Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 15:59
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
25 signatures
150 seconds
General
-
Target
dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe
-
Size
512KB
-
MD5
dc9063b98ddc0372cc6aabe10d00c379
-
SHA1
10bc51c8e9c32f6e07d45676c873961e3acb9495
-
SHA256
569b9bc09c033c0233bab251d651cd8ebfc6b294c6250862e6afa9dd57a9d7d4
-
SHA512
4b506c2607505fa2572a90b2888e2992cdfaed52e1edeea7eba743033432cf05b78fd035114d97e9518df2de28ebf84e321db51229934b7e770f56db6c7a05d4
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Y:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5/
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" kfplvfqsmk.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kfplvfqsmk.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kfplvfqsmk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kfplvfqsmk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" kfplvfqsmk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kfplvfqsmk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kfplvfqsmk.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" kfplvfqsmk.exe -
Executes dropped EXE 5 IoCs
pid Process 2188 kfplvfqsmk.exe 708 ztkryjuqnyfafmo.exe 2764 ogudnyun.exe 3032 hmxqznfyghude.exe 2888 ogudnyun.exe -
Loads dropped DLL 5 IoCs
pid Process 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 2188 kfplvfqsmk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kfplvfqsmk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kfplvfqsmk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kfplvfqsmk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" kfplvfqsmk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kfplvfqsmk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" kfplvfqsmk.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eygncmua = "kfplvfqsmk.exe" ztkryjuqnyfafmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ufxlokeh = "ztkryjuqnyfafmo.exe" ztkryjuqnyfafmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "hmxqznfyghude.exe" ztkryjuqnyfafmo.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: ogudnyun.exe File opened (read-only) \??\x: ogudnyun.exe File opened (read-only) \??\s: kfplvfqsmk.exe File opened (read-only) \??\l: ogudnyun.exe File opened (read-only) \??\a: ogudnyun.exe File opened (read-only) \??\k: ogudnyun.exe File opened (read-only) \??\r: kfplvfqsmk.exe File opened (read-only) \??\o: ogudnyun.exe File opened (read-only) \??\j: kfplvfqsmk.exe File opened (read-only) \??\z: ogudnyun.exe File opened (read-only) \??\m: kfplvfqsmk.exe File opened (read-only) \??\q: kfplvfqsmk.exe File opened (read-only) \??\o: kfplvfqsmk.exe File opened (read-only) \??\w: ogudnyun.exe File opened (read-only) \??\a: kfplvfqsmk.exe File opened (read-only) \??\b: kfplvfqsmk.exe File opened (read-only) \??\q: ogudnyun.exe File opened (read-only) \??\g: kfplvfqsmk.exe File opened (read-only) \??\z: kfplvfqsmk.exe File opened (read-only) \??\p: kfplvfqsmk.exe File opened (read-only) \??\t: kfplvfqsmk.exe File opened (read-only) \??\w: kfplvfqsmk.exe File opened (read-only) \??\t: ogudnyun.exe File opened (read-only) \??\i: ogudnyun.exe File opened (read-only) \??\s: ogudnyun.exe File opened (read-only) \??\z: ogudnyun.exe File opened (read-only) \??\k: ogudnyun.exe File opened (read-only) \??\p: ogudnyun.exe File opened (read-only) \??\i: kfplvfqsmk.exe File opened (read-only) \??\v: kfplvfqsmk.exe File opened (read-only) \??\h: ogudnyun.exe File opened (read-only) \??\g: ogudnyun.exe File opened (read-only) \??\o: ogudnyun.exe File opened (read-only) \??\r: ogudnyun.exe File opened (read-only) \??\u: ogudnyun.exe File opened (read-only) \??\j: ogudnyun.exe File opened (read-only) \??\n: ogudnyun.exe File opened (read-only) \??\y: ogudnyun.exe File opened (read-only) \??\a: ogudnyun.exe File opened (read-only) \??\j: ogudnyun.exe File opened (read-only) \??\w: ogudnyun.exe File opened (read-only) \??\p: ogudnyun.exe File opened (read-only) \??\y: kfplvfqsmk.exe File opened (read-only) \??\s: ogudnyun.exe File opened (read-only) \??