Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/02/2025, 07:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe
-
Size
471KB
-
MD5
0a8f3230035eb9a733d4f9e4fb494e01
-
SHA1
13cdf1d81d0b5c54e6046404eedd2980a2f969cc
-
SHA256
66807ab5bc04055670b7b63fbbd00537279e4c9e39c40406c76ce50cf9758b7f
-
SHA512
cecaddf885f55a6297e027b1efacc38284d4d23be3b190a3a093c09077ac29d45cae3dd7debe46d897f832e04165c4a3673f5fdfbadfbd100177c4943faea6b0
-
SSDEEP
12288:KlC9p23TK3F5dQhQXe+CM9M3z701ybN0uPWK:KDCF5d+QXeg9MD701EO
Malware Config
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 3 IoCs
resource yara_rule behavioral1/memory/1756-15-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral1/memory/1756-12-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades behavioral1/memory/1756-44-0x0000000000400000-0x0000000000470000-memory.dmp family_blackshades -
Modifies firewall policy service 3 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Executes dropped EXE 3 IoCs
pid Process 2788 taskhostt.exe 2944 wmpnetvk.exe 2088 wmpnetvk.exe -
Loads dropped DLL 2 IoCs
pid Process 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2788 taskhostt.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\Credentials\\wmpnetvk.exe" JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\Credentials\\wmpnetvk.exe" wmpnetvk.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2208 set thread context of 1756 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 33 PID 2944 set thread context of 2088 2944 wmpnetvk.exe 50 -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpnetvk.exe:ZONE.identifier cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpnetvk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskhostt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmpnetvk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2552 reg.exe 2824 reg.exe 2668 reg.exe 3024 reg.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpnetvk.exe:ZONE.identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2788 taskhostt.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2788 taskhostt.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2788 taskhostt.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2788 taskhostt.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2788 taskhostt.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2788 taskhostt.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2788 taskhostt.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2788 taskhostt.exe 2944 wmpnetvk.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2788 taskhostt.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2788 taskhostt.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2788 taskhostt.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2788 taskhostt.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2788 taskhostt.exe 2944 wmpnetvk.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2788 taskhostt.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2788 taskhostt.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2788 taskhostt.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2788 taskhostt.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2788 taskhostt.exe 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2944 wmpnetvk.exe 2788 taskhostt.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeDebugPrivilege 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: 1 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeCreateTokenPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeAssignPrimaryTokenPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeLockMemoryPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeIncreaseQuotaPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeMachineAccountPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeTcbPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeSecurityPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeTakeOwnershipPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeLoadDriverPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeSystemProfilePrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeSystemtimePrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeProfSingleProcessPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeIncBasePriorityPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeCreatePagefilePrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeCreatePermanentPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeBackupPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeRestorePrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeShutdownPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeDebugPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeAuditPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeSystemEnvironmentPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeChangeNotifyPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeRemoteShutdownPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeUndockPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeSyncAgentPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeEnableDelegationPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeManageVolumePrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeImpersonatePrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeCreateGlobalPrivilege 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: 31 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: 32 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: 33 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: 34 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: 35 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe Token: SeDebugPrivilege 2788 taskhostt.exe Token: SeDebugPrivilege 2944 wmpnetvk.