Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 14:14
Static task
static1
Behavioral task
behavioral1
Sample
c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe
-
Size
88KB
-
MD5
c8fc70f58d186bc77960daa2a2396111
-
SHA1
29965681b132ef5e8aca9f299b32f65d7cd9bea0
-
SHA256
7595260b8b810dc3884e124d49bf57a5613fbf05fed58805a39b2f0a1bec2a0a
-
SHA512
b2ed4ef83fadfa40706d6f1800f1a9ec4ecddd5ce00e73e3fe54f283a35a56c6ca594d41fa82b510da0a67ffc2a01e339df2e1df68edf499d54b0f5bb1f684e2
-
SSDEEP
1536:VoGyX8vr1+baP1jkjUCW8r58g+16w1jWjUC481yDMFCvJgZP1aZd3BddzyhP1aWT:VWX8vr1+baP1jkjUCW8r58g+16w1jWjC
Malware Config
Signatures
-
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\Drivers\SUPER.BCH c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File created C:\WINDOWS\SysWOW64\Drivers\SUPER.BCH c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCCWIN98.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BLACKICE.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMdevmonx.exe c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVW.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVE32.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVSCHED.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICLOAD95.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ECENGINE.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAW95CF.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPDOS32.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WFINDV32.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SWEEP95.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCRSCAN.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_AVPM.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVSCHED32.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSSTAT.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN32.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NORMIST.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSHW c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NISUM.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVLU32.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VIRUS c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVP95.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVWSC.exe\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPROT.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVP95_0.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MOOLIVE.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAW95CF.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_AVPM.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonxp.kxp c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZONEALARM.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TDS2-98.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLEANER.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWIN95.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICSUPPNT.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLEANER3.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVAPW32.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OfcPfwSvc.exe c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NVC95.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NUPGRADE.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTIV\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NMAIN.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESAFE.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsravmon c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NORMIST.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCRSCAN.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LOOKOUT.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IBMASN.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFIADMIN.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BLACKD.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsccenter c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TBSCAN.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMC.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IOMON98.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWUPD32.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPUPD.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSHWIN32.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SPHINX.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVNT.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TCA.EXE\Debugger = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FRW.EXE c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon = "C:\\WINDOWS\\SUPER.BCH,0" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MJ0011 = "C:\\WINDOWS\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SafeGuard = "C:\\WINDOWS\\system\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BCH = "C:\\WINDOWS\\system32\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemDoctor = "C:\\WINDOWS\\system32\\Drivers\\SUPER.BCH" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\c:\autorun.inf c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File created \??\d:\autorun.inf c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File created \??\f:\autorun.inf c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\SUPER.BCH c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\SUPER.BCH c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\pages\wefgalleryonenoteinsertwinrt.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\pages\winrthost.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\DisableAboutFlag.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\PhishSite_Iframe.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\500-18.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\401-4.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\404-9.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\http_406.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\invalidcert.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\invalidcert.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\defaultbrowser.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\navcancl.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\proxyerror.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\navcancl.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\DisableAboutFlag.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\404-1.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\403-1.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\PhishSiteEdge.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\DisableAboutFlag.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\http_500.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\404-5.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\404-4.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\401-4.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\403-4.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\http_400.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\http_501.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\tlserror.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\PhishSite_Iframe.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\403-16.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\BlockSite.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\http_gen.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\404-5.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\forbidframingedge.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\BlockSite.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\defaultbrowser.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-o..documents.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6ae61beebd6b13dd\oobe_learn_more_activity_history.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\404-9.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\403-6.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\404-6.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\acr_error.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\403-6.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\servbusy.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\ErrorPages\sslnavcancel.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\405.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\404-14.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\servbusy.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\404-12.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\404-7.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_45a6c0aa2ed16c7c\http_410.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\http_406.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\ErrorPages\http_404.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\404-14.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\WpcBlockFrame.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\ErrorPages\servbusy.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\403-14.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\403-17.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_45a6c0aa2ed16c7c\navcancl.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\http_501.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\es-ES\assets\ErrorPages\http_404.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\404-7.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\repost.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\WpcBlockFrame.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\403-13.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\413-1.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\PhishSiteEdge.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\forbidframingedge.htm c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bch c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bch\ = "exefile" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon = "C:\\WINDOWS\\SUPER.BCH,0" c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3448 c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3448 c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c8fc70f58d186bc77960daa2a2396111_JaffaCakes118.exe"1⤵
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Modifies system executable filetype association
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3448
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5c8fc70f58d186bc77960daa2a2396111
SHA129965681b132ef5e8aca9f299b32f65d7cd9bea0
SHA2567595260b8b810dc3884e124d49bf57a5613fbf05fed58805a39b2f0a1bec2a0a
SHA512b2ed4ef83fadfa40706d6f1800f1a9ec4ecddd5ce00e73e3fe54f283a35a56c6ca594d41fa82b510da0a67ffc2a01e339df2e1df68edf499d54b0f5bb1f684e2