\n: kfplvfqsmk.exe File opened (read-only) \??\e: ogudnyun.exe File opened (read-only) \??\m: ogudnyun.exe File opened (read-only) \??\e: ogudnyun.exe File opened (read-only) \??\e: kfplvfqsmk.exe File opened (read-only) \??\h: kfplvfqsmk.exe File opened (read-only) \??\u: ogudnyun.exe File opened (read-only) \??\i: ogudnyun.exe File opened (read-only) \??\n: ogudnyun.exe File opened (read-only) \??\b: ogudnyun.exe File opened (read-only) \??\l: ogudnyun.exe File opened (read-only) \??\t: ogudnyun.exe File opened (read-only) \??\x: kfplvfqsmk.exe File opened (read-only) \??\y: ogudnyun.exe File opened (read-only) \??\h: ogudnyun.exe File opened (read-only) \??\r: ogudnyun.exe File opened (read-only) \??\l: kfplvfqsmk.exe File opened (read-only) \??\b: ogudnyun.exe File opened (read-only) \??\q: ogudnyun.exe File opened (read-only) \??\v: ogudnyun.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" kfplvfqsmk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" kfplvfqsmk.exe -
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2408-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x0008000000016c58-9.dat autoit_exe behavioral1/files/0x000d0000000131aa-17.dat autoit_exe behavioral1/files/0x0008000000016c4e-22.dat autoit_exe behavioral1/files/0x0007000000016cd3-34.dat autoit_exe behavioral1/files/0x0008000000016d13-69.dat autoit_exe behavioral1/files/0x00090000000167dc-67.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ogudnyun.exe dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe File created C:\Windows\SysWOW64\hmxqznfyghude.exe dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\hmxqznfyghude.exe dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\kfplvfqsmk.exe dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe File created C:\Windows\SysWOW64\ztkryjuqnyfafmo.exe dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe File created C:\Windows\SysWOW64\ogudnyun.exe dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe File created C:\Windows\SysWOW64\kfplvfqsmk.exe dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ztkryjuqnyfafmo.exe dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll kfplvfqsmk.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe ogudnyun.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal ogudnyun.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal ogudnyun.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe ogudnyun.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe ogudnyun.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe ogudnyun.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe ogudnyun.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe ogudnyun.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe ogudnyun.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe ogudnyun.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal ogudnyun.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe ogudnyun.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe ogudnyun.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal ogudnyun.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ogudnyun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kfplvfqsmk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ztkryjuqnyfafmo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ogudnyun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hmxqznfyghude.exe -
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" kfplvfqsmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33332C7E9D5083536D4376D677272DDD7D8364AD" dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBFF9B0F966F2E084793B4B819E3E90B08103FD43150338E1C842ED08A5" dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat kfplvfqsmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" kfplvfqsmk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh kfplvfqsmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" kfplvfqsmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" kfplvfqsmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF9FF8A4F2882699032D7297D93BCE4E135593066426343D791" dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F468C3FE1A21ADD273D0A38B7C916B" dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1945C60C1493DAB7B8CB7C94EDE234BA" dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs kfplvfqsmk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg kfplvfqsmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" kfplvfqsmk.