Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/01/2025, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe
-
Size
437KB
-
MD5
02c92a0d1d31087dc181020969e5b1f3
-
SHA1
274977e3f1cebbd7b90ae450652b5cf9d22313d2
-
SHA256
110cda2677c1e22cb1d0c989f0e98b1d1e2194874356b74c5660a31a1b05448e
-
SHA512
8c2849a1029da3c4a74a83ac70aabea0c0dcf6c11e4435020c724104eb5f468b88880692b4f6f46f8064fbda6ff79a144ef22a76fd384f148df6ef9d4314e0df
-
SSDEEP
6144:o7yqzqTobmMXWkypkwlciR+9V8rh0U2MpafHvRF7A2bK3/szcBGWw/hDIcqn0:o7yMqTozXeaZw+I9y/vXAfkwoDhscR
Malware Config
Extracted
cybergate
2.5
vítima
lecoa286.no-ip.org:81
192.168.254.1:81
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
título da mensagem
-
password
abcd1234
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Cybergate family
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\server.exe" JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\server.exe" JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500} JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{08B0E5JF-4FCB-11CF-AAA5-00401C6XX500}\StubPath = "c:\\dir\\install\\install\\server.exe Restart" JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "c:\\dir\\install\\install\\server.exe" JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "c:\\dir\\install\\install\\server.exe" JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3016 set thread context of 2160 3016 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 31 -
resource yara_rule behavioral1/memory/2160-24-0x0000000024010000-0x0000000024052000-memory.dmp upx behavioral1/memory/2160-28-0x0000000024060000-0x00000000240A2000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe Token: SeDebugPrivilege 1104 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3016 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2160 3016 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 31 PID 3016 wrote to memory of 2160 3016 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 31 PID 3016 wrote to memory of 2160 3016 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 31 PID 3016 wrote to memory of 2160 3016 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 31 PID 3016 wrote to memory of 2160 3016 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 31 PID 3016 wrote to memory of 2160 3016 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 31 PID 3016 wrote to memory of 2160 3016 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 31 PID 3016 wrote to memory of 2160 3016 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 31 PID 3016 wrote to memory of 2160 3016 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 31 PID 3016 wrote to memory of 2160 3016 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 31 PID 3016 wrote to memory of 2160 3016 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 31 PID 3016 wrote to memory of 2160 3016 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 31 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32 PID 2160 wrote to memory of 2844 2160 JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe 32
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:256
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:336
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:384
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:592
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe4⤵PID:840
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵PID:1636
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:676
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:740
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:820
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵PID:1172
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:848
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵PID:584
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:972
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:276
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:328
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1064
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1108
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"3⤵PID:556
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:2544
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:2292
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:492
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:500
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:396
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_02c92a0d1d31087dc181020969e5b1f3.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1104
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8B
MD52ab128f16d93dc0625236c0e2d551f08
SHA10ada904f737ecfab54022198e46a414b7c7ec8f5
SHA256136455dea5ea1932d6ae5544c7ff740dfa57a355f2fdc222487b990438ce790e
SHA51272afe50390c514daa94d3a0226e1a7cd69832b8508d215a920e19b6ca828443a201eddf1b22d924b4156faf45cc69e7b944a078a75fb327c6dd0c8dee051740a
-
Filesize
200KB
MD508a8d98488ac6f78c6e76f21d79c0879
SHA1fdfd84a9fe6bf5657c631eaee1ad22746292f68c
SHA2562295e27e006281c5ef7ea137c0e298009295b7be6a2141945b4d73c31ad21848
SHA5124a210bb393682ccce390fc29714eeb621f62fa367c1db5f54433c9d08ef9683596bee96be1cc728cce77bb371c1f3cfa0ef5946ae8dd5eb2627e136d06a2abb9
-
Filesize
15B
MD54362e21af8686f5ebba224768d292a5b
SHA1504510a4d10e230dcd1605ab3342525b38a10933
SHA256b1b2cc9a6bf77f9e56955acbbce253c70fc25b92d1e150d9928b9183b19b93b3
SHA512f2ee4b95d5c50b533de93f21f9d73a75ab8c755ab9f343b4848bd92b6827e76dc5e17fe27b0f2ad2049a1ee0fe20d0cb0398b1973277b85e84b6af004e945850