Malware Analysis Report

2024-09-11 12:18

Sample ID 240617-pm7hwavdjp
Target b89d7260914649679198612f3d26d027_JaffaCakes118
SHA256 78d5cc8faa953da913a73fa2da08e4c0dbc0a30e664548a30082a82c55bfdadb
Tags
upx sality backdoor evasion spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

78d5cc8faa953da913a73fa2da08e4c0dbc0a30e664548a30082a82c55bfdadb

Threat Level: Known bad

The file b89d7260914649679198612f3d26d027_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

upx sality backdoor evasion spyware stealer trojan

Modifies firewall policy service

Sality

Windows security bypass

UAC bypass

UPX packed file

Reads user/profile data of web browsers

Loads dropped DLL

ACProtect 1.3x - 1.4x DLL software

Windows security modification

Checks whether UAC is enabled

Enumerates connected drives

Drops autorun.inf file

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Modifies registry class

System policy modification

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Replication Through Removable Media
T1091
Execution
TA0002
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Defense Evasion
TA0005
Modify Registry
T1112
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Replication Through Removable Media
T1091
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-17 12:27

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 12:27

Reported

2024-06-17 12:30

Platform

win7-20240220-en

Max time kernel

127s

Max time network

120s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\MountTaiSoftware\Lodop\CAOSOFT_WEB_PRINT_lodop.ocx C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\MountTaiSoftware\Lodop\NPCAOSOFT_WEB_PRINT_lodop.dll C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\MiscStatus\ = "0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\FLAGS\ = "2" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E} C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\Version = "6.0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\HELPDIR\ = "C:\\Program Files (x86)\\MountTaiSoftware\\Lodop\\" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB} C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\0\win32\ = "C:\\Program Files (x86)\\MountTaiSoftware\\Lodop\\CAOSOFT_WEB_PRINT_lodop.ocx" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\TypeLib C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ProgID\ = "Lodop.LodopX" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb\ C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX\Clsid C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Control\ C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\InprocServer32\ = "C:\\PROGRA~2\\MOUNTT~1\\Lodop\\CAOSOF~1.OCX" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ = "LodopX Control" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX\ = "LodopX Control" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\Version = "6.0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\Version = "6.0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E} C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Version\ = "6.0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\ = "Lodop" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ = "ILodopX" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX\Clsid\ = "{2105C259-1E0C-4534-8141-A753534CB4CA}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\MiscStatus C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\MiscStatus\1\ = "205201" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\FLAGS C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA} C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\InprocServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Control C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ = "ILodopXEvents" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\MiscStatus\1 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb\0 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\Version = "6.0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ProgID C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Version C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\0\win32 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ = "ILodopXEvents" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ToolboxBitmap32 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ToolboxBitmap32\ = "C:\\Program Files (x86)\\MountTaiSoftware\\Lodop\\CAOSOFT_WEB_PRINT_lodop.ocx,0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\0 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\HELPDIR C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ = "ILodopX" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb\0\ = "Properties,0,2" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED} C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2008 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2008 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2008 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2008 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 2008 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2008 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2008 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2008 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2008 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2008 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2008 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2008 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2008 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2008 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2008 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2008 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2008 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2008 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2008 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2008 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2008 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2008 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2008 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2008 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2008 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2008 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2008 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2008 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2008 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2008 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2008 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2008 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2008 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2008 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2008 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2008 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2008 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 2008 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\taskhost.exe
PID 2008 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\Dwm.exe
PID 2008 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe"

Network

N/A

Files

memory/2008-0-0x0000000000400000-0x0000000000709000-memory.dmp

memory/2008-1-0x0000000000EF0000-0x00000000011F9000-memory.dmp

memory/2008-9-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-5-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-6-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-4-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-11-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-7-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-13-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-12-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/1100-15-0x0000000002010000-0x0000000002012000-memory.dmp

memory/2008-27-0x0000000000D90000-0x0000000000D92000-memory.dmp

memory/2008-26-0x0000000000E20000-0x0000000000E21000-memory.dmp

memory/2008-24-0x0000000000E20000-0x0000000000E21000-memory.dmp

memory/2008-23-0x0000000000D90000-0x0000000000D92000-memory.dmp

memory/2008-2-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-8-0x00000000028C0000-0x000000000394E000-memory.dmp

