Analysis
- max time kernel
136s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system - submitted
20/04/2024, 03:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe
- Size 426KB
- Sample240420-dh1c8afe9v
- SHA256 a74e26f8b9275b5600c322c2938343e68814d222693075e930bfb13c274c1990
- MD5 fbc87a888696d172237c5a0ed6e2821f
- SHA1 f7aeebd50ed8c3318d7d5d1237209cc80840256f
- SHA512 659c78d0fb7226eb408b29113f91483d1537fe0d697b6f663681492ae598d2e8506d714af281d033a2628acf45fe3439e8f2af5170da656a97ff8646f336c188
- SSDEEP 12288:DuPaisTW8lv0XBUvuqXXBGHVl1TuE27OmuBG6kgE:disTn0XBgXBG31TN27OJPkh
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe - Modifies Installed Components in the registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe - Executes dropped EXE 64 IoCs
pid Process 980 fservice.exe 4716 fservice.exe 4532 services.exe 5088 services.exe 5116 services.exe 1076 services.exe 740 services.exe 1548 services.exe 984 services.exe 808 services.exe 668 services.exe 2396 services.exe 2344 services.exe 1740 services.exe 2816 services.exe 2312 services.exe 4624 services.exe 3612 services.exe 1052 services.exe 3256 services.exe 2676 services.exe 4612 services.exe 1568 services.exe 888 services.exe 1424 services.exe 1820 services.exe 1012 services.exe 5012 services.exe 1972 services.exe 2044 services.exe 3392 services.exe 5108 services.exe 4124 services.exe 468 services.exe 2408 services.exe 3636 services.exe 2220 services.exe 220 services.exe 4744 services.exe 1716 services.exe 3960 services.exe 4364 services.exe 3744 services.exe 5112 services.exe 4588 services.exe 1740 services.exe 1976 services.exe 4024 services.exe 384 services.exe 2356 services.exe 2224 services.exe 3788 services.exe 1888 services.exe 2808 services.exe 888 services.exe 4384 services.exe 2116 services.exe 3328 services.exe 4344 services.exe 4780 services.exe 3880 services.exe 2456 services.exe 3344 services.exe 4272 services.exe -
resource yara_rule behavioral2/memory/2580-0-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/2580-1-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/2580-3-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/2580-4-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/2580-20-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4716-21-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/5088-37-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4716-41-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/5088-55-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/1076-54-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/1076-62-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/1548-63-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/808-76-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/1548-83-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/808-90-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/2396-91-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/2396-104-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/1740-105-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/1740-125-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/2312-122-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/2312-132-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/3612-139-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/3256-153-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/3612-146-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4612-167-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/3256-166-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4612-182-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/888-174-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/1820-188-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/888-195-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/5012-209-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/5012-223-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/2044-216-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/1820-202-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/5108-231-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/2044-230-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/5108-242-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/468-248-