Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 02:24
Static task
static1
Behavioral task
behavioral1
Sample
0d7a787355d2f1ecb90885df072efcef_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0d7a787355d2f1ecb90885df072efcef_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0d7a787355d2f1ecb90885df072efcef_JaffaCakes118.exe
-
Size
2.3MB
-
MD5
0d7a787355d2f1ecb90885df072efcef
-
SHA1
ace88584859f06e03040b4851fd7a0871f3dc5e9
-
SHA256
a92e969b52c1c84ca99a949c3f92e74a725030feec886aafc6d2e2aedc20886c
-
SHA512
395ad105056928bead911a095c150f0972f678115931539549a013cef62edeab2fd7afcad68a738fb6702034262dae56f0b9fe3e5b25bb2ab5aab12c4bfba21b
-
SSDEEP
49152:1bxLX3lOLrEABY33hIkcNSkCBK1AW9sby1RbsXWQ:JxLX//cRCBQA/X
Malware Config
Signatures
-
Executes dropped EXE 20 IoCs
pid Process 1988 OnG4aQH6sKfLgZj.exe 2924 l4pm5sQJ6E8R9Tw.exe 2632 xH6sWJ7fE8TqYwU.exe 2980 cPNyxA1uv2b3m5Q.exe 2668 YBtxP0ycSiDoFaH.exe 2604 FTXwjUCelBzN.exe 1376 lOBtxP0yc1v3n4m.exe 1600 QhTXqjUCeIrOyAu.exe 2524 rD2onF4pm5Q7E8R.exe 2988 luvS2ibF3n5Q6W7.exe 2080 fycA1ivD2n4m5Q7.exe 2152 EONtxA0uc2b3n4Q.exe 2476 dUVelIBtzNc1v2b.exe 2084 skIVrlONtPuSiDo.exe 2260 C5sQJ6dEKfZhXjC.exe 1492 lsWJ7fEL8TqY.exe 1788 WIBrzPNyx1v2b3m.exe 872 EF4amH5sW7E8R.exe 1592 LA1uvD2ob4m5Q6.exe 2704 vWK7fEL9gZjCkVl.exe -
Loads dropped DLL 40 IoCs
pid Process 2264 0d7a787355d2f1ecb90885df072efcef_JaffaCakes118.exe 2264 0d7a787355d2f1ecb90885df072efcef_JaffaCakes118.exe 1988 OnG4aQH6sKfLgZj.exe 1988 OnG4aQH6sKfLgZj.exe 2924 l4pm5sQJ6E8R9Tw.exe 2924 l4pm5sQJ6E8R9Tw.exe 2632 xH6sWJ7fE8TqYwU.exe 2632 xH6sWJ7fE8TqYwU.exe 2980 cPNyxA1uv2b3m5Q.exe 2980 cPNyxA1uv2b3m5Q.exe 2668 YBtxP0ycSiDoFaH.exe 2668 YBtxP0ycSiDoFaH.exe 2604 FTXwjUCelBzN.exe 2604 FTXwjUCelBzN.exe 1376 lOBtxP0yc1v3n4m.exe 1376 lOBtxP0yc1v3n4m.exe 1600 QhTXqjUCeIrOyAu.exe 1600 QhTXqjUCeIrOyAu.exe 2524 rD2onF4pm5Q7E8R.exe 2524 rD2onF4pm5Q7E8R.exe 2988 luvS2ibF3n5Q6W7.exe 2988 luvS2ibF3n5Q6W7.exe 2080 fycA1ivD2n4m5Q7.exe 2080 fycA1ivD2n4m5Q7.exe 2152 EONtxA0uc2b3n4Q.exe 2152 EONtxA0uc2b3n4Q.exe 2476 dUVelIBtzNc1v2b.exe 2476 dUVelIBtzNc1v2b.exe 2084 skIVrlONtPuSiDo.exe 2084 skIVrlONtPuSiDo.exe 2260 C5sQJ6dEKfZhXjC.exe 2260 C5sQJ6dEKfZhXjC.exe 1492 lsWJ7fEL8TqY.exe 1492 lsWJ7fEL8TqY.exe 1788 WIBrzPNyx1v2b3m.exe 1788 WIBrzPNyx1v2b3m.exe 872 EF4amH5sW7E8R.exe 872 EF4amH5sW7E8R.exe 1592 LA1uvD2ob4m5Q6.exe 1592 LA1uvD2ob4m5Q6.exe -
Adds Run key to start application 2 TTPs 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ywIVrlONtPuSiDo8234A = "C:\\Windows\\system32\\OnG4aQH6sKfLgZj.exe" 0d7a787355d2f1ecb90885df072efcef_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tUCelrPNyAuSoFp8234A = "C:\\Windows\\system32\\l4pm5sQJ6E8R9Tw.exe" OnG4aQH6sKfLgZj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GRL9gTXqjCkVzNx8234A = "C:\\Windows\\system32\\luvS2ibF3n5Q6W7.exe" rD2onF4pm5Q7E8R.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PEK8fRZ9hXj8234A = "C:\\Windows\\system32\\LA1uvD2ob4m5Q6.exe" EF4amH5sW7E8R.