\Program Files (x86)\MountTaiSoftware\Lodop\CAOSOFT_WEB_PRINT_lodop.ocx

MD5 be84f2a691c4767ddacc5f37fe0e5a68
SHA1 1ae6e280cdb0ed7fe028d18ba175ac1e5062dd80
SHA256 600cf26e64b9763963cdf36daf30e84d52d5a191e6d070bcfa1e378768b73cbb
SHA512 29954bbf34693dc14228d1a95b55b8fd07e16ee397f53296ca424a8e84ea1bed61a569030acc6bf577faecd5325574c6366a5ddb558c223a8c6ea6f2dceb0d46

memory/2008-33-0x0000000074160000-0x000000007466C000-memory.dmp

\Program Files (x86)\MountTaiSoftware\Lodop\NPCAOSOFT_WEB_PRINT_lodop.dll

MD5 0b11270c32657df207a40d0ef02e07d4
SHA1 894b3a5a4edeecb6e9a7fb172570ff6c6cb63ec7
SHA256 60a5fda3a85bc29cd94b7e1df6aa613353b31187bf5a9b30363d8dc6f1dfa202
SHA512 3863c7fbc250e9754c5a053dcb0a4e37ac11dca65ba8ee25ef67b227d9df1f00eee538f524925dad286abb12a34a6d39bc1eebcff3380f56381d633693f66573

memory/2008-14-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-51-0x0000000074160000-0x000000007466C000-memory.dmp

memory/2008-50-0x00000000734E0000-0x00000000739EC000-memory.dmp

memory/2008-49-0x0000000005750000-0x0000000005857000-memory.dmp

memory/2008-48-0x0000000005750000-0x0000000005857000-memory.dmp

memory/2008-52-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-53-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-54-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-56-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-57-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-59-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-60-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-62-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-65-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-66-0x0000000000400000-0x0000000000709000-memory.dmp

memory/2008-71-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-72-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-75-0x0000000000EF0000-0x00000000011F9000-memory.dmp

memory/2008-77-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-78-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-80-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-82-0x0000000000EF0000-0x00000000011F9000-memory.dmp

memory/2008-81-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-90-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-92-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-95-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-97-0x0000000000D90000-0x0000000000D92000-memory.dmp

memory/2008-98-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-99-0x00000000028C0000-0x000000000394E000-memory.dmp

memory/2008-113-0x00000000734E0000-0x00000000739EC000-memory.dmp

memory/2008-112-0x0000000005750000-0x0000000005857000-memory.dmp

F:\bgoulr.exe

MD5 4c729db8ada6e678ff42d5cd0b1df5c6
SHA1 f18918d26065b7e0ecbd45e52162230e20d816d4
SHA256 f97a646e1fdeefde161fc3e3e680bd9a0b77cf6bc6281a28f58cae8b4b65bf5c
SHA512 991e3be12e51d8e4ac6236a1f4e99e47aaf9d5b9e683ec17b119e4ab46e27f8eacfed42329483c253c7a4a041c94283142017f8d59129a3d2df2b46ff26d60ee