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/3636-254-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/468-253-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/220-268-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/3636-263-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/1716-273-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4364-283-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/1716-282-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/5112-293-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4364-292-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/5112-302-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/1740-303-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/1740-312-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4024-313-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4024-322-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/2356-323-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/3788-338-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/2356-337-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/220-336-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/3788-343-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/2808-344-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/2808-354-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4384-353-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/4384-363-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/3328-364-0x0000000000400000-0x00000000005FC000-memory.dmp upx behavioral2/memory/3328-373-0x0000000000400000-0x00000000005FC000-memory.dmp upx - Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe Process not Found File created C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe Process not Found File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe Process not Found File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe Process not Found File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe Process not Found File created C:\Windows\SysWOW64\fservice.exe Process not Found File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe Process not Found File opened for modification C:\Windows\SysWOW64\fservice.exe Process not Found File created C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe Process not Found File opened for modification C:\Windows\SysWOW64\fservice.exe Process not Found File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe Process not Found File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe Process not Found File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe Process not Found File opened for modification C:\Windows\SysWOW64\fservice.exe Process not Found File created C:\Windows\SysWOW64\fservice.exe services.exe File opened for modification C:\Windows\SysWOW64\fservice.exe services.exe - Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 1424 set thread context of 2580 1424 fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe 86 PID 980 set thread context of 4716 980 fservice.exe 88 PID 4532 set thread context of 5088 4532 services.exe 92 PID 5116 set thread context of 1076 5116 services.exe 94 PID 740 set thread context of 1548 740 services.exe 97 PID 984 set thread context of 808 984 services.exe 99 PID 668 set thread context of 2396 668 services.exe 103 PID 2344 set thread context of 1740 2344 services.exe 139 PID 2816 set thread context of 2312 2816 services.exe 108 PID 4624 set thread context of 3612 4624 services.exe 110 PID 1052 set thread context of 3256 1052 services.exe 112 PID 2676 set thread context of 4612 2676 services.exe 114 PID 1568 set thread context of 888 1568 services.exe 151 PID 1424 set thread context of 1820 1424 services.exe 118 PID 1012 set thread context of 5012 1012 services.exe 120 PID 1972 set thread context of 2044 1972 services.exe 122 PID 3392 set thread context of 5108 3392 services.exe 124 PID 4124 set thread context of 468 4124 services.exe 126 PID 2408 set thread context of 3636 2408 services.exe 128 PID 2220 set thread context of 220 2220 services.exe 130 PID 4744 set thread context of 1716 4744 services.exe 132 PID 3960 set thread context of 4364 3960 services.exe 134 PID 3744 set thread context of 5112 3744 services.exe 136 PID 4588 set thread context of 1740 4588 