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" kfplvfqsmk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc kfplvfqsmk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC4B12D4492399F53BFB9A233E9D7C8" dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf kfplvfqsmk.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2872 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 2188 kfplvfqsmk.exe 2188 kfplvfqsmk.exe 2188 kfplvfqsmk.exe 2188 kfplvfqsmk.exe 2188 kfplvfqsmk.exe 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 708 ztkryjuqnyfafmo.exe 708 ztkryjuqnyfafmo.exe 708 ztkryjuqnyfafmo.exe 708 ztkryjuqnyfafmo.exe 708 ztkryjuqnyfafmo.exe 2764 ogudnyun.exe 2764 ogudnyun.exe 2764 ogudnyun.exe 2764 ogudnyun.exe 2888 ogudnyun.exe 2888 ogudnyun.exe 2888 ogudnyun.exe 2888 ogudnyun.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 708 ztkryjuqnyfafmo.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 708 ztkryjuqnyfafmo.exe 708 ztkryjuqnyfafmo.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 708 ztkryjuqnyfafmo.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 708 ztkryjuqnyfafmo.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 708 ztkryjuqnyfafmo.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 708 ztkryjuqnyfafmo.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 708 ztkryjuqnyfafmo.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 708 ztkryjuqnyfafmo.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 708 ztkryjuqnyfafmo.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 708 ztkryjuqnyfafmo.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 708 ztkryjuqnyfafmo.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 2188 kfplvfqsmk.exe 2188 kfplvfqsmk.exe 2188 kfplvfqsmk.exe 708 ztkryjuqnyfafmo.exe 708 ztkryjuqnyfafmo.exe 708 ztkryjuqnyfafmo.exe 2764 ogudnyun.exe 2764 ogudnyun.exe 2764 ogudnyun.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 2888 ogudnyun.exe 2888 ogudnyun.exe 2888 ogudnyun.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 2188 kfplvfqsmk.exe 2188 kfplvfqsmk.exe 2188 kfplvfqsmk.exe 708 ztkryjuqnyfafmo.exe 708 ztkryjuqnyfafmo.exe 708 ztkryjuqnyfafmo.exe 2764 ogudnyun.exe 2764 ogudnyun.exe 2764 ogudnyun.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 3032 hmxqznfyghude.exe 2888 ogudnyun.exe 2888 ogudnyun.exe 2888 ogudnyun.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2872 WINWORD.EXE 2872 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2188 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 31 PID 2408 wrote to memory of 2188 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 31 PID 2408 wrote to memory of 2188 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 31 PID 2408 wrote to memory of 2188 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 31 PID 2408 wrote to memory of 708 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 32 PID 2408 wrote to memory of 708 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 32 PID 2408 wrote to memory of 708 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 32 PID 2408 wrote to memory of 708 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 32 PID 2408 wrote to memory of 2764 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 33 PID 2408 wrote to memory of 2764 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 33 PID 2408 wrote to memory of 2764 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 33 PID 2408 wrote to memory of 2764 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 33 PID 2408 wrote to memory of 3032 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 34 PID 2408 wrote to memory of 3032 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 34 PID 2408 wrote to memory of 3032 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 