Analysis
-
max time kernel
100s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
14-05-2024 01:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
3d539afa84c194e6ee2743e9a1d3d63b
-
SHA1
f34fce9ffd3fbcc0301750f57829f44648d462b7
-
SHA256
df44027aba6ccfa93994b556ec0ad139e0ed41f36510fdea9c17e378f48da80f
-
SHA512
b506340f78580708b1afed9ecc24ea228044b1e3d23d9f09fb3944ec24d99d7d630e4ab62a265fac1d4b95aaf0064d0e1087a972ce9bffda7b4f31617cdc773b
-
SSDEEP
24576:xs2iC2EShf8IZkfFnnq8G1JyqTBa1Wp8JcQmao54XBddNl7kQD2arhnch6taluTC:5zm8IiZqbA/1Wv8XBV+HluTI5L
Malware Config
Signatures
-
NirSoft MailPassView 6 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/2700-6-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral1/memory/2700-7-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral1/memory/2700-8-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral1/memory/2264-13-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/2264-14-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/2264-16-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/2700-6-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView behavioral1/memory/2700-7-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView behavioral1/memory/2700-8-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView -
Nirsoft 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2700-6-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral1/memory/2700-7-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral1/memory/2700-8-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral1/memory/2264-13-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/2264-14-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/2264-16-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft -
Drops startup file 3 IoCs
Processes:
3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ParentFolderName\Filename.exe 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ParentFolderName\Filename.exe 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ParentFolderName 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\-Launcher = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ParentFolderName\\Filename.exe" 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exedescription pid Process procid_target PID 2460 set thread context of 2700 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 59 PID 2700 set thread context of 2264 2700 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 61 PID 2700 set thread context of 2160 2700 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 62 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 1484 2160 WerFault.exe 62 -
Kills process with taskkill 15 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid Process 2628 taskkill.exe 2372 taskkill.exe 1372 taskkill.exe 756 taskkill.exe 984 taskkill.exe 2612 taskkill.exe 2896 taskkill.exe 2216 taskkill.exe 2540 taskkill.exe 2376 taskkill.exe 1564 taskkill.exe 2508 taskkill.exe 2412 taskkill.exe 2396 taskkill.exe 1428 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exepid Process 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exedescription pid Process Token: SeDebugPrivilege 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe Token: SeDebugPrivilege 2528 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe Token: SeDebugPrivilege 2896 taskkill.exe Token: SeDebugPrivilege 2216 taskkill.exe Token: SeDebugPrivilege 2540 taskkill.exe Token: SeDebugPrivilege 2412 taskkill.exe Token: SeDebugPrivilege 2372 taskkill.exe Token: SeDebugPrivilege 2376 taskkill.exe Token: SeDebugPrivilege 1564 taskkill.exe Token: SeDebugPrivilege 1428 taskkill.exe Token: SeDebugPrivilege 2612 taskkill.exe Token: SeDebugPrivilege 756 taskkill.exe Token: SeDebugPrivilege 2700 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exepid Process 2700 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exedescription pid Process procid_target PID 2460 wrote to memory of 2896 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 28 PID 2460 wrote to memory of 2896 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 28 PID 2460 wrote to memory of 2896 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 28 PID 2460 wrote to memory of 2896 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 28 PID 2460 wrote to memory of 2216 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 29 PID 2460 wrote to memory of 2216 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 29 PID 2460 wrote to memory of 2216 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 29 PID 2460 wrote to memory of 2216 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 29 PID 2460 wrote to memory of 2508 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 30 PID 2460 wrote to memory of 2508 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 30 PID 2460 wrote to memory of 2508 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 30 PID 2460 wrote to memory of 2508 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 30 PID 2460 wrote to memory of 2528 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 34 PID 2460 wrote to memory of 2528 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 34 PID 2460 wrote to memory of 2528 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 34 PID 2460 wrote to memory of 2528 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 34 PID 2460 wrote to memory of 2540 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 35 PID 2460 wrote to memory of 2540 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 35 PID 2460 wrote to memory of 2540 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 35 PID 2460 wrote to memory of 2540 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 35 PID 2460 wrote to memory of 2412 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 36 PID 2460 wrote to memory of 2412 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 36 PID 2460 wrote to memory of 2412 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 36 PID 2460 wrote to memory of 2412 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 36 PID 2460 wrote to memory of 2628 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 37 PID 2460 wrote to memory of 2628 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 37 PID 2460 wrote to memory of 2628 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 37 PID 2460 wrote to memory of 2628 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 37 PID 2460 wrote to memory of 2376 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 41 PID 2460 wrote to memory of 2376 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 41 PID 2460 wrote to memory of 2376 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 41 PID 2460 wrote to memory of 2376 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 41 PID 2460 wrote to memory of 2372 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 42 PID 2460 wrote to memory of 2372 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 42 PID 2460 wrote to memory of 2372 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 42 PID 2460 wrote to memory of 2372 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 42 PID 2460 wrote to memory of 2396 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 43 PID 2460 wrote to memory of 2396 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 43 PID 2460 wrote to memory of 2396 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 43 PID 2460 wrote to memory of 2396 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 43 PID 2460 wrote to memory of 1564 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 47 PID 2460 wrote to memory of 1564 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 47 PID 2460 wrote to memory of 1564 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 47 PID 2460 wrote to memory of 1564 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 47 PID 2460 wrote to memory of 1428 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 48 PID 2460 wrote to memory of 1428 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 48 PID 2460 wrote to memory of 1428 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 48 PID 2460 wrote to memory of 1428 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 48 PID 2460 wrote to memory of 1372 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 50 PID 2460 wrote to memory of 1372 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 50 PID 2460 wrote to memory of 1372 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 50 PID 2460 wrote to memory of 1372 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 50 PID 2460 wrote to memory of 2612 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 53 PID 2460 wrote to memory of 2612 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 53 PID 2460 wrote to memory of 2612 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 53 PID 2460 wrote to memory of 2612 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 53 PID 2460 wrote to memory of 756 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 54 PID 2460 wrote to memory of 756 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 54 PID 2460 wrote to memory of 756 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 54 PID 2460 wrote to memory of 756 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 54 PID 2460 wrote to memory of 984 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 56 PID 2460 wrote to memory of 984 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 56 PID 2460 wrote to memory of 984 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 56 PID 2460 wrote to memory of 984 2460 3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe 56
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im firefox.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im2⤵
- Kills process with taskkill
PID:2508
-
-
C:\Users\Admin\AppData\Local\Temp\3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2540
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im firefox.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im2⤵
- Kills process with taskkill
PID:2628
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im firefox.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im2⤵
- Kills process with taskkill
PID:2396
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im firefox.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1428
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im2⤵
- Kills process with taskkill
PID:1372
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im firefox.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im2⤵
- Kills process with taskkill
PID:984
-
-
C:\Users\Admin\AppData\Local\Temp\3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3d539afa84c194e6ee2743e9a1d3d63b_JaffaCakes118.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2700 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
PID:2264
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵PID:2160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 364⤵
- Program crash
PID:1484
-
-
-