services.exe 139 PID 1976 set thread context of 4024 1976 services.exe 141 PID 384 set thread context of 2356 384 services.exe 145 PID 2224 set thread context of 3788 2224 services.exe 147 PID 1888 set thread context of 2808 1888 services.exe 150 PID 888 set thread context of 4384 888 services.exe 152 PID 2116 set thread context of 3328 2116 services.exe 155 PID 4344 set thread context of 4780 4344 services.exe 186 PID 3880 set thread context of 2456 3880 services.exe 160 PID 3344 set thread context of 4272 3344 services.exe 162 PID 1452 set thread context of 5048 1452 services.exe 164 PID 2240 set thread context of 4280 2240 services.exe 166 PID 2816 set thread context of 2756 2816 services.exe 168 PID 3008 set thread context of 1936 3008 services.exe 170 PID 1604 set thread context of 4760 1604 services.exe 172 PID 4360 set thread context of 4500 4360 services.exe 174 PID 4496 set thread context of 4776 4496 services.exe 176 PID 4332 set thread context of 4408 4332 services.exe 178 PID 2972 set thread context of 1220 2972 services.exe 180 PID 4720 set thread context of 3312 4720 services.exe 182 PID 4152 set thread context of 4600 4152 services.exe 184 PID 4780 set thread context of 2220 4780 services.exe 187 PID 220 set thread context of 3952 220 services.exe 189 PID 2892 set thread context of 1044 2892 services.exe 191 PID 3408 set thread context of 532 3408 services.exe 193 PID 4068 set thread context of 5100 4068 services.exe 195 PID 3300 set thread context of 2492 3300 services.exe 197 PID 3256 set thread context of 2876 3256 services.exe 199 PID 3496 set thread context of 2188 3496 services.exe 227 PID 784 set thread context of 2896 784 services.exe 230 PID 4048 set thread context of 2972 4048 services.exe 205 PID 5116 set thread context of 5032 5116 services.exe 207 PID 5096 set thread context of 4152 5096 services.exe 209 PID 3344 set thread context of 3544 3344 services.exe 211 PID 4460 set thread context of 2196 4460 services.exe 213 PID 436 set thread context of 1004 436 services.exe 264 PID 4736 set thread context of 3412 4736 services.exe 244 PID 4888 set thread context of 4068 4888 services.exe 220 PID 2312 set thread context of 4584 2312 services.exe 222 PID 556 set thread context of 4760 556 services.exe 250 PID 1424 set thread context of 2360 1424 services.exe 226 - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system\sservice.exe services.exe File created C:\Windows\system\sservice.exe services.exe File created C:\Windows\system\sservice.exe services.exe File opened for modification C:\Windows\system\sservice.exe services.exe File created C:\Windows\services.exe services.exe File opened for modification C:\Windows\system\sservice.exe Process not Found File opened for modification C:\Windows\system\sservice.exe Process not Found File created C:\Windows\services.exe services.exe File created C:\Windows\services.exe Process not Found File opened for modification C:\Windows\services.exe Process not Found File created C:\Windows\system\sservice.exe services.exe File created C:\Windows\system\sservice.exe services.exe File created C:\Windows\services.exe services.exe File opened for modification C:\Windows\services.exe services.exe File opened for modification C:\Windows\services.exe services.exe File opened for modification C:\Windows\services.exe Process not Found File opened for modification C:\Windows\services.exe Process not Found File created C:\Windows\services.exe services.exe File opened for modification C:\Windows\system\sservice.exe services.exe File created C:\Windows\services.exe services.exe File created C:\Windows\system\sservice.exe Process not Found File created C:\Windows\services.exe services.exe File opened for modification C:\Windows\system\sservice.exe services.exe File created C:\Windows\system\sservice.exe services.exe File opened for modification C:\Windows\services.exe Process not Found File created C:\Windows\system\sservice.exe Process not Found File created C:\Windows\system\sservice.exe services.exe File opened for modification C:\Windows\system\sservice.exe Process not Found File opened for modification C:\Windows\system\sservice.exe services.exe File opened for modification C:\Windows\system\sservice.exe services.exe File created C:\Windows\services.exe services.exe File