Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 21:51
Behavioral task
behavioral1
Sample
db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe
-
Size
7.6MB
-
MD5
db4783d98a68a9798aa3c953999e98e4
-
SHA1
d8c76af371431c7211aff2758e2a2067168e5027
-
SHA256
7c5050753cbab1d4f72a0ef6ea8c06a68d6ea831ea84c9a8ff70614d3b656e91
-
SHA512
68fe18c9bb7b04e3cecb6e17f265c6919b740e935a53f8c10740b71c9b096367a335cbb74f312b8a8088d209fd08c49bfa353b0f7b46f13cff397bcfcfce0986
-
SSDEEP
196608:Ta9+6Y7SOEibgR7ZOfeWKCBoDmpZPzmGP8cGBfWJGBfWzb:TFgR7ZOfeWKCBoC2GuWeW
Malware Config
Signatures
-
Detect Blackmoon payload 4 IoCs
resource yara_rule behavioral1/memory/2316-0-0x0000000000400000-0x0000000000619000-memory.dmp family_blackmoon behavioral1/files/0x0001000000011c9e-12.dat family_blackmoon behavioral1/memory/2316-340-0x0000000000400000-0x0000000000619000-memory.dmp family_blackmoon behavioral1/memory/2316-739-0x0000000000400000-0x0000000000619000-memory.dmp family_blackmoon -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe -
XMRig Miner payload 19 IoCs
resource yara_rule behavioral1/memory/2316-0-0x0000000000400000-0x0000000000619000-memory.dmp xmrig behavioral1/files/0x0008000000016d3f-7.dat xmrig behavioral1/files/0x0001000000011c9e-12.dat xmrig behavioral1/memory/2832-339-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2316-340-0x0000000000400000-0x0000000000619000-memory.dmp xmrig behavioral1/memory/2832-363-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2832-372-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2832-738-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2316-739-0x0000000000400000-0x0000000000619000-memory.dmp xmrig behavioral1/memory/2832-740-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2832-741-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2832-742-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2832-743-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2832-744-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2832-745-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2832-746-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2832-747-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2832-748-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral1/memory/2832-749-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe" db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe" db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe" db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe" db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe" db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe" db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2832 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2316-0-0x0000000000400000-0x0000000000619000-memory.dmp upx behavioral1/files/0x0001000000011c9e-12.dat upx behavioral1/memory/2316-340-0x0000000000400000-0x0000000000619000-memory.dmp upx behavioral1/memory/2316-739-0x0000000000400000-0x0000000000619000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe" db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\raserver.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\reg.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\WerFault.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmic.inf_amd64_neutral_b94eb92e8150fa35\vmicsvc.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\wsmprovhost.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\fc.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\fixmapi.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\ieUnatt.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\isoburn.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\setup16.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\upnpcont.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\PushPrinterConnections.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\runas.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\charmap.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\poqexec.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\proquota.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\shrpubw.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\syskey.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\auditpol.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\dccw.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\dpnsvr.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\msfeedssync.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\NETSTAT.EXE db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\TapiUnattend.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\at.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\mountvol.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\Robocopy.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\sdiagnhost.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\TRACERT.EXE db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\vssadmin.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\forfiles.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\pcaui.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\rekeywiz.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\sfc.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPMGR.EXE db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\clip.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\dllhost.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\psr.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\taskkill.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\diskcopy.com db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\choice.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\cliconfg.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\ROUTE.EXE db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\secinit.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\SyncHost.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPDCT.EXE db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\cscript.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\dpapimig.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\subst.