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 12:27

Reported

2024-06-17 12:30

Platform

win10v2004-20240508-en

Max time kernel

123s

Max time network

150s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\MountTaiSoftware\Lodop\CAOSOFT_WEB_PRINT_lodop.ocx C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\MountTaiSoftware\Lodop\NPCAOSOFT_WEB_PRINT_lodop.dll C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe = "0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings\LOCALMACHINE_CD_UNLOCK = "0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\HELPDIR\ = "C:\\Program Files (x86)\\MountTaiSoftware\\Lodop\\" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\MiscStatus\ = "0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ToolboxBitmap32 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E} C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\MiscStatus\1 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\ = "Lodop" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\HELPDIR C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\Version = "6.0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ = "LodopX Control" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Version\ = "6.0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ = "ILodopXEvents" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\MiscStatus C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ToolboxBitmap32\ = "C:\\Program Files (x86)\\MountTaiSoftware\\Lodop\\CAOSOFT_WEB_PRINT_lodop.ocx,0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX\Clsid\ = "{2105C259-1E0C-4534-8141-A753534CB4CA}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb\0\ = "Properties,0,2" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED} C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\FLAGS C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB} C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ = "ILodopX" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\Version = "6.0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\InprocServer32\ = "C:\\PROGRA~2\\MOUNTT~1\\Lodop\\CAOSOF~1.OCX" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\0\win32\ = "C:\\Program Files (x86)\\MountTaiSoftware\\Lodop\\CAOSOFT_WEB_PRINT_lodop.ocx" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB} C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb\ C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ProgID C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\TypeLib C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Control\ C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\MiscStatus\1\ = "205201" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Control C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\FLAGS\ = "2" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\0\win32 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E} C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\InprocServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ = "ILodopXEvents" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA} C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX\ = "LodopX Control" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb\0 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\Version = "6.0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DC96C68-587A-486E-93D8-7BA1EAF5B9CB}\TypeLib\ = "{0F9014E9-F31C-408E-9CBA-C484B39066ED}" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Version C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0\0 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\ = "ILodopX" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{409D8542-9C63-4719-8DF6-ABDA44494A4E}\TypeLib\Version = "6.0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Lodop.LodopX\Clsid C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\ProgID\ = "Lodop.LodopX" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2105C259-1E0C-4534-8141-A753534CB4CA}\Verb C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F9014E9-F31C-408E-9CBA-C484B39066ED}\6.0 C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3756 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3756 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3756 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 3756 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 3756 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3756 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 3756 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3756 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3756 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3756 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3756 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3756 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3756 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3756 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3756 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 3756 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3756 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3756 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3756 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 3756 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 3756 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3756 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 3756 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3756 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3756 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3756 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3756 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3756 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3756 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3756 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3756 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 3756 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3756 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3756 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3756 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3756 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 3756 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 3756 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3756 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 3756 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3756 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3756 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3756 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3756 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3756 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3756 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3756 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3756 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 3756 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3756 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3756 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3756 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3756 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 3756 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 3756 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3756 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 3756 wrote to memory of 3488 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3756 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3756 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3756 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3756 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3756 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3756 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3756 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\b89d7260914649679198612f3d26d027_JaffaCakes118.exe"

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

Network

Files

memory/3756-0-0x0000000000400000-0x0000000000709000-memory.dmp

memory/3756-6-0x0000000000860000-0x0000000000861000-memory.dmp

memory/3756-11-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-9-0x0000000000850000-0x0000000000852000-memory.dmp

memory/3756-8-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-16-0x0000000002630000-0x00000000036BE000-memory.dmp

C:\Program Files (x86)\MountTaiSoftware\Lodop\CAOSOFT_WEB_PRINT_lodop.ocx

MD5 be84f2a691c4767ddacc5f37fe0e5a68
SHA1 1ae6e280cdb0ed7fe028d18ba175ac1e5062dd80
SHA256 600cf26e64b9763963cdf36daf30e84d52d5a191e6d070bcfa1e378768b73cbb
SHA512 29954bbf34693dc14228d1a95b55b8fd07e16ee397f53296ca424a8e84ea1bed61a569030acc6bf577faecd5325574c6366a5ddb558c223a8c6ea6f2dceb0d46

memory/3756-34-0x0000000006BD0000-0x0000000006BD1000-memory.dmp

memory/3756-33-0x0000000074390000-0x000000007489C000-memory.dmp

memory/3756-10-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-12-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-14-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-15-0x0000000000850000-0x0000000000852000-memory.dmp

memory/3756-13-0x0000000004630000-0x0000000004631000-memory.dmp

memory/3756-4-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-7-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-5-0x0000000000850000-0x0000000000852000-memory.dmp

memory/3756-1-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-35-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-36-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-37-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-38-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-39-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-41-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-42-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-43-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-45-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-46-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-48-0x0000000000400000-0x0000000000709000-memory.dmp

memory/3756-49-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-51-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-54-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-56-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-58-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-60-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-67-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-69-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-71-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-75-0x0000000074390000-0x000000007489C000-memory.dmp

memory/3756-74-0x0000000000850000-0x0000000000852000-memory.dmp

memory/3756-76-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-78-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-80-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-82-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-84-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-86-0x0000000006BD0000-0x0000000006BD1000-memory.dmp

memory/3756-87-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-89-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-91-0x0000000002630000-0x00000000036BE000-memory.dmp

memory/3756-93-0x0000000002630000-0x00000000036BE000-memory.dmp

F:\lcykbp.exe

MD5 654aa5b7d08e8e581a6c1fc386802835
SHA1 b2a613e276ed1c82684d59474db81d02552bac01
SHA256 666c1dcf809add0d3de7de6b43d48b7d49beac2ed1eab9ed9bf65778241cc39d
SHA512 54f80c1fba62d6f1cf5bed3fb68194328eae40c123884a6c65284c7a1ec67edad0098c5f9e5419bcd460cc2bcdef3d824a91e69a73eb49bee330a57ce42199f4