created C:\Windows\system\sservice.exe Process not Found File opened for modification C:\Windows\system\sservice.exe Process not Found File created C:\Windows\system\sservice.exe services.exe File created C:\Windows\system\sservice.exe services.exe File created C:\Windows\services.exe services.exe File created C:\Windows\services.exe services.exe File opened for modification C:\Windows\system\sservice.exe services.exe File opened for modification C:\Windows\services.exe services.exe File opened for modification C:\Windows\system\sservice.exe services.exe File created C:\Windows\services.exe services.exe File created C:\Windows\services.exe Process not Found File created C:\Windows\system\sservice.exe services.exe File opened for modification C:\Windows\system\sservice.exe services.exe File created C:\Windows\system\sservice.exe services.exe File opened for modification C:\Windows\services.exe services.exe File created C:\Windows\services.exe services.exe File created C:\Windows\services.exe services.exe File opened for modification C:\Windows\system\sservice.exe services.exe File created C:\Windows\system\sservice.exe Process not Found File created C:\Windows\services.exe services.exe File opened for modification C:\Windows\services.exe Process not Found File created C:\Windows\services.exe Process not Found File created C:\Windows\system\sservice.exe Process not Found File opened for modification C:\Windows\services.exe services.exe File created C:\Windows\system\sservice.exe services.exe File created C:\Windows\system\sservice.exe Process not Found File created C:\Windows\services.exe Process not Found File created C:\Windows\services.exe Process not Found File created C:\Windows\services.exe Process not Found File created C:\Windows\system\sservice.exe Process not Found File created C:\Windows\system\sservice.exe services.exe File created C:\Windows\services.exe services.exe File created C:\Windows\system\sservice.exe Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1424 wrote to memory of 2580 1424 fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe 86 PID 1424 wrote to memory of 2580 1424 fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe 86 PID 1424 wrote to memory of 2580 1424 fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe 86 PID 1424 wrote to memory of 2580 1424 fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe 86 PID 1424 wrote to memory of 2580 1424 fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe 86 PID 2580 wrote to memory of 980 2580 fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe 87 PID 2580 wrote to memory of 980 2580 fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe 87 PID 2580 wrote to memory of 980 2580 fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe 87 PID 980 wrote to memory of 4716 980 fservice.exe 88 PID 980 wrote to memory of 4716 980 fservice.exe 88 PID 980 wrote to memory of 4716 980 fservice.exe 88 PID 980 wrote to memory of 4716 980 fservice.exe 88 PID 980 wrote to memory of 4716 980 fservice.exe 88 PID 2580 wrote to memory of 1108 2580 fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe 89 PID 2580 wrote to memory of 1108 2580 fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe 89 PID 2580 wrote to memory of 1108 2580 fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe 89 PID 4716 wrote to memory of 4532 4716 fservice.exe 91 PID 4716 wrote to memory of 4532 4716 fservice.exe 91 PID 4716 wrote to memory of 4532 4716 fservice.exe 91 PID 4532 wrote to memory of 5088 4532 services.exe 92 PID 4532 wrote to memory of 5088 4532 services.exe 92 PID 4532 wrote to memory of 5088 4532 services.exe 92 PID 4532 wrote to memory of 5088 4532 services.exe 92 PID 4532 wrote to memory of 5088 4532 services.exe 92 PID 5088 wrote to memory of 5116 5088 services.exe 93 PID 5088 wrote to memory of 5116 5088 services.exe 93 PID 5088 wrote to memory of 5116 5088 services.exe 93 PID 5116 wrote to memory of 1076 5116 services.exe 94 PID 5116 wrote to memory of 1076 5116 services.exe 94 PID 5116 wrote to memory of 1076 5116 services.exe 94 PID 5116 wrote to memory of 1076 5116 services.exe 94 PID 5116 wrote to memory of 1076 5116 services.exe 94 PID 1076 wrote to memory of 740 1076 services.exe 96 PID 1076 wrote to memory of 740 1076 services.exe 96 PID 