Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 09:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe
-
Size
45KB
-
MD5
0a0032a860c7ae456b91400703be4a4c
-
SHA1
78b76d9fdfbbd43f70937a9025371d279593752e
-
SHA256
ef52a3d099bbf90addc13d1aec8fb29d27091192ed156f6510673a104336c707
-
SHA512
31a657e9e39f86ca37c22a7ad9ead0c218704d2720cbbc351a060cecff3893145cf4a9a1f929b2fcd791bb4d13b44438a4f82e323f4e60a69e76825c207f2f40
-
SSDEEP
768:E1AuwHyeFo6NPIFAoslbf8eRYLGXdoIFbb5omuKWcbsvwnoT9D88888888888JXf:EOxyeFo6NPCAosxYyXdF5oy3VoKf
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe -
Executes dropped EXE 12 IoCs
pid Process 1776 SVCHOST.EXE 3544 SVCHOST.EXE 804 SVCHOST.EXE 876 SVCHOST.EXE 3100 SVCHOST.EXE 4948 SPOOLSV.EXE 4980 SVCHOST.EXE 4192 SVCHOST.EXE 1656 SPOOLSV.EXE 3084 SPOOLSV.EXE 1460 SVCHOST.EXE 1668 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened for modification F:\Recycled\desktop.ini 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\N: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\H: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\P: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\R: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\U: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\G: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\M: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\Q: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\S: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\K: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\T: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\J: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\O: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\W: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\Z: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\I: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\V: 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language userinit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 29 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\*\TileInfo = "prop:Type;Size" 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\*\QuickTip = "prop:Type;Size" 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4152 WINWORD.EXE 4152 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4948 SPOOLSV.EXE 4948 SPOOLSV.EXE 4948 SPOOLSV.EXE 4948 SPOOLSV.EXE 4948 SPOOLSV.EXE 4948 SPOOLSV.EXE 4948 SPOOLSV.EXE 4948 SPOOLSV.EXE 4948 SPOOLSV.EXE 4948 SPOOLSV.EXE 4948 SPOOLSV.EXE 4948 SPOOLSV.EXE 804 SVCHOST.EXE 804 SVCHOST.EXE 804 SVCHOST.EXE 804 SVCHOST.EXE 804 SVCHOST.EXE 804 SVCHOST.EXE 804 SVCHOST.EXE 804 SVCHOST.EXE 804 SVCHOST.EXE 804 SVCHOST.EXE 804 SVCHOST.EXE 804 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1776 SVCHOST.EXE 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 1776 SVCHOST.EXE 3544 SVCHOST.EXE 804 SVCHOST.EXE 876 SVCHOST.EXE 3100 SVCHOST.EXE 4948 SPOOLSV.EXE 4980 SVCHOST.EXE 4192 SVCHOST.EXE 1656 SPOOLSV.EXE 3084 SPOOLSV.EXE 1460 SVCHOST.EXE 1668 SPOOLSV.EXE 4152 WINWORD.EXE 4152 WINWORD.EXE 4152 WINWORD.EXE 4152 WINWORD.EXE 4152 WINWORD.EXE 4152 WINWORD.EXE 4152 WINWORD.EXE -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1000 wrote to memory of 1776 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 82 PID 1000 wrote to memory of 1776 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 82 PID 1000 wrote to memory of 1776 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 82 PID 1776 wrote to memory of 3544 1776 SVCHOST.EXE 83 PID 1776 wrote to memory of 3544 1776 SVCHOST.EXE 83 PID 1776 wrote to memory of 3544 1776 SVCHOST.EXE 83 PID 1776 wrote to memory of 804 1776 SVCHOST.EXE 84 PID 1776 wrote to memory of 804 1776 SVCHOST.EXE 84 PID 1776 wrote to memory of 804 1776 SVCHOST.EXE 84 PID 804 wrote to memory of 876 804 SVCHOST.EXE 85 PID 804 wrote to memory of 876 804 SVCHOST.EXE 85 PID 804 wrote to memory of 876 804 SVCHOST.EXE 85 PID 804 wrote to memory of 3100 804 SVCHOST.EXE 86 PID 804 wrote to memory of 3100 804 SVCHOST.EXE 86 PID 804 wrote to memory of 3100 804 SVCHOST.EXE 86 PID 804 wrote to memory of 4948 804 SVCHOST.EXE 87 PID 804 wrote