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\taskeng.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\chkdsk.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\dfrgui.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\ktmutil.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\mcbuilder.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\netbtugc.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\setupSNK.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrshost.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\Ribbons.scr db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\SysWOW64\diskpart.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{26793F86-7A02-4BBD-B5DA-4AA3D83AA174}\chrome_installer.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\settings.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\cpu.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsMacroTemplate.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files\Windows Media Player\setup_wm.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplateRTL.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files\Windows Defender\MSASCui.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\currency.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Soft Blue.htm db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files\DVD Maker\DVDMaker.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\sidebar.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\calendar.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Green Bubbles.htm db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.HTM db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\iexplore.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\sidebar.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\RSSFeeds.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\picturePuzzle.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsColorChart.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\WMPDMC.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\settings.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\settings.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OSPP.HTM db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files\Windows Journal\Journal.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\settings.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\flyout.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\settings.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\clock.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\slideShow.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\Fonts\GlobalMonospace.CompositeFont db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\401.htm db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\405.htm db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_6.1.7601.17514_none_1202940e4711971e\plasrv.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0098688ad232f281\cpu.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\502.htm db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config.comments db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\404-9.htm db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.1.7600.16385_none_81d82fe9c216eb89\pcaui.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_6.1.7600.16385_none_c25bebf1075ff6aa\OptionalFeatures.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-regini_31bf3856ad364e35_6.1.7600.16385_none_0c2c92921b2478ef\regini.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_18a11c58aaf4d08c\MigSetup.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\404-8.htm db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_6.1.7601.17514_none_1229a6f0546e2346\lpr.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\404-3.htm db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\412.htm db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-msdt_31bf3856ad364e35_6.1.7600.16385_none_0177539a37378025\msdt.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad_lodctr.exe_b02cefba db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.1.7601.17514_none_df7c5af777ec4541\drvinst.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..-currency.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_5c4791cafd126e03\currency.html db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..executionprevention_31bf3856ad364e35_6.1.7600.16385_none_25d85b4a3e4a7709\SystemPropertiesDataExecutionPrevention.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_d911df4e81059b22\subst.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\chglogon.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_narrator-nonmsil_31bf3856ad364e35_6.1.7601.17514_none_8b63c5e0db87fde8\Narrator.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\401-2.htm db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\twunk_16.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_6.1.7600.16385_none_5cbb962a4f0d58c1\fc.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..ng-spooler-splwow64_31bf3856ad364e35_6.1.7601.17514_none_25d05769a8973724_splwow64.exe_74753166 db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_22f5c6aadf559287\MigSetup.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-notepad_31bf3856ad364e35_6.1.7600.16385_none_d5642974be118415\notepad.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7600.16385_none_ce6f64032560fa6b\instnm.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_ef38a8d0d05cc2c7\IMJPDADM.EXE db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-rasclienttools_31bf3856ad364e35_6.1.7600.16385_none_6f1d25ec0a04d811\rasphone.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-computerdefaults_31bf3856ad364e35_6.1.7600.16385_none_626b9352dcfa715c\ComputerDefaults.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\500-13.htm db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_6.1.7600.16385_none_f0686b7ca6acde00\mpnotify.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-dns-client_31bf3856ad364e35_6.1.7601.17514_none_4008824c98f8edac_dnscacheugc.exe_aa32623e db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\404-5.htm db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_6.1.7601.17514_none_fa8534ab236134c4\rrinstaller.