1076 wrote to memory of 740 1076 services.exe 96 PID 740 wrote to memory of 1548 740 services.exe 97 PID 740 wrote to memory of 1548 740 services.exe 97 PID 740 wrote to memory of 1548 740 services.exe 97 PID 740 wrote to memory of 1548 740 services.exe 97 PID 740 wrote to memory of 1548 740 services.exe 97 PID 1548 wrote to memory of 984 1548 services.exe 98 PID 1548 wrote to memory of 984 1548 services.exe 98 PID 1548 wrote to memory of 984 1548 services.exe 98 PID 984 wrote to memory of 808 984 services.exe 99 PID 984 wrote to memory of 808 984 services.exe 99 PID 984 wrote to memory of 808 984 services.exe 99 PID 984 wrote to memory of 808 984 services.exe 99 PID 984 wrote to memory of 808 984 services.exe 99 PID 808 wrote to memory of 668 808 services.exe 101 PID 808 wrote to memory of 668 808 services.exe 101 PID 808 wrote to memory of 668 808 services.exe 101 PID 668 wrote to memory of 2396 668 services.exe 103 PID 668 wrote to memory of 2396 668 services.exe 103 PID 668 wrote to memory of 2396 668 services.exe 103 PID 668 wrote to memory of 2396 668 services.exe 103 PID 668 wrote to memory of 2396 668 services.exe 103 PID 2396 wrote to memory of 2344 2396 services.exe 104 PID 2396 wrote to memory of 2344 2396 services.exe 104 PID 2396 wrote to memory of 2344 2396 services.exe 104 PID 2344 wrote to memory of 1740 2344 services.exe 139 PID 2344 wrote to memory of 1740 2344 services.exe 139 PID 2344 wrote to memory of 1740 2344 services.exe 139 PID 2344 wrote to memory of 1740 2344 services.exe 139 PID 2344 wrote to memory of 1740 2344 services.exe 139
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\fbc87a888696d172237c5a0ed6e2821f_JaffaCakes118.exe2⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Modifies WinLogon
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\fservice.exeC:\Windows\system32\fservice.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\fservice.exeC:\Windows\SysWOW64\fservice.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\services.exeC:\Windows\services.exe -XP5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\services.exeC:\Windows\services.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\services.exeC:\Windows\services.exe -XP7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\services.exeC:\Windows\services.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\services.exeC:\Windows\services.exe -XP9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\services.exeC:\Windows\services.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\services.exeC:\Windows\services.exe -XP11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\services.exeC:\Windows\services.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\services.exeC:\Windows\services.exe -XP13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\services.exeC:\Windows\services.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\services.exeC:\Windows\services.exe -XP15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\services.exeC:\Windows\services.exe16⤵
- Executes dropped EXE
PID:1740 -
C:\Windows\services.exeC:\Windows\services.exe -XP17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2816 -
C:\Windows\services.exeC:\Windows\services.exe18⤵
- Executes dropped EXE
PID:2312 -
C:\Windows\services.exeC:\Windows\services.exe -XP19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4624 -
C:\Windows\services.exeC:\Windows\services.exe20⤵
- Executes dropped EXE
PID:3612 -
C:\Windows\services.exeC:\Windows\services.exe -XP21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1052 -
C:\Windows\services.exeC:\Windows\services.exe22⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3256 -
C:\Windows\services.exeC:\Windows\services.exe -XP23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2676 -
C:\Windows\services.exeC:\Windows\services.exe24⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4612 -
C:\Windows\services.exeC:\Windows\services.exe -XP25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1568 -
C:\Windows\services.exeC:\Windows\services.exe26⤵
- Executes dropped EXE
PID:888 -
C:\Windows\services.exeC:\Windows\services.exe -XP27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1424 -
C:\Windows\services.exeC:\Windows\services.exe28⤵
- Executes dropped EXE
PID:1820 -