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VwkUVrlOBx0c1v38234A = "C:\\Windows\\system32\\lsWJ7fEL8TqY.exe" C5sQJ6dEKfZhXjC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LNtxP0ucSiDoGa8234A = "C:\\Windows\\system32\\vWK7fEL9gZjCkVl.exe" LA1uvD2ob4m5Q6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JrlOBtxP0c1v3n48234A = "C:\\Windows\\system32\\xH6sWJ7fE8TqYwU.exe" l4pm5sQJ6E8R9Tw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ZTXqjUCekBzNx0v8234A = "C:\\Windows\\system32\\cPNyxA1uv2b3m5Q.exe" xH6sWJ7fE8TqYwU.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eWJ7dEL8gZhXkV8234A = "C:\\Windows\\system32\\YBtxP0ycSiDoFaH.exe" cPNyxA1uv2b3m5Q.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GhYXwjUVeItPyAu8234A = "C:\\Windows\\system32\\rD2onF4pm5Q7E8R.exe" QhTXqjUCeIrOyAu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IG4amH6sW7E8TqY8234A = "C:\\Windows\\system32\\skIVrlONtPuSiDo.exe" dUVelIBtzNc1v2b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\F5sWJ7dELgZhXkV8234A = "C:\\Windows\\system32\\lOBtxP0yc1v3n4m.exe" FTXwjUCelBzN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oF3pnG5aQ6W7R9T8234A = "C:\\Windows\\system32\\QhTXqjUCeIrOyAu.exe" lOBtxP0yc1v3n4m.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PEK8gRZ9hXjVlBz8234A = "C:\\Windows\\system32\\fycA1ivD2n4m5Q7.exe" luvS2ibF3n5Q6W7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\N6sWK7fELgZjCkV8234A = "C:\\Windows\\system32\\EONtxA0uc2b3n4Q.exe" fycA1ivD2n4m5Q7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wRL9hTXqjCkBzNx8234A = "C:\\Windows\\system32\\WIBrzPNyx1v2b3m.exe" lsWJ7fEL8TqY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lxA1uvS2oFpGaJd8234A = "C:\\Windows\\system32\\FTXwjUCelBzN.exe" YBtxP0ycSiDoFaH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kfRZ9hTXwUeIrPy8234A = "C:\\Windows\\system32\\dUVelIBtzNc1v2b.exe" EONtxA0uc2b3n4Q.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\llIBrzPNyAuSoFp8234A = "C:\\Windows\\system32\\C5sQJ6dEKfZhXjC.exe" skIVrlONtPuSiDo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FqhYXwkUV8234A = "C:\\Windows\\system32\\EF4amH5sW7E8R.exe" WIBrzPNyx1v2b3m.exe -
Drops file in System32 directory 20 IoCs
description ioc Process File created C:\Windows\SysWOW64\fycA1ivD2n4m5Q7.exe luvS2ibF3n5Q6W7.exe File created C:\Windows\SysWOW64\EONtxA0uc2b3n4Q.exe fycA1ivD2n4m5Q7.exe File created C:\Windows\SysWOW64\dUVelIBtzNc1v2b.exe EONtxA0uc2b3n4Q.exe File created C:\Windows\SysWOW64\C5sQJ6dEKfZhXjC.exe skIVrlONtPuSiDo.exe File created C:\Windows\SysWOW64\lsWJ7fEL8TqY.exe C5sQJ6dEKfZhXjC.exe File created C:\Windows\SysWOW64\vWK7fEL9gZjCkVl.exe LA1uvD2ob4m5Q6.exe File created C:\Windows\SysWOW64\OnG4aQH6sKfLgZj.exe 0d7a787355d2f1ecb90885df072efcef_JaffaCakes118.exe File created C:\Windows\SysWOW64\luvS2ibF3n5Q6W7.exe rD2onF4pm5Q7E8R.exe File created C:\Windows\SysWOW64\WIBrzPNyx1v2b3m.exe lsWJ7fEL8TqY.exe File created C:\Windows\SysWOW64\l4pm5sQJ6E8R9Tw.exe OnG4aQH6sKfLgZj.exe