read-only) \??\u: vvhhgsgyzc.exe File opened (read-only) \??\w: vvhhgsgyzc.exe File opened (read-only) \??\v: lvexkazu.exe File opened (read-only) \??\y: lvexkazu.exe File opened (read-only) \??\t: lvexkazu.exe File opened (read-only) \??\w: lvexkazu.exe File opened (read-only) \??\y: lvexkazu.exe File opened (read-only) \??\i: lvexkazu.exe File opened (read-only) \??\g: lvexkazu.exe File opened (read-only) \??\u: lvexkazu.exe File opened (read-only) \??\a: vvhhgsgyzc.exe File opened (read-only) \??\y: vvhhgsgyzc.exe File opened (read-only) \??\n: lvexkazu.exe File opened (read-only) \??\x: lvexkazu.exe File opened (read-only) \??\b: lvexkazu.exe File opened (read-only) \??\u: lvexkazu.exe File opened (read-only) \??\h: lvexkazu.exe File opened (read-only) \??\b: vvhhgsgyzc.exe File opened (read-only) \??\p: vvhhgsgyzc.exe File opened (read-only) \??\q: vvhhgsgyzc.exe File opened (read-only) \??\r: vvhhgsgyzc.exe File opened (read-only) \??\m: lvexkazu.exe File opened (read-only) \??\e: vvhhgsgyzc.exe File opened (read-only) \??\m: vvhhgsgyzc.exe File opened (read-only) \??\i: vvhhgsgyzc.exe File opened (read-only) \??\s: vvhhgsgyzc.exe File opened (read-only) \??\z: vvhhgsgyzc.exe File opened (read-only) \??\j: vvhhgsgyzc.exe File opened (read-only) \??\o: lvexkazu.exe File opened (read-only) \??\w: lvexkazu.exe File opened (read-only) \??\z: lvexkazu.exe File opened (read-only) \??\t: lvexkazu.exe File opened (read-only) \??\n: vvhhgsgyzc.exe File opened (read-only) \??\o: vvhhgsgyzc.exe File opened (read-only) \??\x: vvhhgsgyzc.exe File opened (read-only) \??\a: lvexkazu.exe File opened (read-only) \??\r: lvexkazu.exe File opened (read-only) \??\k: vvhhgsgyzc.exe File opened (read-only) \??\t: vvhhgsgyzc.exe File opened (read-only) \??\n: lvexkazu.exe File opened (read-only) \??\r: lvexkazu.exe File opened (read-only) \??\m: lvexkazu.exe File opened (read-only) \??\k: lvexkazu.exe File opened (read-only) \??\s: lvexkazu.exe File opened (read-only) \??\j: lvexkazu.exe File opened (read-only) \??\l: lvexkazu.exe File opened (read-only) \??\o: lvexkazu.exe File opened (read-only) \??\p: lvexkazu.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" vvhhgsgyzc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" vvhhgsgyzc.exe -
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2928-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x00070000000186be-9.dat autoit_exe behavioral1/files/0x00070000000120fe-17.dat autoit_exe behavioral1/files/0x00090000000175ab-21.dat autoit_exe behavioral1/files/0x00070000000186c4-32.dat autoit_exe behavioral1/files/0x00060000000186cb-66.dat autoit_exe behavioral1/files/0x00060000000186d7-68.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\vvhhgsgyzc.exe c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\jhcdthpnbjsrjtf.exe c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\lvexkazu.exe c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\gairbmoykoebi.exe c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll vvhhgsgyzc.exe File created C:\Windows\SysWOW64\vvhhgsgyzc.exe c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe File created C:\Windows\SysWOW64\lvexkazu.exe c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe File created C:\Windows\SysWOW64\gairbmoykoebi.exe c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe File created C:\Windows\SysWOW64\jhcdthpnbjsrjtf.exe c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe lvexkazu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal lvexkazu.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe lvexkazu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe lvexkazu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal lvexkazu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal lvexkazu.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe lvexkazu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe lvexkazu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal lvexkazu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe lvexkazu.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe lvexkazu.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe lvexkazu.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe lvexkazu.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe lvexkazu.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe lvexkazu.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvexkazu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvhhgsgyzc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhcdthpnbjsrjtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvexkazu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gairbmoykoebi.exe -
