Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/01/2025, 21:28
Behavioral task
behavioral1
Sample
JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe
-
Size
667KB
-
MD5
07a0cfc9a41125240f4ef8f14d61aeef
-
SHA1
a8b1862c246e30104700fdfd62e009e9b34b4477
-
SHA256
69a46cd3b5ba6900604533b68d74c540c8db03613948d67d76d2456013cbd826
-
SHA512
8f9960b8c7d79e18c4b6f81873f2d8cbc8bf9b7ac7c6c6dec226aba55e08a275dc65533d63cf5ae99afe644a5c0259faf221254344c322122102918c872d3977
-
SSDEEP
12288:WbMqmYEEb4E9F/ATyGv4XKGQi2lJLm1Giizl6oAlpxElrW1A:WI6EEb4Ev/ATEXKGVnGTzpA1Ec1A
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 6 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/1340-102-0x0000000000400000-0x0000000000452000-memory.dmp family_cycbot behavioral1/memory/1220-104-0x0000000000400000-0x0000000000452000-memory.dmp family_cycbot behavioral1/memory/2736-176-0x0000000000400000-0x0000000000452000-memory.dmp family_cycbot behavioral1/memory/1220-178-0x0000000000400000-0x0000000000452000-memory.dmp family_cycbot behavioral1/memory/1220-255-0x0000000000400000-0x0000000000452000-memory.dmp family_cycbot behavioral1/memory/1220-299-0x0000000000400000-0x0000000000452000-memory.dmp family_cycbot -
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" bohost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" DV245F.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lpdeof.exe -
Modiloader family
-
ModiLoader Second Stage 7 IoCs
resource yara_rule behavioral1/memory/2640-10-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral1/memory/2676-16-0x0000000000400000-0x00000000004CF000-memory.dmp modiloader_stage2 behavioral1/memory/2676-14-0x0000000000400000-0x00000000004CF000-memory.dmp modiloader_stage2 behavioral1/files/0x00070000000193c4-45.dat modiloader_stage2 behavioral1/memory/2156-67-0x0000000000400000-0x000000000041E000-memory.dmp modiloader_stage2 behavioral1/memory/2676-71-0x0000000000400000-0x00000000004CF000-memory.dmp modiloader_stage2 behavioral1/memory/2676-289-0x0000000000400000-0x00000000004CF000-memory.dmp modiloader_stage2 -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
pid Process 2372 cmd.exe -
Executes dropped EXE 8 IoCs
pid Process 2696 DV245F.exe 2532 lpdeof.exe 2156 aohost.exe 2120 aohost.exe 1220 bohost.exe 3008 dohost.exe 1340 bohost.exe 2736 bohost.exe -
Loads dropped DLL 10 IoCs
pid Process 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 2696 DV245F.exe 2696 DV245F.exe 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /s" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /o" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /x" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /H" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /V" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /J" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /Q" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /g" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /y" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /r" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /d" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /K" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /O" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /C" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /h" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /c" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /a" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /X" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /P" lpdeof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9F7.exe = "C:\\Program Files (x86)\\LP\\24F0\\9F7.exe" bohost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /b" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /l" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /E" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /U" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /Z" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /Y" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /W" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /D" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /j" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /F" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /p" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /e" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /c" DV245F.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /I" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /T" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /z" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /N" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /G" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /t" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /f" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /R" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /A" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /w" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /u" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /S" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /m" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /n" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /L" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /M" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /v" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /B" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /i" lpdeof.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lpdeof = "C:\\Users\\Admin\\lpdeof.exe /k" lpdeof.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum aohost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 aohost.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 2392 tasklist.exe 2736 tasklist.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2640 set thread context of 2676 2640 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 30 PID 2156 set thread context of 2120 2156 aohost.exe 38 -