File created C:\Windows\SysWOW64\rD2onF4pm5Q7E8R.exe QhTXqjUCeIrOyAu.exe File created C:\Windows\SysWOW64\LA1uvD2ob4m5Q6.exe EF4amH5sW7E8R.exe File created C:\Windows\SysWOW64\cPNyxA1uv2b3m5Q.exe xH6sWJ7fE8TqYwU.exe File created C:\Windows\SysWOW64\YBtxP0ycSiDoFaH.exe cPNyxA1uv2b3m5Q.exe File created C:\Windows\SysWOW64\FTXwjUCelBzN.exe YBtxP0ycSiDoFaH.exe File created C:\Windows\SysWOW64\lOBtxP0yc1v3n4m.exe FTXwjUCelBzN.exe File created C:\Windows\SysWOW64\QhTXqjUCeIrOyAu.exe lOBtxP0yc1v3n4m.exe File created C:\Windows\SysWOW64\skIVrlONtPuSiDo.exe dUVelIBtzNc1v2b.exe File created C:\Windows\SysWOW64\EF4amH5sW7E8R.exe WIBrzPNyx1v2b3m.exe File created C:\Windows\SysWOW64\xH6sWJ7fE8TqYwU.exe l4pm5sQJ6E8R9Tw.exe -
resource yara_rule behavioral1/memory/2264-2-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/2264-12-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/1988-15-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/1988-26-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/2924-36-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/2632-47-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/2980-58-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/2668-69-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/2604-80-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/1376-91-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/1600-102-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/2524-113-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/2988-124-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/2080-135-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/2152-147-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/2476-157-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/2084-168-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/2260-179-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/1492-188-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/1788-195-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/872-202-0x0000000000400000-0x0000000000CB2000-memory.dmp upx behavioral1/memory/1592-209-0x0000000000400000-0x0000000000CB2000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBtxP0ycSiDoFaH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skIVrlONtPuSiDo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5sQJ6dEKfZhXjC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF4amH5sW7E8R.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0d7a787355d2f1ecb90885df072efcef_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OnG4aQH6sKfLgZj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cPNyxA1uv2b3m5Q.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QhTXqjUCeIrOyAu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dUVelIBtzNc1v2b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language l4pm5sQJ6E8R9Tw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lOBtxP0yc1v3n4m.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rD2onF4pm5Q7E8R.