C:\Windows\services.exeC:\Windows\services.exe -XP29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1012 -
C:\Windows\services.exeC:\Windows\services.exe30⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5012 -
C:\Windows\services.exeC:\Windows\services.exe -XP31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1972 -
C:\Windows\services.exeC:\Windows\services.exe32⤵
- Executes dropped EXE
PID:2044 -
C:\Windows\services.exeC:\Windows\services.exe -XP33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3392 -
C:\Windows\services.exeC:\Windows\services.exe34⤵
- Executes dropped EXE
PID:5108 -
C:\Windows\services.exeC:\Windows\services.exe -XP35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4124 -
C:\Windows\services.exeC:\Windows\services.exe36⤵
- Executes dropped EXE
PID:468 -
C:\Windows\services.exeC:\Windows\services.exe -XP37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2408 -
C:\Windows\services.exeC:\Windows\services.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3636 -
C:\Windows\services.exeC:\Windows\services.exe -XP39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2220 -
C:\Windows\services.exeC:\Windows\services.exe40⤵
- Executes dropped EXE
PID:220 -
C:\Windows\services.exeC:\Windows\services.exe -XP41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4744 -
C:\Windows\services.exeC:\Windows\services.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1716 -
C:\Windows\services.exeC:\Windows\services.exe -XP43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3960 -
C:\Windows\services.exeC:\Windows\services.exe44⤵
- Executes dropped EXE
PID:4364 -
C:\Windows\services.exeC:\Windows\services.exe -XP45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3744 -
C:\Windows\services.exeC:\Windows\services.exe46⤵
- Executes dropped EXE
PID:5112 -
C:\Windows\services.exeC:\Windows\services.exe -XP47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4588 -
C:\Windows\services.exeC:\Windows\services.exe48⤵
- Executes dropped EXE
PID:1740 -
C:\Windows\services.exeC:\Windows\services.exe -XP49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1976 -
C:\Windows\services.exeC:\Windows\services.exe50⤵
- Executes dropped EXE
PID:4024 -
C:\Windows\services.exeC:\Windows\services.exe -XP51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:384 -
C:\Windows\services.exeC:\Windows\services.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2356 -
C:\Windows\services.exeC:\Windows\services.exe -XP53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2224 -
C:\Windows\services.exeC:\Windows\services.exe54⤵
- Executes dropped EXE
PID:3788 -
C:\Windows\services.exeC:\Windows\services.exe -XP55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1888 -
C:\Windows\services.exeC:\Windows\services.exe56⤵
- Executes dropped EXE
PID:2808 -
C:\Windows\services.exeC:\Windows\services.exe -XP57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:888 -
C:\Windows\services.exeC:\Windows\services.exe58⤵
- Executes dropped EXE
PID:4384 -
C:\Windows\services.exeC:\Windows\services.exe -XP59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2116 -
C:\Windows\services.exeC:\Windows\services.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3328 -
C:\Windows\services.exeC:\Windows\services.exe -XP61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4344 -
C:\Windows\services.exeC:\Windows\services.exe62⤵
- Executes dropped EXE
PID:4780 -
C:\Windows\services.exeC:\Windows\services.exe -XP63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3880 -
C:\Windows\services.exeC:\Windows\services.exe64⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\services.exeC:\Windows\services.exe -XP65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3344 -
C:\Windows\services.exeC:\Windows\services.exe66⤵
- Executes dropped EXE
PID:4272 -
C:\Windows\services.exeC:\Windows\services.exe -XP67⤵
- Suspicious use of SetThreadContext
PID:1452 -
C:\Windows\services.exeC:\Windows\services.exe68⤵
- Drops file in Windows directory
PID:5048 -
C:\Windows\services.exeC:\Windows\services.exe -XP69⤵
- Suspicious use of SetThreadContext
PID:2240 -
C:\Windows\services.exeC:\Windows\services.exe70⤵
- Drops file in System32 directory
PID:4280 -
C:\Windows\services.exeC:\Windows\services.exe -XP71⤵
- Suspicious use of SetThreadContext