resource yara_rule behavioral1/memory/2676-4-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/2676-13-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/2676-16-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/2676-14-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/2676-6-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/2676-2-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/2120-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2120-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2120-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2120-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2120-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2120-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-71-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/1340-102-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral1/memory/1220-104-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral1/memory/2736-176-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral1/memory/1220-178-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral1/memory/1220-255-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral1/memory/2676-289-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/1220-299-0x0000000000400000-0x0000000000452000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\24F0\9F7.exe bohost.exe File opened for modification C:\Program Files (x86)\LP\24F0\A93A.tmp bohost.exe File opened for modification C:\Program Files (x86)\LP\24F0\9F7.exe bohost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpdeof.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bohost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bohost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bohost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DV245F.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aohost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dohost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2696 DV245F.exe 2696 DV245F.exe 2532 lpdeof.exe 2532 lpdeof.exe 2120 aohost.exe 2532 lpdeof.exe 1220 bohost.exe 1220 bohost.exe 1220 bohost.exe 1220 bohost.exe 1220 bohost.exe 1220 bohost.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 2532 lpdeof.exe 1220 bohost.exe 1220 bohost.exe 1220 bohost.exe 1220 bohost.exe 1220 bohost.exe 1220 bohost.exe 1220 bohost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2008 explorer.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 2392 tasklist.exe Token: SeRestorePrivilege 1536 msiexec.exe Token: SeTakeOwnershipPrivilege 1536 msiexec.exe Token: SeSecurityPrivilege 1536 msiexec.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeDebugPrivilege 2736 tasklist.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 2696 DV245F.exe 2532 lpdeof.exe 3008 dohost.exe -
Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 2640 wrote to memory of 2676 2640 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 30 PID 2640 wrote to memory of 2676 2640 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 30 PID 2640 wrote to memory of 2676 2640 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 30 PID 2640 wrote to memory of 2676 2640 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 30 PID 2640 wrote to memory of 2676 2640 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 30 PID 2640 wrote to memory of 2676 2640 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 30 PID 2640 wrote to memory of 2676 2640 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 30 PID 2640 wrote to memory of 2676 2640 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 30 PID 2676 wrote to memory of 2696 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 31 PID 2676 wrote to memory of 2696 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 31 PID 2676 wrote to memory of 2696 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 31 PID 2676 wrote to memory of 2696 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 31 PID 2696 wrote to memory of 2532 2696 DV245F.exe 32 PID 2696 wrote to memory of 2532 2696 DV245F.exe 32 PID 2696 wrote to memory of 2532 2696 DV245F.exe 32 PID 2696 wrote to memory of 2532 2696 DV245F.exe 32 PID 2696 wrote to memory of 2976 2696 DV245F.exe 33 PID 2696 wrote to memory of 2976 2696 DV245F.exe 33 PID 2696 wrote to memory of 2976 2696 DV245F.exe 33 PID 2696 wrote to memory of 2976 2696 DV245F.exe 33 PID 2976 wrote to memory of 2392 2976 cmd.exe 35 PID 2976 wrote to memory of 2392 2976 cmd.exe 35 PID 2976 wrote to memory of 2392 2976 cmd.exe 35 PID 2976 wrote to memory of 2392 2976 cmd.exe 35 PID 2676 wrote to memory of 2156 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 37 PID 2676 wrote to memory of 2156 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 37 PID 2676 wrote to memory of 2156 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 37 PID 2676 wrote to memory of 2156 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 37 PID 2156 wrote to memory of 2120 2156 aohost.exe 38 PID 2156 wrote to memory of 2120 2156 aohost.exe 38 PID 2156 wrote to memory of 2120 2156 aohost.exe 38 PID 2156 wrote to memory of 2120 2156 aohost.exe 38 PID 2156 wrote to memory of 2120 2156 aohost.exe 38 PID 2156 wrote to memory of 2120 2156 aohost.exe 38 PID 2156 wrote to memory of 2120 2156 aohost.exe 38 PID 2156 wrote to memory of 2120 2156 aohost.exe 38 PID 2676 wrote to memory of 1220 