Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 01:26
Behavioral task
behavioral1
Sample
eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe
-
Size
9.1MB
-
MD5
eecf728e47d5ec61e962cf1dc07a7ac2
-
SHA1
621a5e303bff3957bebbf6e761365a03139dab3c
-
SHA256
2712ce115756d4432703711de2fa430a1b809d73c69e781d41bd114922a5d753
-
SHA512
9a88c106486b1771338372a0b33a1ddf03dac37648c719ef052f538aa5298e8290854f61868a32f03367be06319ee476a29c0efea6b8504b8d0570e6790425d9
-
SSDEEP
196608:i7effIPEsy58doQaTzwZ8Jq3QKnqVtxQnKnqVtxQu9OryfEQncryfEQuWCLeybAu:i7effIPEsy58doQaTzwZ8Jq3QKnqVtxB
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe," eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\spools.exe eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\spools.exe eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe" eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe -
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0007000000023476-15.dat acprotect behavioral2/memory/2156-18-0x0000000010000000-0x000000001010B000-memory.dmp acprotect behavioral2/memory/2156-20-0x0000000010000000-0x000000001010B000-memory.dmp acprotect -
Loads dropped DLL 1 IoCs
pid Process 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/2156-0-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/files/0x000700000002346f-5.dat upx behavioral2/files/0x0007000000023476-15.dat upx behavioral2/memory/2156-18-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/memory/2156-19-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/516-21-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2156-20-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/memory/1992-22-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/4488-23-0x0000000000400000-0x0000000000426000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\Q: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\W: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\T: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\W: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\M: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\R: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\T: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\S: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\U: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\N: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\J: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\T: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\X: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\Q: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\U: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\X: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\I: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\R: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\G: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\S: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\L: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\I: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\X: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\J: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\G: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\P: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\M: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\Q: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\S: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\O: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\T: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\H: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\N: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\N: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\E: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\I: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\Q: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\W: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\O: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\X: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\E: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\V: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\V: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\W: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\P: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\N: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\O: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\R: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\L: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\H: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\V: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\K: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\J: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\K: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\G: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\U: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\I: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\U: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\M: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\H: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\E: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\E: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe File opened (read-only) \??\J: eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects reg.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost = "logonui.exe" eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ftpdll.dll eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 516 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 516 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2156 wrote to memory of 516 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 85 PID 2156 wrote to memory of 516 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 85 PID 2156 wrote to memory of 516 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 85 PID 2156 wrote to memory of 1628 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 89 PID 2156 wrote to memory of 1628 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 89 PID 2156 wrote to memory of 1628 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 89 PID 2156 wrote to memory of 1992 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 90 PID 2156 wrote to memory of 1992 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 90 PID 2156 wrote to memory of 1992 2156 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 90 PID 516 wrote to memory of 4488 516 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 92 PID 516 wrote to memory of 4488 516 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 92 PID 516 wrote to memory of 4488 516 eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Users\Admin\AppData\Local\Temp\eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe3⤵
- Enumerates connected drives
PID:4488
-
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f2⤵
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
PID:1628
-
-
C:\Users\Admin\AppData\Local\Temp\eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\eecf728e47d5ec61e962cf1dc07a7ac2_JaffaCakes118.exe2⤵
- Enumerates connected drives
PID:1992
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.1MB
MD5157eee2d9e7e5442eb1fbf5abe305370
SHA1df0369b4eedd42ce3d242814728517c5f5709560
SHA256c2d444420faa49b6dc7b5f01c5d0c5bea058a9c0ab5541bf8964dcdd58a73a8a
SHA512f33d6a7265ff3fce0070564e96f61bcf5a13e74bf7692122f354734ade5829f6f91849524e785955b4733b4fd21da99467189bdae94645d7960a29f1b43f21f0
-
Filesize
5KB
MD5d807aa04480d1d149f7a4cac22984188
SHA1ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9
SHA256eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb
SHA512875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e