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183EC6091594DABEB8BA7F97ED9137CF" c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat vvhhgsgyzc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh vvhhgsgyzc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" vvhhgsgyzc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" vvhhgsgyzc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg vvhhgsgyzc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" vvhhgsgyzc.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8FFFF9482982139141D72A7DE1BCE4E146593167426345D79D" c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F468B4FF1822A9D20ED1A78B089111" c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" vvhhgsgyzc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" vvhhgsgyzc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf vvhhgsgyzc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs vvhhgsgyzc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32452D7E9C2183576A4477D370212DD77C8464DA" c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABFFABCF911F1E284743B32819B39E6B08D02FE4212023BE1C4459D08D3" c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC7B02C479238EA53C5BAD3339FD4B8" c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc vvhhgsgyzc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" vvhhgsgyzc.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2644 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2012 vvhhgsgyzc.exe 2012 vvhhgsgyzc.exe 2012 vvhhgsgyzc.exe 2012 vvhhgsgyzc.exe 2012 vvhhgsgyzc.exe 2576 jhcdthpnbjsrjtf.exe 2576 jhcdthpnbjsrjtf.exe 2576 jhcdthpnbjsrjtf.exe 2576 jhcdthpnbjsrjtf.exe 2576 jhcdthpnbjsrjtf.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 1608 lvexkazu.exe 1608 lvexkazu.exe 1608 lvexkazu.exe 1608 lvexkazu.exe 2892 lvexkazu.exe 2892 lvexkazu.exe 2892 lvexkazu.exe 2892 lvexkazu.exe 2576 jhcdthpnbjsrjtf.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2576 jhcdthpnbjsrjtf.exe 2576 jhcdthpnbjsrjtf.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2576 jhcdthpnbjsrjtf.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2576 jhcdthpnbjsrjtf.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2576 jhcdthpnbjsrjtf.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2576 jhcdthpnbjsrjtf.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2576 jhcdthpnbjsrjtf.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2576 jhcdthpnbjsrjtf.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2576 jhcdthpnbjsrjtf.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2576 jhcdthpnbjsrjtf.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2576 jhcdthpnbjsrjtf.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2012 vvhhgsgyzc.exe 2012 vvhhgsgyzc.exe 2012 vvhhgsgyzc.exe 2576 jhcdthpnbjsrjtf.exe 2576 jhcdthpnbjsrjtf.exe 2576 jhcdthpnbjsrjtf.exe 1608 lvexkazu.exe 1608 lvexkazu.exe 1608 lvexkazu.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2892 lvexkazu.exe 2892 lvexkazu.exe 2892 lvexkazu.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 2012 vvhhgsgyzc.exe 2012 vvhhgsgyzc.exe 2012 vvhhgsgyzc.exe 2576 jhcdthpnbjsrjtf.exe 2576 jhcdthpnbjsrjtf.exe 2576 jhcdthpnbjsrjtf.exe 1608 lvexkazu.exe 1608 lvexkazu.exe 1608 lvexkazu.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2796 gairbmoykoebi.exe 2892 lvexkazu.exe 2892 lvexkazu.exe 2892 lvexkazu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2644 WINWORD.EXE 2644 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2012 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 29 PID 2928 wrote to memory of 2012 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 29 PID 2928 wrote to memory of 2012 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 29 PID 2928 wrote to memory of 2012 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 29 PID 2928 wrote to memory of 2576 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 30 PID 2928 wrote to memory of 2576 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 30 PID 2928 wrote to memory of 2576 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 30 PID 2928 wrote to memory of 2576 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 