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 39 PID 2676 wrote to memory of 1220 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 39 PID 2676 wrote to memory of 1220 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 39 PID 2676 wrote to memory of 1220 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 39 PID 2676 wrote to memory of 3008 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 41 PID 2676 wrote to memory of 3008 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 41 PID 2676 wrote to memory of 3008 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 41 PID 2676 wrote to memory of 3008 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 41 PID 1220 wrote to memory of 1340 1220 bohost.exe 42 PID 1220 wrote to memory of 1340 1220 bohost.exe 42 PID 1220 wrote to memory of 1340 1220 bohost.exe 42 PID 1220 wrote to memory of 1340 1220 bohost.exe 42 PID 1220 wrote to memory of 2736 1220 bohost.exe 44 PID 1220 wrote to memory of 2736 1220 bohost.exe 44 PID 1220 wrote to memory of 2736 1220 bohost.exe 44 PID 1220 wrote to memory of 2736 1220 bohost.exe 44 PID 2676 wrote to memory of 2372 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 47 PID 2676 wrote to memory of 2372 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 47 PID 2676 wrote to memory of 2372 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 47 PID 2676 wrote to memory of 2372 2676 JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe 47 PID 2372 wrote to memory of 2736 2372 cmd.exe 49 PID 2372 wrote to memory of 2736 2372 cmd.exe 49 PID 2372 wrote to memory of 2736 2372 cmd.exe 49 PID 2372 wrote to memory of 2736 2372 cmd.exe 49 PID 2532 wrote to memory of 2736 2532 lpdeof.exe 49 PID 2532 wrote to memory of 2736 2532 lpdeof.exe 49 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer bohost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" bohost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exeJaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\DV245F.exeC:\Users\Admin\DV245F.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\lpdeof.exe"C:\Users\Admin\lpdeof.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del DV245F.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
-
-
-
C:\Users\Admin\aohost.exeC:\Users\Admin\aohost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\aohost.exeaohost.exe4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2120
-
-
-
C:\Users\Admin\bohost.exeC:\Users\Admin\bohost.exe3⤵
- Modifies security service
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1220 -
C:\Users\Admin\bohost.exeC:\Users\Admin\bohost.exe startC:\Users\Admin\AppData\Roaming\00E39\93024.exe%C:\Users\Admin\AppData\Roaming\00E394⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1340
-
-
C:\Users\Admin\bohost.exeC:\Users\Admin\bohost.exe startC:\Program Files (x86)\39FDC\lvvm.exe%C:\Program Files (x86)\39FDC4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2736
-
-
-
C:\Users\Admin\dohost.exeC:\Users\Admin\dohost.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3008
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_07a0cfc9a41125240f4ef8f14d61aeef.exe3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2008
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
600B
MD5daad00d0811a7ea4395aaa3509bad4a3
SHA17cfbe83c49a4331648c3687dac2e018b16d1b0e4
SHA256ac05f1b52b1fcaae6a5d09a498d19469cacf341a0ce3a9deef8eedaa4cfad6ed
SHA512bdf424ad7f112bd0c4ea4216f6a29035be452437cb4b8552212386d7da400d28d9d66cb01fc66d069fe3906c2fa6a5f82a46e5e48235b53bdfdddc39bb2e087e
-
Filesize
996B
MD5f63edf547ee1ce14f1231a66090d3038
SHA10fefefc7eca4034064c9998eb40f53cadf836f6a
SHA256ebe2f936d3902052a8515f08aef20688df0b226bc26f5de645fb261329c332c2
SHA512957086d656e05587fda2ec4a9fe518d558bd923dc38d3856a2e41e3000e2278ec747d6303ad0d724eb05528d2717e73135de08fb914c9506d9045ecc11e9b7d6
-
Filesize
1KB
MD5ebd64c6fce1e7a18a881dad3591b3e7d
SHA1046b2b8682b08b2df52c5440cdf5b4ddb52c41e2
SHA256ef83d5f5b3f8633ff795df0725049c2e9cb304421c4417bd6762e03e5f527276
SHA512335a7750462a32d28127b160e18a40341ff37fd98ee1793c5da65fd93a5df7a1635eb3605f4e602035df113a776e5badfee0e78a472a76aba124a161c72078c5
-
Filesize
216KB
MD500b1af88e176b5fdb1b82a38cfdce35b
SHA1c0f77262df92698911e0ac2f7774e93fc6b06280
SHA25650f026d57fea9c00d49629484442ea59cccc0053d7db73168d68544a3bbf6f59
SHA5129e55e7c440af901f9c6d0cdae619f6e964b9b75c9351c76ea64362ff161c150b12a1caabb3d2eb63353a59ae70e7159ca6b3793ed0cc11994766846ac316107f
-
Filesize
152KB
MD54401958b004eb197d4f0c0aaccee9a18
SHA150e600f7c5c918145c5a270b472b114faa72a971
SHA2564c477ed134bc76fa7b912f1aad5e59d4f56f993baa16646e25fec2fdeed3bd8b
SHA512f0548bdaafce2cde2f9d3bd1c26ed3c8e9321ef6d706bd372e18886d834828e5bb54ae44f19764e94574ceb4a1a2a99bdd8476e174b05114fcac9a6d4a2d58e6
-
Filesize
173KB
MD50578a41258df62b7b4320ceaafedde53
SHA150e7c0b00f8f1e5355423893f10ae8ee844d70f4
SHA25618941e3030ef70437a5330e4689ec262f887f6f6f1da1cd66c0cbae2a76e75bf
SHA5125870a73798bad1f92b4d79f20bf618112ec8917574f6b25ab968c47afff419a829eef57b0282fb4c53e6e636436c8cf52a01426c46bdd4a0ea948d371f0feb09
-
Filesize
24KB
MD5d7390e209a42ea46d9cbfc5177b8324e
SHA1eff57330de49be19d2514dd08e614afc97b061d2
SHA256d2d49c37bdf2313756897245c3050494b39e824af448450eca1c0e83cf95b1e5
SHA512de0eb11dd20cd9d74f47b138fb4189a299a57173fe2635150045b01629354f35b26e0575acd25501403af0db238a123b2e5a79582b47aee1d6e786f5eec1929d
-
Filesize
216KB
MD504d17b3ee63c71cca27a1ec1bbe51a3c
SHA13b8ce12c24c447852cd0dd7b5c1cb382f6dafad4
SHA2568e4863247f88ed04fd68126f7b6f02839f5557f417a1438662b20d89985ff1d0
SHA512b5f8793897d023f339824e2b743400a1ff70a62947c10b351bf8f2e70cf5c77995998590ac3003b982c3da89f764f6263c63c80914f69f03a9224c6729a7c657