Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
07/12/2024, 02:40
Static task
static1
Behavioral task
behavioral1
Sample
d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe
Resource
win7-20241023-en
General
-
Target
d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe
-
Size
145KB
-
MD5
d0458d9fbe73ca1aa592edb5efc17c7f
-
SHA1
9e141e603d8beb468d996b77a28410816b47baf8
-
SHA256
2900578658bbb8349305983ac9a5ca487a8f4f928d202a3dfc639b80c165727e
-
SHA512
a75e3959d699e98cccbced31fc039eec3499168495b697600375e392b95add27c65a0275e3925d140cf04c1b3cd167db85b996a358f6614a9e7b8c5d4f1242fc
-
SSDEEP
3072:R2+b4i7mTwrJKJsrqUDWu9CXtl/wLY9ePBmGniAOLZzhOUBL:R2Y4E8wr4ip9CXnh0cdnl1v
Malware Config
Extracted
njrat
0.7.3
Lime
127.0.0.1:1528
Client.exe
-
reg_key
Client.exe
-
splitter
AZERTY
Signatures
-
Njrat family
-
Executes dropped EXE 1 IoCs
pid Process 2844 Client.exe -
Loads dropped DLL 2 IoCs
pid Process 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 2844 Client.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2884 set thread context of 828 2884 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 28 PID 2908 set thread context of 2128 2908 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 44 PID 1408 set thread context of 3008 1408 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 54 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Kills process with taskkill 6 IoCs
pid Process 2172 TASKKILL.exe 2668 TASKKILL.exe 1548 TASKKILL.exe 2792 TASKKILL.exe 2320 TASKKILL.exe 3056 TASKKILL.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1384 schtasks.exe 1676 schtasks.exe 1920 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2884 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe Token: SeDebugPrivilege 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe Token: SeDebugPrivilege 2320 TASKKILL.exe Token: SeDebugPrivilege 2792 TASKKILL.exe Token: SeDebugPrivilege 2844 Client.exe Token: SeDebugPrivilege 2908 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe Token: SeDebugPrivilege 2128 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe Token: SeDebugPrivilege 2172 TASKKILL.exe Token: SeDebugPrivilege 3056 TASKKILL.exe Token: SeDebugPrivilege 1408 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe Token: SeDebugPrivilege 3008 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe Token: SeDebugPrivilege 1548 TASKKILL.exe Token: SeDebugPrivilege 2668 TASKKILL.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2884 wrote to memory of 828 2884 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 28 PID 2884 wrote to memory of 828 2884 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 28 PID 2884 wrote to memory of 828 2884 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 28 PID 2884 wrote to memory of 828 2884 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 28 PID 2884 wrote to memory of 828 2884 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 28 PID 2884 wrote to memory of 828 2884 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 28 PID 828 wrote to memory of 2320 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 29 PID 828 wrote to memory of 2320 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 29 PID 828 wrote to memory of 2320 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 29 PID 828 wrote to memory of 2320 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 29 PID 828 wrote to memory of 2792 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 30 PID 828 wrote to memory of 2792 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 30 PID 828 wrote to memory of 2792 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 30 PID 828 wrote to memory of 2792 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 30 PID 828 wrote to memory of 336 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 34 PID 828 wrote to memory of 336 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 34 PID 828 wrote to memory of 336 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 34 PID 828 wrote to memory of 336 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 34 PID 828 wrote to memory of 1384 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 36 PID 828 wrote to memory of 1384 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 36 PID 828 wrote to memory of 1384 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 36 PID 828 wrote to memory of 1384 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 36 PID 828 wrote to memory of 2844 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 38 PID 828 wrote to memory of 2844 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 38 PID 828 wrote to memory of 2844 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 38 PID 828 wrote to memory of 2844 828 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 38 PID 2844 wrote to memory of 1728 2844 Client.exe 39 PID 2844 wrote to memory of 1728 2844 Client.exe 39 PID 2844 wrote to memory of 1728 2844 Client.exe 39 PID 2844 wrote to memory of 1728 2844 Client.exe 39 PID 1988 wrote to memory of 2908 1988 taskeng.exe 43 PID 1988 wrote to memory of 2908 1988 taskeng.exe 43 PID 1988 wrote to memory of 2908 1988 taskeng.exe 43 PID 1988 wrote to memory of 2908 1988 taskeng.exe 43 PID 2908 wrote to memory of 2128 2908 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 44 PID 2908 wrote to memory of 2128 2908 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 44 PID 2908 wrote to memory of 2128 2908 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 44 PID 2908 wrote to memory of 2128 2908 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 44 PID 2908 wrote to memory of 2128 2908 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 44 PID 2908 wrote to memory of 2128 2908 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 44 PID 2128 wrote to memory of 3056 2128 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 45 PID 2128 wrote to memory of 3056 2128 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 45 PID 2128 wrote to memory of 3056 2128 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 45 PID 2128 wrote to memory of 3056 2128 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 45 PID 2128 wrote to memory of 2172 2128 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 46 PID 2128 wrote to memory of 2172 2128 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 46 PID 2128 wrote to memory of 2172 2128 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 46 PID 2128 wrote to memory of 2172 2128 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 46 PID 2128 wrote to memory of 2064 2128 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 49 PID 2128 wrote to memory of 2064 2128 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 49 PID 2128 wrote to memory of 2064 2128 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 49 PID 2128 wrote to memory of 2064 2128 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 49 PID 2128 wrote to memory of 1676 2128 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 51 PID 2128 wrote to memory of 1676 2128 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 51 PID 2128 wrote to memory of 1676 2128 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 51 PID 2128 wrote to memory of 1676 2128 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 51 PID 1988 wrote to memory of 1408 1988 taskeng.exe 53 PID 1988 wrote to memory of 1408 1988 taskeng.exe 53 PID 1988 wrote to memory of 1408 1988 taskeng.exe 53 PID 1988 wrote to memory of 1408 1988 taskeng.exe 53 PID 1408 wrote to memory of 3008 1408 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 54 PID 1408 wrote to memory of 3008 1408 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 54 PID 1408 wrote to memory of 3008 1408 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 54 PID 1408 wrote to memory of 3008 1408 d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2320
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
- System Location Discovery: System Language Discovery
PID:336
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe" /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1384
-
-
C:\Users\Admin\AppData\Roaming\Client.exe"C:\Users\Admin\AppData\Roaming\Client.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Roaming\Client.exeC:\Users\Admin\AppData\Roaming\Client.exe4⤵PID:1728
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {A39899D0-027D-4285-8165-087ED7F8ABBD} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2172
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F4⤵
- System Location Discovery: System Language Discovery
PID:2064
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe" /sc minute /mo 14⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1676
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3008 -
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1548
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F4⤵
- System Location Discovery: System Language Discovery
PID:2696
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\d0458d9fbe73ca1aa592edb5efc17c7f_JaffaCakes118.exe" /sc minute /mo 14⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1920
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145KB
MD5d0458d9fbe73ca1aa592edb5efc17c7f
SHA19e141e603d8beb468d996b77a28410816b47baf8
SHA2562900578658bbb8349305983ac9a5ca487a8f4f928d202a3dfc639b80c165727e
SHA512a75e3959d699e98cccbced31fc039eec3499168495b697600375e392b95add27c65a0275e3925d140cf04c1b3cd167db85b996a358f6614a9e7b8c5d4f1242fc