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-snmp-agent-service_31bf3856ad364e35_6.1.7601.17514_none_5faf9128a3432508\snmp.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-p..erandprintui-pmcppc_31bf3856ad364e35_6.1.7601.17514_none_0d6fabd7def3be93\PushPrinterConnections.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-wimgapi_31bf3856ad364e35_6.1.7601.17514_none_8b030c557320a2c1\wimserv.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wordpad_31bf3856ad364e35_6.1.7601.17514_none_8be07ea283850f02\wordpad.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-mcglidhost_31bf3856ad364e35_6.1.7600.16385_none_05a2b72417ec1c6a\mcGlidHost.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-mspaint_31bf3856ad364e35_6.1.7600.16385_none_8df3dcc84fe54e8b\mspaint.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_6.1.7600.16385_none_7c6ba3bd1f954290\wermgr.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\find.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-mobsyncexe_31bf3856ad364e35_6.1.7601.17514_none_f1584379b2973708\mobsync.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tzutil_31bf3856ad364e35_6.1.7601.17514_none_9269da4819c69a89\tzutil.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\Backup\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_347a450f0c8bd52d_printui.exe_bb673fff db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\d09b54cd68bc772b3be3832926e940d4\LoadMxf.ni.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-w..ion-twaincomponents_31bf3856ad364e35_6.1.7601.17514_none_8b399e33ba72bed9\twunk_16.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-18.htm db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\404-10.htm db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\ehome\WTVConverter.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\406.htm db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\500-13.htm db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.17932_none_d26a33ec18cb49c4\conhost.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_6.1.7600.16385_none_61573ee0c2c4be2b\wecutil.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\403-10.htm db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2316 db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe Token: 33 2316 db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2316 db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2832 svchost.exe Token: SeLockMemoryPrivilege 2832 svchost.exe Token: SeLockMemoryPrivilege 2832 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2316 db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2832 2316 db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe 30 PID 2316 wrote to memory of 2832 2316 db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe 30 PID 2316 wrote to memory of 2832 2316 db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe 30 PID 2316 wrote to memory of 2832 2316 db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe 30 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\db4783d98a68a9798aa3c953999e98e4_JaffaCakes118.exe"1⤵
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2316 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.2MB
MD542d4b7a46f8884c388609509d397e9c9
SHA11cf64cc6a5b5c1a8b0984b58df2e11238933dc69
SHA2568abada1ac471c91a43ff40fbb89c986ba06ab6ab5ef9763649480378b38f7bff
SHA512769fcec9c60ba91c0549c468cf6f62e8da95e71c4dcd22320392364806ef35d6b14d57097b8467902068238e41b9a545f43a4b15463030564f5fba5c56e7a381
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html
Filesize16KB
MD5ed1191da9c4f74a60d695a25686f374e
SHA13a427657c16a716be332587425101653c25221d0
SHA256ab8cafd1958c27d70adc747259495e35592f8a06ae00969964f5f34f72896f3f
SHA51268098c1342f87939b3f57cd3e3a799ff316d2f1eb5c52f8d9c0c9e7c214281bff68a1260a91527b7175ad031798f42125cf9ee2e0d49772eb03b5836b67d9fbf
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html
Filesize6KB
MD5657eb3527d651515f97b960a67d19fda
SHA127404b587183bc2f3b3b6919fbb91892f505b60d
SHA256f301745232a72d84f277980ad53b65d94b02479369e8b73fe0e6717adcf11a35
SHA5121085550a8844de081a216bd864990e56fbe91498fb6186cce435173ab73e29932e7b8182078cd2876039addbdb7e3c9769d7d7923f7ed2a5422e6a2a36321b70
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html
Filesize12KB
MD5cdea5d1cccee27144519c75bcf3015bd
SHA1c36862abb1ada006b3dd4c28adc8b393a92fd325
SHA2561184f2316c36648a2d457b602c713d5d5eb980e86e5e8ed388e94a47f8573dbd
SHA5125d0ea1cef2af7111098c19578c42bfdfd7bb00ec3259fe026df6dd867a24f9a94f3299b035235e3cb87b1c9010f0d1be434a08318dae0412e03ecfdb439edfe9
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html
Filesize9KB
MD5bc3e199345ad8ba54e2fe4acad95433d
SHA1c93cb69c27e1c03069de3c952534a52f391e3fb9
SHA256462c197c83ee3d677b07fe000b2c4e64ac4be4ceaaea80c1c77a5e67d832edd8
SHA512c1941c9106ff0d665dfee1888afcdc3c54e4db8fdb11e3313cd92a147a1084264dba8f1f9cbac5216d3c5ce1f97ff7f8d7d7493826ec3538d5db57a933fe32e4
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html
Filesize14KB
MD559e4add1732aef6b8e228ecfb880c299
SHA131a6380e878f89ec9d2c83716fe42faafdd828db
SHA256089aaccbf4c17d2a0163f13820e926f8ce3122c9ed87e7e040a77439795b8fc4
SHA512461240638f98f92a0df94a6a76470d7ed3a9bf45f845b545ff37355efd4fb3efdbe592e563b6624d2e42374a3bf7682a572c3bfd96c21be87fc96ec3b3bcfbaf
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html
Filesize16KB
MD526986f79440b7a706b65724e509f009f
SHA19d8ff0beef1c19fbecd28e3f632101acf3d02599
SHA256e59b7fa34b947d5ada478ff17543204251955052fdace284e5a285bd2abec5d1
SHA5122c240c4f7b8912bd5049bef22c2507c7c1af15432c860549d0f1ea35f03183270eb7315607fdf35be86703a61ec0ed7801e9e6ea627a026dbf93d98ff11d2ed6
-
Filesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
Filesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
Filesize
81KB
MD5b08542cf9638d9e833f17411819b573f
SHA1479132c24765c5f3b2cfd4b613c0fa99daeb7dad
SHA25688e616ba238eb0db2f672225304129afbc39396ae88c1cfe93603395fc193c40
SHA512c2bbdd0f3d226e6e01bea22e764a06f6680ae279cbd4b047bf75ef99fa86d508bb2556abd8d5cde6d16c1b9d0ef0b54884e43fb996ee244f5edfce3759df27b8