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language luvS2ibF3n5Q6W7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fycA1ivD2n4m5Q7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LA1uvD2ob4m5Q6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vWK7fEL9gZjCkVl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xH6sWJ7fE8TqYwU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTXwjUCelBzN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EONtxA0uc2b3n4Q.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsWJ7fEL8TqY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WIBrzPNyx1v2b3m.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 2264 0d7a787355d2f1ecb90885df072efcef_JaffaCakes118.exe 1988 OnG4aQH6sKfLgZj.exe 2924 l4pm5sQJ6E8R9Tw.exe 2632 xH6sWJ7fE8TqYwU.exe 2980 cPNyxA1uv2b3m5Q.exe 2668 YBtxP0ycSiDoFaH.exe 2604 FTXwjUCelBzN.exe 1376 lOBtxP0yc1v3n4m.exe 1600 QhTXqjUCeIrOyAu.exe 2524 rD2onF4pm5Q7E8R.exe 2988 luvS2ibF3n5Q6W7.exe 2080 fycA1ivD2n4m5Q7.exe 2152 EONtxA0uc2b3n4Q.exe 2476 dUVelIBtzNc1v2b.exe 2084 skIVrlONtPuSiDo.exe 2260 C5sQJ6dEKfZhXjC.exe 1492 lsWJ7fEL8TqY.exe 1788 WIBrzPNyx1v2b3m.exe 872 EF4amH5sW7E8R.exe 1592 LA1uvD2ob4m5Q6.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 1988 2264 0d7a787355d2f1ecb90885df072efcef_JaffaCakes118.exe 30 PID 2264 wrote to memory of 1988 2264 0d7a787355d2f1ecb90885df072efcef_JaffaCakes118.exe 30 PID 2264 wrote to memory of 1988 2264 0d7a787355d2f1ecb90885df072efcef_JaffaCakes118.exe 30 PID 2264 wrote to memory of 1988 2264 0d7a787355d2f1ecb90885df072efcef_JaffaCakes118.exe 30 PID 1988 wrote to memory of 2924 1988 OnG4aQH6sKfLgZj.exe 31 PID 1988 wrote to memory of 2924 1988 OnG4aQH6sKfLgZj.exe 31 PID 1988 wrote to memory of 2924 1988 OnG4aQH6sKfLgZj.exe 31 PID 1988 wrote to memory of 2924 1988 OnG4aQH6sKfLgZj.exe 31 PID 2924 wrote to memory of 2632 2924 l4pm5sQJ6E8R9Tw.exe 32 PID 2924 wrote to memory of 2632 2924 l4pm5sQJ6E8R9Tw.exe 32 PID 2924 wrote to memory of 2632 2924 l4pm5sQJ6E8R9Tw.exe 32 PID 2924 wrote to memory of 2632 2924 l4pm5sQJ6E8R9Tw.exe 32 PID 2632 wrote to memory of 2980 2632 xH6sWJ7fE8TqYwU.exe 33 PID 2632 wrote to memory of 2980 2632 xH6sWJ7fE8TqYwU.exe 33 PID 2632 wrote to memory of 2980 2632 xH6sWJ7fE8TqYwU.exe 33 PID 2632 wrote to memory of 2980 2632 xH6sWJ7fE8TqYwU.exe 33 PID 2980 wrote to memory of 2668 2980 cPNyxA1uv2b3m5Q.exe 34 PID 2980 wrote to memory of 2668 2980 cPNyxA1uv2b3m5Q.exe 34 PID 2980 wrote to memory of 2668 2980 cPNyxA1uv2b3m5Q.exe 34 PID 2980 wrote to memory of 2668 2980 cPNyxA1uv2b3m5Q.exe 34 PID 2668 wrote to memory of 2604 2668 YBtxP0ycSiDoFaH.exe 35 PID 2668 wrote to memory of 2604 2668 YBtxP0ycSiDoFaH.exe 35 PID 2668 wrote to memory of 2604 2668 YBtxP0ycSiDoFaH.exe 35 PID 2668 wrote to memory of 2604 2668 YBtxP0ycSiDoFaH.exe 35 PID 2604 wrote to memory of 1376 2604 FTXwjUCelBzN.exe 36 PID 2604 wrote to memory of 1376 2604 FTXwjUCelBzN.exe 36 PID 2604 wrote to memory of 1376 2604 