Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 14:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe
-
Size
88KB
-
MD5
c8fc70f58d186bc77960daa2a2396111
-
SHA1
29965681b132ef5e8aca9f299b32f65d7cd9bea0
-
SHA256
7595260b8b810dc3884e124d49bf57a5613fbf05fed58805a39b2f0a1bec2a0a
-
SHA512
b2ed4ef83fadfa40706d6f1800f1a9ec4ecddd5ce00e73e3fe54f283a35a56c6ca594d41fa82b510da0a67ffc2a01e339df2e1df68edf499d54b0f5bb1f684e2
-
SSDEEP
1536:VoGyX8vr1+baP1jkjUCW8r58g+16w1jWjUC481yDMFCvJgZP1aZd3BddzyhP1aWT:VWX8vr1+baP1jkjUCW8r58g+16w1jWjC
Score
8/10
Malware Config
Signatures
-
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\Drivers\SUPER.BCH c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\Drivers\SUPER.BCH c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PERSFW.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFIADMIN.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP32.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPCC.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TASKM\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TDS2-NT.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCRSCAN.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCFWALLICON.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVWNT.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IBMASN.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\N32SCANW.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSS c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSHWIN32.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VET95.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVCL..EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPUPD.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SAFEWEB.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IOMON98.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICMON.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAV7.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PADMIN.EOUTPOST.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVP95.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFIADMIN.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVLU32.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAW95CF.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMDEVMONSRV.exe\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSHW c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VETTRAY.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NORMIST.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSCAN40.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VETTRAY.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TCA.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NISUM.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BLACKD.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AUTODOWN.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVAPW32.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVAPW32.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ACKWIN32.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WFINDV32.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVW32.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\N32SCANW.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPROT.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OfficeScanNTPersonalFirewall\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NUPGRADE.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAW95CF.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WFINDV32.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VET95.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SPHINX.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SPHINX.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANPM.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LOCKDOWN2000.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonxp.kxp\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVWSC.exe c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FESCUE.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAV7WIN.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVLU32.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVE32.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NortonAntiVirusServer\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZONEALARM.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon = "C:\\WINDOWS\\SUPER.BCH,0" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MJ0011 = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SafeGuard = "C:\\WINDOWS\\system\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BCH = "C:\\WINDOWS\\system32\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemDoctor = "C:\\WINDOWS\\system32\\Drivers\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\c:\autorun.inf c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File created \??\d:\autorun.inf c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File created \??\f:\autorun.inf c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\SUPER.BCH c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\SUPER.BCH c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Drops file in Program Files directory 29 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\Stationery\Green Bubbles.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\Stationery\Roses.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\Stationery\Soft Blue.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsVersion1Warning.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\Stationery\Orange Circles.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsVersion1Warning.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\Stationery\Hand Prints.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\Stationery\Stars.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsVersion1Warning.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\Stationery\Shades of Blue.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\404-15.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\502.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Roses.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Shades of Blue.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\404-5.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\404-11.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\404-13.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\404-9.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-3.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-13.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\500.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\401-2.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\403.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\403-16.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\404-4.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-2.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-8.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-18.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\404-13.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\403-12.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\404-1.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\404-7.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Green Bubbles.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\404-6.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\403-13.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\403-3.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\500-14.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\500-13.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\404-6.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\500-16.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-sonic-clickme_31bf3856ad364e35_6.1.7600.16385_none_560dd693a7476c8c\ClickMe.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\401-4.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\403-12.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\401-4.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-18.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-5.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\401-2.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\500-19.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\401-1.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\403-7.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\404.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-11.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\500-15.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\500-15.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-16.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\403-4.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\404-2.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification C:\WINDOWS\SUPER.BCH c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\401.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-5.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\404-8.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-6.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-14.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\401-3.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\404-2.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-17.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\404-14.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\401-5.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\401-4.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-19.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\404.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\403-18.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\500-18.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bch c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bch\ = "exefile" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon = "C:\\WINDOWS\\SUPER.BCH,0" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2844 c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2844 c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe"1⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Modifies system executable filetype association
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2844
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5c8fc70f58d186bc77960daa2a2396111
SHA129965681b132ef5e8aca9f299b32f65d7cd9bea0
SHA2567595260b8b810dc3884e124d49bf57a5613fbf05fed58805a39b2f0a1bec2a0a
SHA512b2ed4ef83fadfa40706d6f1800f1a9ec4ecddd5ce00e73e3fe54f283a35a56c6ca594d41fa82b510da0a67ffc2a01e339df2e1df68edf499d54b0f5bb1f684e2