to memory of 4948 804 SVCHOST.EXE 87 PID 804 wrote to memory of 4948 804 SVCHOST.EXE 87 PID 4948 wrote to memory of 4980 4948 SPOOLSV.EXE 88 PID 4948 wrote to memory of 4980 4948 SPOOLSV.EXE 88 PID 4948 wrote to memory of 4980 4948 SPOOLSV.EXE 88 PID 4948 wrote to memory of 4192 4948 SPOOLSV.EXE 89 PID 4948 wrote to memory of 4192 4948 SPOOLSV.EXE 89 PID 4948 wrote to memory of 4192 4948 SPOOLSV.EXE 89 PID 4948 wrote to memory of 1656 4948 SPOOLSV.EXE 90 PID 4948 wrote to memory of 1656 4948 SPOOLSV.EXE 90 PID 4948 wrote to memory of 1656 4948 SPOOLSV.EXE 90 PID 1776 wrote to memory of 3084 1776 SVCHOST.EXE 91 PID 1776 wrote to memory of 3084 1776 SVCHOST.EXE 91 PID 1776 wrote to memory of 3084 1776 SVCHOST.EXE 91 PID 1000 wrote to memory of 1460 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 92 PID 1000 wrote to memory of 1460 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 92 PID 1000 wrote to memory of 1460 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 92 PID 1776 wrote to memory of 1592 1776 SVCHOST.EXE 93 PID 1776 wrote to memory of 1592 1776 SVCHOST.EXE 93 PID 1776 wrote to memory of 1592 1776 SVCHOST.EXE 93 PID 1000 wrote to memory of 1668 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 94 PID 1000 wrote to memory of 1668 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 94 PID 1000 wrote to memory of 1668 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 94 PID 1592 wrote to memory of 3580 1592 userinit.exe 95 PID 1592 wrote to memory of 3580 1592 userinit.exe 95 PID 1592 wrote to memory of 3580 1592 userinit.exe 95 PID 1000 wrote to memory of 4152 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 97 PID 1000 wrote to memory of 4152 1000 0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3544
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:804 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:876
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3100
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4980
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4192
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1656
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3084
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\Explorer.exeExplorer.exe "C:\recycled\SVCHOST.exe"4⤵
- System Location Discovery: System Language Discovery
PID:3580
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1460
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1668
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0a0032a860c7ae456b91400703be4a4c_JaffaCakes118.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4152
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD58b83b62978a7c5cc4691ba617d5debf8
SHA1bea385f54d2293d6591787d30b04a7ef8061c303
SHA25633cb2faee0ae52a7ec44218880f35b916f2b67840150254d0afb4f4cae0e7388
SHA5121402588e4bc42e22cc9937eae5488d4ee392b011f81d92d93de4aae0bdf2a92fac66baf1ed17f51844c5195360f2bbbc0ae6474839535057fb3030e84ed057a4
-
Filesize
45KB
MD59358d9f02bf3af9ebf05ae922d1de328
SHA1c21e533893fd222d372f9bc73513ba18ca2c4145
SHA256b9db0b2c976a4e15dcad008f6d42da11415cfaa371476292a952f3969116c39e
SHA512a474c752e189f759ee0b01c099b4264357249d1aae6dd0a540e962e72a0065e445d284b51b7afe2b3b78f47f16668393cb74eee8d3108989f5dca4dac99d32f2
-
Filesize
65B
MD5ad0b0b4416f06af436328a3c12dc491b
SHA1743c7ad130780de78ccbf75aa6f84298720ad3fa
SHA25623521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416
SHA512884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD50a55a1a8bf1d0dab632bfda6f3473f05
SHA1e3ced1480a22052ae63e1b2d2526daa69d0b697a
SHA2565bb400faf691de70faaeb8d5d35261ed23aafcfaa6c842db7f3f79d51a8aed1a
SHA51218984f641b2845635567e4e0ee10491042035b9a647c07a463b6892f96b2367201e8afa191ed72e39be11c071a5b112f82844b059d04bb9738f96e5ce96fe9d7
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
45KB
MD5b401ddba8ea1f32869e1a8eecbc729c7
SHA1d504f00dafb67d6f3abf85e3570abc7a1ea1aae3
SHA256bed0af0d407fdf035a71b077720d570f423eb730f5863e0a62df08d7e2ab0ade
SHA5120118a6752d0c59e37fc80ff2fb9cbb14edf85b51b2671c61ee516f0a44b2e7e84a50c5911067a16b63759d39a00227242319e924b95a60b81981358ca05a8db3