34 PID 2408 wrote to memory of 3032 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 34 PID 2188 wrote to memory of 2888 2188 kfplvfqsmk.exe 35 PID 2188 wrote to memory of 2888 2188 kfplvfqsmk.exe 35 PID 2188 wrote to memory of 2888 2188 kfplvfqsmk.exe 35 PID 2188 wrote to memory of 2888 2188 kfplvfqsmk.exe 35 PID 2408 wrote to memory of 2872 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 36 PID 2408 wrote to memory of 2872 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 36 PID 2408 wrote to memory of 2872 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 36 PID 2408 wrote to memory of 2872 2408 dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe 36 PID 2872 wrote to memory of 1660 2872 WINWORD.EXE 38 PID 2872 wrote to memory of 1660 2872 WINWORD.EXE 38 PID 2872 wrote to memory of 1660 2872 WINWORD.EXE 38 PID 2872 wrote to memory of 1660 2872 WINWORD.EXE 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc9063b98ddc0372cc6aabe10d00c379_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\kfplvfqsmk.exekfplvfqsmk.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\ogudnyun.exeC:\Windows\system32\ogudnyun.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2888
-
-
-
C:\Windows\SysWOW64\ztkryjuqnyfafmo.exeztkryjuqnyfafmo.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:708
-
-
C:\Windows\SysWOW64\ogudnyun.exeogudnyun.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2764
-
-
C:\Windows\SysWOW64\hmxqznfyghude.exehmxqznfyghude.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3032
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1660
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5632199375e95e76927ba899a7a6f1c79
SHA188371a674a1de2c6d1c18705c33772b7abae404d
SHA25660fccb526738d7d36c05f1e732346a2d3c73d34297eb657704a3e827838ff13d
SHA5124245d41c19dbe4650095a1603697c91df013a1e5572181e09ae64cc435ec5156d9e8dfb8f4bbc9876ceae355ae28d79cdd3cbbd7af064d3ea0eb8abb04ad3fea
-
Filesize
512KB
MD54438eab87f0c09fe10c3ae4523c99de5
SHA150c7e526391f8c487639a993fda5d1d7597cdd5a
SHA2568b32c92bdd9313087a453d8f18cd21697b65e23d2adb1f3c2b9bdb3c7cdea14e
SHA512a82ad24a4ad25fd6fbf5f0d9cb6c8f32cf1b02b21484c48310058a05d8686b44f10a9635b2c23d487784a186f3ec9702c40fd54f6ddecd3c0a4f7786b21d2901
-
Filesize
391B
MD58f1d3b5c73b183a31913fa1a6a9533a2
SHA1d01d853b4fb618881e052aef4f9281e33623cada
SHA2565a5a1917bf4066b9a8755c09392b44771d31cb9870ff76edf9b7174dcfd2d454
SHA5126c321d47fd623839057075c660552148b036096776f7ca2779bcb8a4b06820d07c28ce0bfa34cc4098e0a1ce4bc4e2c3d91d0d5e080eac2ceb94ce1630b755d9
-
Filesize
19KB
MD59d29c9767751b3a482c2a79d058be8e2
SHA1baa3a1fde098ee9f87497038bfa9600c509f609c
SHA256b7815320c75de1dab7745a64fdd4c73194a4f80f199f5a495d6894d4e04216ef
SHA5129ee4a51f18724161f20649f3d25e2c51e150b4aea32b8d89eec15b74468c52eb2d99892a578fb577025a89fcc15e1fcd8032d2dfb268ce034fd9c38b67c37216
-
Filesize
512KB
MD562620e32231a276e9d3b071680f235da
SHA158733b620d3e9b40dc55607a742c2d28614febef
SHA256b2673be242f86929cbc2d081969b2cf97c3fdf08c7be2cb624db5a16d03836db
SHA5129604808490d4e12e8168dfc2a0f9549667547207fb6787804dd59849577055fb7ff4ff3d18ecd58de7cb3982d2c483e5424d7ed131d5ba8c2631aa5f49a955c8
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5c8968c55ab78c8163f1ea8f20f74f31e
SHA184734a38a4c0fc9c3d553869e3d17f85ff6202b1
SHA2569f4e3574ab2d1386a56896570ffc088f8b89633fa448c0bb84e305c0860bac11
SHA512dc498c9ef46a1d2c50ccdb2872593f286d9a2093fb2d1d0dd77a113237d2650cbb4e715fa38e37175cfc54194bae5edd3feac64d8908ec27e34dfe697ca12be6
-
Filesize
512KB
MD538651b6914e97141fd90c16568897d83
SHA101825bc1bb911ef5ffe6e265bf53b15b341d1d96
SHA256ae736e2c36c0774fc20407c6ce71393ebd93fe9d31e8316a7eba50b3f64e07d8
SHA5126aeb926bc05967a133eb2a5a8b6df0697c068ff884416c22eb0fad7f0956fdc5dcff716c5e5b316995dbf6c2d7089d020e6662d94bdaf538885ca2db78672eed
-
Filesize
512KB
MD5c5d4d4fe5e52479e5634b5a3d00c5867
SHA129ca6850c46768f660b82c55b07d3d6e45a502e9
SHA256caf52957bec22e29d43993d778747d7b9109c5c4d6b68a78e819814db7509dfd
SHA512ef883015ba29426d8ee95d80237c95932a624f2ae893fc06f71d82f2962c44059d91daf3ff7db575c5f91f11f36d9711a3af02f16f6b425d1f28b8597701cd08