FTXwjUCelBzN.exe 36 PID 2604 wrote to memory of 1376 2604 FTXwjUCelBzN.exe 36 PID 1376 wrote to memory of 1600 1376 lOBtxP0yc1v3n4m.exe 37 PID 1376 wrote to memory of 1600 1376 lOBtxP0yc1v3n4m.exe 37 PID 1376 wrote to memory of 1600 1376 lOBtxP0yc1v3n4m.exe 37 PID 1376 wrote to memory of 1600 1376 lOBtxP0yc1v3n4m.exe 37 PID 1600 wrote to memory of 2524 1600 QhTXqjUCeIrOyAu.exe 38 PID 1600 wrote to memory of 2524 1600 QhTXqjUCeIrOyAu.exe 38 PID 1600 wrote to memory of 2524 1600 QhTXqjUCeIrOyAu.exe 38 PID 1600 wrote to memory of 2524 1600 QhTXqjUCeIrOyAu.exe 38 PID 2524 wrote to memory of 2988 2524 rD2onF4pm5Q7E8R.exe 39 PID 2524 wrote to memory of 2988 2524 rD2onF4pm5Q7E8R.exe 39 PID 2524 wrote to memory of 2988 2524 rD2onF4pm5Q7E8R.exe 39 PID 2524 wrote to memory of 2988 2524 rD2onF4pm5Q7E8R.exe 39 PID 2988 wrote to memory of 2080 2988 luvS2ibF3n5Q6W7.exe 41 PID 2988 wrote to memory of 2080 2988 luvS2ibF3n5Q6W7.exe 41 PID 2988 wrote to memory of 2080 2988 luvS2ibF3n5Q6W7.exe 41 PID 2988 wrote to memory of 2080 2988 luvS2ibF3n5Q6W7.exe 41 PID 2080 wrote to memory of 2152 2080 fycA1ivD2n4m5Q7.exe 42 PID 2080 wrote to memory of 2152 2080 fycA1ivD2n4m5Q7.exe 42 PID 2080 wrote to memory of 2152 2080 fycA1ivD2n4m5Q7.exe 42 PID 2080 wrote to memory of 2152 2080 fycA1ivD2n4m5Q7.exe 42 PID 2152 wrote to memory of 2476 2152 EONtxA0uc2b3n4Q.exe 43 PID 2152 wrote to memory of 2476 2152 EONtxA0uc2b3n4Q.exe 43 PID 2152 wrote to memory of 2476 2152 EONtxA0uc2b3n4Q.exe 43 PID 2152 wrote to memory of 2476 2152 EONtxA0uc2b3n4Q.exe 43 PID 2476 wrote to memory of 2084 2476 dUVelIBtzNc1v2b.exe 44 PID 2476 wrote to memory of 2084 2476 dUVelIBtzNc1v2b.exe 44 PID 2476 wrote to memory of 2084 2476 dUVelIBtzNc1v2b.exe 44 PID 2476 wrote to memory of 2084 2476 dUVelIBtzNc1v2b.exe 44 PID 2084 wrote to memory of 2260 2084 skIVrlONtPuSiDo.exe 45 PID 2084 wrote to memory of 2260 2084 skIVrlONtPuSiDo.exe 45 PID 2084 wrote to memory of 2260 2084 skIVrlONtPuSiDo.exe 45 PID 2084 wrote to memory of 2260 2084 skIVrlONtPuSiDo.exe 45 PID 2260 wrote to memory of 1492 2260 C5sQJ6dEKfZhXjC.exe 46 PID 2260 wrote to memory of 1492 2260 C5sQJ6dEKfZhXjC.exe 46 PID 2260 wrote to memory of 1492 2260 C5sQJ6dEKfZhXjC.exe 46 PID 2260 wrote to memory of 1492 2260 C5sQJ6dEKfZhXjC.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d7a787355d2f1ecb90885df072efcef_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0d7a787355d2f1ecb90885df072efcef_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\OnG4aQH6sKfLgZj.exeC:\Windows\system32\OnG4aQH6sKfLgZj.exe 5985C:\Users\Admin\AppData\Local\Temp\0d7a787355d2f1ecb90885df072efcef_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\l4pm5sQJ6E8R9Tw.exeC:\Windows\system32\l4pm5sQJ6E8R9Tw.exe 5985C:\Windows\SysWOW64\OnG4aQH6sKfLgZj.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\xH6sWJ7fE8TqYwU.exeC:\Windows\system32\xH6sWJ7fE8TqYwU.exe 5985C:\Windows\SysWOW64\l4pm5sQJ6E8R9Tw.