PID:2816 -
C:\Windows\services.exeC:\Windows\services.exe72⤵PID:2756
-
C:\Windows\services.exeC:\Windows\services.exe -XP73⤵
- Suspicious use of SetThreadContext
PID:3008 -
C:\Windows\services.exeC:\Windows\services.exe74⤵PID:1936
-
C:\Windows\services.exeC:\Windows\services.exe -XP75⤵
- Suspicious use of SetThreadContext
PID:1604 -
C:\Windows\services.exeC:\Windows\services.exe76⤵PID:4760
-
C:\Windows\services.exeC:\Windows\services.exe -XP77⤵
- Suspicious use of SetThreadContext
PID:4360 -
C:\Windows\services.exeC:\Windows\services.exe78⤵PID:4500
-
C:\Windows\services.exeC:\Windows\services.exe -XP79⤵
- Suspicious use of SetThreadContext
PID:4496 -
C:\Windows\services.exeC:\Windows\services.exe80⤵PID:4776
-
C:\Windows\services.exeC:\Windows\services.exe -XP81⤵
- Suspicious use of SetThreadContext
PID:4332 -
C:\Windows\services.exeC:\Windows\services.exe82⤵PID:4408
-
C:\Windows\services.exeC:\Windows\services.exe -XP83⤵
- Suspicious use of SetThreadContext
PID:2972 -
C:\Windows\services.exeC:\Windows\services.exe84⤵PID:1220
-
C:\Windows\services.exeC:\Windows\services.exe -XP85⤵
- Suspicious use of SetThreadContext
PID:4720 -
C:\Windows\services.exeC:\Windows\services.exe86⤵
- Drops file in System32 directory
PID:3312 -
C:\Windows\services.exeC:\Windows\services.exe -XP87⤵
- Suspicious use of SetThreadContext
PID:4152 -
C:\Windows\services.exeC:\Windows\services.exe88⤵PID:4600
-
C:\Windows\services.exeC:\Windows\services.exe -XP89⤵
- Suspicious use of SetThreadContext
PID:4780 -
C:\Windows\services.exeC:\Windows\services.exe90⤵
- Drops file in System32 directory
PID:2220 -
C:\Windows\services.exeC:\Windows\services.exe -XP91⤵
- Suspicious use of SetThreadContext
PID:220 -
C:\Windows\services.exeC:\Windows\services.exe92⤵PID:3952
-
C:\Windows\services.exeC:\Windows\services.exe -XP93⤵
- Suspicious use of SetThreadContext
PID:2892 -
C:\Windows\services.exeC:\Windows\services.exe94⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1044 -
C:\Windows\services.exeC:\Windows\services.exe -XP95⤵
- Suspicious use of SetThreadContext
PID:3408 -
C:\Windows\services.exeC:\Windows\services.exe96⤵PID:532
-
C:\Windows\services.exeC:\Windows\services.exe -XP97⤵
- Suspicious use of SetThreadContext
PID:4068 -
C:\Windows\services.exeC:\Windows\services.exe98⤵PID:5100
-
C:\Windows\services.exeC:\Windows\services.exe -XP99⤵
- Suspicious use of SetThreadContext
PID:3300 -
C:\Windows\services.exeC:\Windows\services.exe100⤵PID:2492
-
C:\Windows\services.exeC:\Windows\services.exe -XP101⤵
- Suspicious use of SetThreadContext
PID:3256 -
C:\Windows\services.exeC:\Windows\services.exe102⤵PID:2876
-
C:\Windows\services.exeC:\Windows\services.exe -XP103⤵
- Suspicious use of SetThreadContext
PID:3496 -
C:\Windows\services.exeC:\Windows\services.exe104⤵PID:2188
-
C:\Windows\services.exeC:\Windows\services.exe -XP105⤵
- Suspicious use of SetThreadContext
PID:784 -
C:\Windows\services.exeC:\Windows\services.exe106⤵PID:2896
-
C:\Windows\services.exeC:\Windows\services.exe -XP107⤵
- Suspicious use of SetThreadContext
PID:4048 -
C:\Windows\services.exeC:\Windows\services.exe108⤵PID:2972
-
C:\Windows\services.exeC:\Windows\services.exe -XP109⤵
- Suspicious use of SetThreadContext
PID:5116 -
C:\Windows\services.exeC:\Windows\services.exe110⤵PID:5032
-
C:\Windows\services.exeC:\Windows\services.exe -XP111⤵
- Suspicious use of SetThreadContext
PID:5096 -
C:\Windows\services.exeC:\Windows\services.exe112⤵PID:4152
-
C:\Windows\services.exeC:\Windows\services.exe -XP113⤵
- Suspicious use of SetThreadContext
PID:3344 -
C:\Windows\services.exeC:\Windows\services.exe114⤵PID:3544
-
C:\Windows\services.exeC:\Windows\services.exe -XP115⤵
- Suspicious use of SetThreadContext
PID:4460 -
C:\Windows\services.exeC:\Windows\services.exe116⤵PID:2196
-
C:\Windows\services.exeC:\Windows\services.exe -XP117⤵
- Suspicious use of SetThreadContext
PID:436 -
C:\Windows\services.exeC:\Windows\services.exe118⤵PID:1004
-
C:\Windows\services.exeC:\Windows\services.exe -XP119⤵
- Suspicious use of SetThreadContext
PID:4736 -
C:\Windows\services.exeC:\Windows\services.exe120⤵
- Drops file in Windows directory
PID:3412 -
C:\Windows\services.exeC:\Windows\services.exe -XP121⤵
- Suspicious use of SetThreadContext
PID:4888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-