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 2088 wmpnetvk.exe 2088 wmpnetvk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2964 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 31 PID 2208 wrote to memory of 2964 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 31 PID 2208 wrote to memory of 2964 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 31 PID 2208 wrote to memory of 2964 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 31 PID 2208 wrote to memory of 1756 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 33 PID 2208 wrote to memory of 1756 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 33 PID 2208 wrote to memory of 1756 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 33 PID 2208 wrote to memory of 1756 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 33 PID 2208 wrote to memory of 1756 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 33 PID 2208 wrote to memory of 1756 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 33 PID 2208 wrote to memory of 1756 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 33 PID 2208 wrote to memory of 1756 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 33 PID 1756 wrote to memory of 2636 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 34 PID 1756 wrote to memory of 2636 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 34 PID 1756 wrote to memory of 2636 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 34 PID 1756 wrote to memory of 2636 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 34 PID 1756 wrote to memory of 2244 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 35 PID 1756 wrote to memory of 2244 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 35 PID 1756 wrote to memory of 2244 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 35 PID 1756 wrote to memory of 2244 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 35 PID 1756 wrote to memory of 3068 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 37 PID 1756 wrote to memory of 3068 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 37 PID 1756 wrote to memory of 3068 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 37 PID 1756 wrote to memory of 3068 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 37 PID 1756 wrote to memory of 2188 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 39 PID 1756 wrote to memory of 2188 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 39 PID 1756 wrote to memory of 2188 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 39 PID 1756 wrote to memory of 2188 1756 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 39 PID 2244 wrote to memory of 3024 2244 cmd.exe 43 PID 2244 wrote to memory of 3024 2244 cmd.exe 43 PID 2244 wrote to memory of 3024 2244 cmd.exe 43 PID 2244 wrote to memory of 3024 2244 cmd.exe 43 PID 2636 wrote to memory of 2552 2636 cmd.exe 42 PID 2636 wrote to memory of 2552 2636 cmd.exe 42 PID 2636 wrote to memory of 2552 2636 cmd.exe 42 PID 2636 wrote to memory of 2552 2636 cmd.exe 42 PID 3068 wrote to memory of 2668 3068 cmd.exe 44 PID 3068 wrote to memory of 2668 3068 cmd.exe 44 PID 3068 wrote to memory of 2668 3068 cmd.exe 44 PID 3068 wrote to memory of 2668 3068 cmd.exe 44 PID 2188 wrote to memory of 2824 2188 cmd.exe 45 PID 2188 wrote to memory of 2824 2188 cmd.exe 45 PID 2188 wrote to memory of 2824 2188 cmd.exe 45 PID 2188 wrote to memory of 2824 2188 cmd.exe 45 PID 2208 wrote to memory of 2788 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 46 PID 2208 wrote to memory of 2788 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 46 PID 2208 wrote to memory of 2788 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 46 PID 2208 wrote to memory of 2788 2208 JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe 46 PID 2788 wrote to memory of 2796 2788 taskhostt.exe 47 PID 2788 wrote to memory of 2796 2788 taskhostt.exe 47 PID 2788 wrote to memory of 2796 2788 taskhostt.exe 47 PID 2788 wrote to memory of 2796 2788 taskhostt.exe 47 PID 2788 wrote to memory of 2944 2788 taskhostt.exe 49 PID 2788 wrote to memory of 2944 2788 taskhostt.exe 49 PID 2788 wrote to memory of 2944 2788 taskhostt.exe 49 PID 2788 wrote to memory of 2944 2788 taskhostt.exe 49 PID 2944 wrote to memory of 2088 2944 wmpnetvk.exe 50 PID 2944 wrote to memory of 2088 2944 wmpnetvk.exe 50 PID 2944 wrote to memory of 2088 2944 wmpnetvk.exe 50 PID 2944 wrote to memory of 2088 2944 wmpnetvk.exe 50 PID 2944 wrote to memory of 2088 2944 wmpnetvk.exe 50 PID 2944 wrote to memory of 2088 2944 wmpnetvk.exe 50 PID 2944 wrote to memory of 2088 2944 wmpnetvk.exe 50 PID 2944 wrote to memory of 2088 2944 wmpnetvk.exe 50
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\cmd.exe"cmd"2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
PID:2964
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exeJaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2552
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0a8f3230035eb9a733d4f9e4fb494e01.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3024
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2668
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2824
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\taskhostt.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\taskhostt.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\cmd.exe"cmd"3⤵
- System Location Discovery: System Language Discovery
PID:2796
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpnetvk.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpnetvk.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpnetvk.exewmpnetvk.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2088
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471KB
MD50a8f3230035eb9a733d4f9e4fb494e01
SHA113cdf1d81d0b5c54e6046404eedd2980a2f969cc
SHA25666807ab5bc04055670b7b63fbbd00537279e4c9e39c40406c76ce50cf9758b7f
SHA512cecaddf885f55a6297e027b1efacc38284d4d23be3b190a3a093c09077ac29d45cae3dd7debe46d897f832e04165c4a3673f5fdfbadfbd100177c4943faea6b0
-
Filesize
27B
MD5130a75a932a2fe57bfea6a65b88da8f6
SHA1b66d7530d150d45c0a390bb3c2cd4ca4fc404d1c
SHA256f2b79cae559d6772afc1c2ed9468988178f8b6833d5028a15dea73ce47d0196e
SHA5126cd147c6f3af95803b7b0898e97ec2ed374c1f56a487b50e3d22003a67cec26a6fa12a3920b1b5624bde156f9601469ae3c7b7354fa8cf37be76c84121767eed
-
Filesize
8KB
MD57b82b2f80d81897ef6fdfd4f3821c6e5
SHA1c5d2bf5a4134df0b7b23a134c2610bbd84b999cb
SHA25677a9dc848022de79981a1a1667e2b59658e806c6d8874c325b129a36e51e515e
SHA51281c330f841945033c0ceec57ff709be4cc6350edca1419e254ab3f4231f8991efaf227b989127d6bb746c5d961a224105f3d191a96e5711091681075e4b53ebf