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cPNyxA1uv2b3m5Q.exeC:\Windows\system32\cPNyxA1uv2b3m5Q.exe 5985C:\Windows\SysWOW64\xH6sWJ7fE8TqYwU.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\YBtxP0ycSiDoFaH.exeC:\Windows\system32\YBtxP0ycSiDoFaH.exe 5985C:\Windows\SysWOW64\cPNyxA1uv2b3m5Q.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\FTXwjUCelBzN.exeC:\Windows\system32\FTXwjUCelBzN.exe 5985C:\Windows\SysWOW64\YBtxP0ycSiDoFaH.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\lOBtxP0yc1v3n4m.exeC:\Windows\system32\lOBtxP0yc1v3n4m.exe 5985C:\Windows\SysWOW64\FTXwjUCelBzN.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\QhTXqjUCeIrOyAu.exeC:\Windows\system32\QhTXqjUCeIrOyAu.exe 5985C:\Windows\SysWOW64\lOBtxP0yc1v3n4m.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\rD2onF4pm5Q7E8R.exeC:\Windows\system32\rD2onF4pm5Q7E8R.exe 5985C:\Windows\SysWOW64\QhTXqjUCeIrOyAu.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\luvS2ibF3n5Q6W7.exeC:\Windows\system32\luvS2ibF3n5Q6W7.exe 5985C:\Windows\SysWOW64\rD2onF4pm5Q7E8R.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\fycA1ivD2n4m5Q7.exeC:\Windows\system32\fycA1ivD2n4m5Q7.exe 5985C:\Windows\SysWOW64\luvS2ibF3n5Q6W7.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\EONtxA0uc2b3n4Q.exeC:\Windows\system32\EONtxA0uc2b3n4Q.exe 5985C:\Windows\SysWOW64\fycA1ivD2n4m5Q7.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\dUVelIBtzNc1v2b.exeC:\Windows\system32\dUVelIBtzNc1v2b.exe 5985C:\Windows\SysWOW64\EONtxA0uc2b3n4Q.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\skIVrlONtPuSiDo.exeC:\Windows\system32\skIVrlONtPuSiDo.exe 5985C:\Windows\SysWOW64\dUVelIBtzNc1v2b.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\C5sQJ6dEKfZhXjC.exeC:\Windows\system32\C5sQJ6dEKfZhXjC.exe 5985C:\Windows\SysWOW64\skIVrlONtPuSiDo.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\lsWJ7fEL8TqY.exeC:\Windows\system32\lsWJ7fEL8TqY.exe 5985C:\Windows\SysWOW64\C5sQJ6dEKfZhXjC.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1492 -
C:\Windows\SysWOW64\WIBrzPNyx1v2b3m.exeC:\Windows\system32\WIBrzPNyx1v2b3m.exe 5985C:\Windows\SysWOW64\lsWJ7fEL8TqY.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1788 -
C:\Windows\SysWOW64\EF4amH5sW7E8R.exeC:\Windows\system32\EF4amH5sW7E8R.exe 5985C:\Windows\SysWOW64\WIBrzPNyx1v2b3m.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:872 -
C:\Windows\SysWOW64\LA1uvD2ob4m5Q6.exeC:\Windows\system32\LA1uvD2ob4m5Q6.exe 5985C:\Windows\SysWOW64\EF4amH5sW7E8R.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1592 -
C:\Windows\SysWOW64\vWK7fEL9gZjCkVl.exeC:\Windows\system32\vWK7fEL9gZjCkVl.exe 5985C:\Windows\SysWOW64\LA1uvD2ob4m5Q6.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD50d7a787355d2f1ecb90885df072efcef
SHA1ace88584859f06e03040b4851fd7a0871f3dc5e9
SHA256a92e969b52c1c84ca99a949c3f92e74a725030feec886aafc6d2e2aedc20886c
SHA512395ad105056928bead911a095c150f0972f678115931539549a013cef62edeab2fd7afcad68a738fb6702034262dae56f0b9fe3e5b25bb2ab5aab12c4bfba21b