Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12/01/2025, 18:06
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe
-
Size
270KB
-
MD5
14ea1e956e06e6b5fa4bd1730705a79c
-
SHA1
c1502b8759d28dabe3dfd31bede88030b80ee449
-
SHA256
4ea730cddb5393d5c2d68b124548c7014c93cbafa9a0644b9390fda5f52615f0
-
SHA512
89a4f0d7aebed543ad65024b089f6696ce0ee6ac482c1dd8580b0348f4df530ff0cdc1979d4e61a4ecdaba654f97649c5d2c082619b98d88725bee94b38fe186
-
SSDEEP
6144:tjMWPd34vhpgf3462vvpu4HyAgI6f7fcw/4/qN:xD34ngA6wpXSvEw/QO
Malware Config
Extracted
cybergate
2.5
Visual Basic
127.0.0.1:81
Virtual
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
SpyNet
-
install_file
Virtual.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
Virtual
Signatures
-
Cybergate family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{B7OQ3P4W-B83O-U367-RI70-Y7K6W737FRP4} JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B7OQ3P4W-B83O-U367-RI70-Y7K6W737FRP4}\StubPath = "c:\\Virtual\\SpyNet\\Virtual.exe Restart" JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2488 set thread context of 2568 2488 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 30 -
resource yara_rule behavioral1/memory/2568-4-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral1/memory/2568-8-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral1/memory/2568-13-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral1/memory/2568-12-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral1/memory/2568-11-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral1/memory/2568-5-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral1/memory/2568-10-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral1/memory/2568-16-0x0000000024010000-0x0000000024052000-memory.dmp upx behavioral1/memory/2568-86-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral1/memory/2568-264-0x0000000000400000-0x000000000044F000-memory.dmp upx behavioral1/memory/2968-269-0x0000000024010000-0x0000000024052000-memory.dmp upx behavioral1/memory/2968-2726-0x0000000024010000-0x0000000024052000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe Token: SeDebugPrivilege 2968 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2488 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2568 2488 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 30 PID 2488 wrote to memory of 2568 2488 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 30 PID 2488 wrote to memory of 2568 2488 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 30 PID 2488 wrote to memory of 2568 2488 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 30 PID 2488 wrote to memory of 2568 2488 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 30 PID 2488 wrote to memory of 2568 2488 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 30 PID 2488 wrote to memory of 2568 2488 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 30 PID 2488 wrote to memory of 2568 2488 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 30 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31 PID 2568 wrote to memory of 2968 2568 JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe 31
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:332
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:372
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:608
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:1560
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1584
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:684
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:748
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:820
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1180
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:848
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:996
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:300
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:768
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1084
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1124
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:1312
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2652
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2680
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:480
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:488
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:380
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_14ea1e956e06e6b5fa4bd1730705a79c.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2968
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD5d4f54f96ddd1810074f413285d28c9f8
SHA16243414a5c9df4bf5a6cd4a9baeb78ba5228b8ef
SHA256d696e2f385b3ea3a15735a4602975193964a4d208776ea6a7e9c35b46e123a27
SHA512db6633cb74d59cc490d1d7325ae7354e5afb0b4a7e9caf8ffb8766e7717df7d4159a3aa1de9028e642bd83e1caf22bc0a05188887f1d27bc68322b001ce075d3
-
Filesize
15B
MD54362e21af8686f5ebba224768d292a5b
SHA1504510a4d10e230dcd1605ab3342525b38a10933
SHA256b1b2cc9a6bf77f9e56955acbbce253c70fc25b92d1e150d9928b9183b19b93b3
SHA512f2ee4b95d5c50b533de93f21f9d73a75ab8c755ab9f343b4848bd92b6827e76dc5e17fe27b0f2ad2049a1ee0fe20d0cb0398b1973277b85e84b6af004e945850