Malware Analysis Report

2025-08-05 20:57

Sample ID 240404-wel1jaea5t
Target bec83a08a91042c1b2821e5e017a7454_JaffaCakes118
SHA256 8c5d1e372be183f79a1e791b42c234e7abd1b4f83616803633e60a0db12366fd
Tags
evasion persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8c5d1e372be183f79a1e791b42c234e7abd1b4f83616803633e60a0db12366fd

Threat Level: Known bad

The file bec83a08a91042c1b2821e5e017a7454_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion persistence

Modifies visiblity of hidden/system files in Explorer

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-04 17:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-04 17:50

Reported

2024-04-04 17:52

Platform

win7-20240221-en

Max time kernel

150s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe"

Signatures

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\kiroq.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\kiroq.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\kiroq = "C:\\Users\\Admin\\kiroq.exe" C:\Users\Admin\kiroq.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\kiroq.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2184 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe C:\Users\Admin\kiroq.exe
PID 2184 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe C:\Users\Admin\kiroq.exe
PID 2184 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe C:\Users\Admin\kiroq.exe
PID 2184 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe C:\Users\Admin\kiroq.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2952 wrote to memory of 2184 N/A C:\Users\Admin\kiroq.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe"

C:\Users\Admin\kiroq.exe

"C:\Users\Admin\kiroq.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ns2.thepicturehut.net udp

Files

\Users\Admin\kiroq.exe

MD5 6d082ddb44121bafd70b6c4d72b46a75
SHA1 3d86bd43ad14f51f7f6989d823fe10ad39d780a3
SHA256 47e80c3c72f3ceca42bf64828f7a63a35d3192897874d2678ddff17e9f271dfc
SHA512 bd374df13964fa6f70355fa94af30097a07270f3b56e8f79e3dfa0792d1eebe693ea52d534cad8238f99b47f5f8384138cdc9da3c37f3671b9b05f602db8030d

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-04 17:50

Reported

2024-04-04 17:52

Platform

win10v2004-20240226-en

Max time kernel

152s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe"

Signatures

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\woudu.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\woudu.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\woudu = "C:\\Users\\Admin\\woudu.exe" C:\Users\Admin\woudu.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\woudu.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1668 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe C:\Users\Admin\woudu.exe
PID 1668 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe C:\Users\Admin\woudu.exe
PID 1668 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe C:\Users\Admin\woudu.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe
PID 2840 wrote to memory of 1668 N/A C:\Users\Admin\woudu.exe C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\bec83a08a91042c1b2821e5e017a7454_JaffaCakes118.exe"

C:\Users\Admin\woudu.exe

"C:\Users\Admin\woudu.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 ns1.thepicturehut.net udp
GB 23.44.234.16:80 tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 41.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 57.162.23.2.in-addr.arpa udp
US 8.8.8.8:53 227.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 175.117.168.52.in-addr.arpa udp

Files

C:\Users\Admin\woudu.exe

MD5 5d2579377d7a2259e175c9a1bda5a56e
SHA1 55f44e09257b79d5a7a3bfe8a97868b2dcf332c4
SHA256 c678c534577c83171f7ed75a3a5d431b93c93278bb563e003708e25713a65e3a
SHA512 f5dcd6351ec22b4f4171b36def1351c07436f5eb514d991615b2e97de1b6f94ec502cbaf985d00b656cab88cb3db85d04960002e38044264aef5174e32fcecff