30 PID 2928 wrote to memory of 1608 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 31 PID 2928 wrote to memory of 1608 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 31 PID 2928 wrote to memory of 1608 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 31 PID 2928 wrote to memory of 1608 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 31 PID 2928 wrote to memory of 2796 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 32 PID 2928 wrote to memory of 2796 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 32 PID 2928 wrote to memory of 2796 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 32 PID 2928 wrote to memory of 2796 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 32 PID 2012 wrote to memory of 2892 2012 vvhhgsgyzc.exe 33 PID 2012 wrote to memory of 2892 2012 vvhhgsgyzc.exe 33 PID 2012 wrote to memory of 2892 2012 vvhhgsgyzc.exe 33 PID 2012 wrote to memory of 2892 2012 vvhhgsgyzc.exe 33 PID 2928 wrote to memory of 2644 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 34 PID 2928 wrote to memory of 2644 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 34 PID 2928 wrote to memory of 2644 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 34 PID 2928 wrote to memory of 2644 2928 c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe 34 PID 2644 wrote to memory of 2960 2644 WINWORD.EXE 36 PID 2644 wrote to memory of 2960 2644 WINWORD.EXE 36 PID 2644 wrote to memory of 2960 2644 WINWORD.EXE 36 PID 2644 wrote to memory of 2960 2644 WINWORD.EXE 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c11192dc6211e591dca1454c40404a7d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\vvhhgsgyzc.exevvhhgsgyzc.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\lvexkazu.exeC:\Windows\system32\lvexkazu.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2892
-
-
-
C:\Windows\SysWOW64\jhcdthpnbjsrjtf.exejhcdthpnbjsrjtf.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2576
-
-
C:\Windows\SysWOW64\lvexkazu.exelvexkazu.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1608
-
-
C:\Windows\SysWOW64\gairbmoykoebi.exegairbmoykoebi.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2796
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:2960
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD58935f48890f91e24ea47e9c689606b14
SHA1dc1a8c97e0cb9883c52e0cc0ebd576c952397889
SHA2567a6d4fc48d9454eb1e4538e23c90e816b5a29942bd26697d8fb3498ec6e258b6
SHA512a319d694aa3f71fc8fd7276ebeee88c3be4ff3ed07ffdbe5b832ed5ca2e693a4e32162afba13cca9d254b8535ae4d867f84f90c5ca78b9185f9b6e3b1bbf05c9
-
Filesize
512KB
MD504f1d0c1a6ba73b9a768eb31d2e90050
SHA1afb94a682eb890ecff9615d7f8b0a27e4f15b233
SHA25617e1c5b4b4fcb89f79585aa2a960013b283b0894bdcdcc546c66087f707caf94
SHA512ef008f8533dbd259724dc918715a93af72acd22f10bf75fa741cdbc45cca7dfbd344a196f8488fc8391802f9047cae18ddeaf8068b6e7486b5e34f09976269d5
-
Filesize
19KB
MD5262f1844215092f2a8d777e0f28377e3
SHA136c9d4c9c2c384b1df369fa7424f6251e6497062
SHA25632f73cca6f4ece0f37ec102409b3931fcee07e3cc5abb615f903a768799f3b99
SHA512a373143686968d9cb7773937cb6b6eaaf4a812dee0c9ccc2add9c6681a542673d47f5e718c805b8f7efc73386511884fc47eaddb97c93c965edfe69f4662d25d
-
Filesize
512KB
MD5c4c5cfac7a2a28809da7ce63c066aba8
SHA1caa0ea13a886206718342fb41130a9590aaa46fb
SHA256ffce63f3e6c053cdd5047346043e3e3a498d66a83e288cabd01aa293a1c3a733
SHA512268bd4f18541f8e3a27dfe83375b1f3ccd3763a704909c2ea223f5450a94b36d920a7701fe862e13ad5f192b1b7fc3b03271df2022348ff6927942077f4ec3f7
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD55886d993bd3fae05395560d36c1b09dd
SHA11f79a8b9f4945c5fa1f65206ff27a6884088cdfa
SHA25618a18765562c53a68ad4f3d9b5c1cf6f259ee46a6335ad825f998647fc04385a
SHA51227e4e3e90203bfbabdbb1249efbf55145aac4c71f121de7b55b6c49f58ea61242fe3a853cc69a437496e33208089e9999502c68a84fb8635e4f134288c6b33aa
-
Filesize
512KB
MD567a098a49d82152cd2623632371ca7b7
SHA12c64cf8b8b60dd63e06786f81a7ea7976899d8da
SHA25605fce3c7184077881bdadbc1a67a803fed5c220dc1385792ffa48fd013323449
SHA5121ac8cdf00cbe1746c996dc0852992ed65baa8f224ae1b4bd5c0f029e3daa99da0a1724d2b079895439e9ac68ae43bb9f53d49cb0e45abe501cfb26face76907f
-
Filesize
512KB
MD5c00be9890f4c46fe706bbf648b84216f
SHA1019d27285255383b948bc2f092c4e7cb0b739294
SHA2563bdfa69e59f9ce3b0791c84b4a80e1b21ddd9da30519579820dbd086e299ef68
SHA51215b2c92057e599ef8cb2cbcd9c49d47f623833cdbd29e6e88b990816d81a5baabd7325250b345f1a3a4c832c97e43e4cc3c80b44dc18fa66e94f79233c1e5a81