Malware Analysis Report

2024-11-16 13:12

Sample ID 240625-sdnwyszckl
Target 0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118
SHA256 469dd425f7c8429479a39aa70841e2815853e9087821a67ec4386d158f06ed0b
Tags
sality backdoor evasion persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

469dd425f7c8429479a39aa70841e2815853e9087821a67ec4386d158f06ed0b

Threat Level: Known bad

The file 0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion persistence trojan upx

Modifies visiblity of hidden/system files in Explorer

Modifies WinLogon for persistence

Sality

Windows security bypass

UAC bypass

Disables Task Manager via registry modification

Disables RegEdit via registry modification

Boot or Logon Autostart Execution: Active Setup

Deletes itself

Executes dropped EXE

UPX packed file

Windows security modification

Checks whether UAC is enabled

Adds Run key to start application

Drops file in Windows directory

Drops file in Program Files directory

Program crash

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-25 15:00

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-25 15:00

Reported

2024-06-25 15:03

Platform

win7-20231129-en

Max time kernel

120s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 148

Network

N/A

Files

memory/952-0-0x0000000000400000-0x0000000000440000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-25 15:00

Reported

2024-06-25 15:03

Platform

win10v2004-20240508-en

Max time kernel

22s

Max time network

94s

Command Line

"fontdrvhost.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\windows\system\explorer.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A

Disables Task Manager via registry modification

evasion

Deletes itself

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" \??\c:\windows\system\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\windows\system\explorer.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe \??\c:\windows\system\explorer.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4196 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4196 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 4196 wrote to memory of 60 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 4196 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 4196 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4196 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 4196 wrote to memory of 3404 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 4196 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 4196 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 4196 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4196 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4196 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4196 wrote to memory of 3808 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4196 wrote to memory of 4284 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 4196 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4196 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe \??\c:\windows\system\explorer.exe
PID 4196 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe \??\c:\windows\system\explorer.exe
PID 4196 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe \??\c:\windows\system\explorer.exe
PID 1668 wrote to memory of 3344 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 1668 wrote to memory of 3344 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 1668 wrote to memory of 3344 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 3344 wrote to memory of 3596 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 3344 wrote to memory of 3596 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 3344 wrote to memory of 3596 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 3596 wrote to memory of 1608 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 3596 wrote to memory of 1608 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 3596 wrote to memory of 1608 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 3596 wrote to memory of 4780 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 3596 wrote to memory of 4780 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 3596 wrote to memory of 4780 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 1668 wrote to memory of 792 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\fontdrvhost.exe
PID 1668 wrote to memory of 796 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\fontdrvhost.exe
PID 1668 wrote to memory of 60 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\dwm.exe
PID 1668 wrote to memory of 2684 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\sihost.exe
PID 1668 wrote to memory of 2748 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\svchost.exe
PID 1668 wrote to memory of 2944 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\taskhostw.exe
PID 1668 wrote to memory of 3404 N/A \??\c:\windows\system\explorer.exe C:\Windows\Explorer.EXE
PID 1668 wrote to memory of 3552 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\svchost.exe
PID 1668 wrote to memory of 3748 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\DllHost.exe
PID 1668 wrote to memory of 3860 N/A \??\c:\windows\system\explorer.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1668 wrote to memory of 3924 N/A \??\c:\windows\system\explorer.exe C:\Windows\System32\RuntimeBroker.exe
PID 1668 wrote to memory of 4008 N/A \??\c:\windows\system\explorer.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1668 wrote to memory of 3808 N/A \??\c:\windows\system\explorer.exe C:\Windows\System32\RuntimeBroker.exe
PID 1668 wrote to memory of 4284 N/A \??\c:\windows\system\explorer.exe C:\Windows\System32\RuntimeBroker.exe
PID 1668 wrote to memory of 4832 N/A \??\c:\windows\system\explorer.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 1668 wrote to memory of 3596 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\svchost.exe
PID 1668 wrote to memory of 3596 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\svchost.exe
PID 1668 wrote to memory of 792 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\fontdrvhost.exe
PID 1668 wrote to memory of 796 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\fontdrvhost.exe
PID 1668 wrote to memory of 60 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\dwm.exe
PID 1668 wrote to memory of 2684 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\sihost.exe
PID 1668 wrote to memory of 2748 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\svchost.exe
PID 1668 wrote to memory of 2944 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\taskhostw.exe
PID 1668 wrote to memory of 3404 N/A \??\c:\windows\system\explorer.exe C:\Windows\Explorer.EXE
PID 1668 wrote to memory of 3552 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\svchost.exe
PID 1668 wrote to memory of 3748 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\DllHost.exe
PID 1668 wrote to memory of 3860 N/A \??\c:\windows\system\explorer.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1668 wrote to memory of 3924 N/A \??\c:\windows\system\explorer.exe C:\Windows\System32\RuntimeBroker.exe
PID 1668 wrote to memory of 4008 N/A \??\c:\windows\system\explorer.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1668 wrote to memory of 3808 N/A \??\c:\windows\system\explorer.exe C:\Windows\System32\RuntimeBroker.exe
PID 1668 wrote to memory of 4284 N/A \??\c:\windows\system\explorer.exe C:\Windows\System32\RuntimeBroker.exe
PID 1668 wrote to memory of 4832 N/A \??\c:\windows\system\explorer.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\0e800efaf61919f9eedcfd6a0e3fa368_JaffaCakes118.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 15:02 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 15:03 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\SysWOW64\at.exe

at 15:04 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp

Files

memory/4196-0-0x0000000000400000-0x0000000000440000-memory.dmp

memory/4196-1-0x00000000029E0000-0x0000000003A6D000-memory.dmp

memory/4196-8-0x00000000029E0000-0x0000000003A6D000-memory.dmp

memory/4196-10-0x00000000006F0000-0x00000000006F1000-memory.dmp

memory/4196-6-0x00000000029E0000-0x0000000003A6D000-memory.dmp

memory/4196-7-0x00000000029E0000-0x0000000003A6D000-memory.dmp

memory/4196-4-0x00000000029E0000-0x0000000003A6D000-memory.dmp

\??\c:\windows\system\explorer.exe

MD5 397f6f4d6afda0acbe1340629b02801c
SHA1 9dd66a2499355e01764672b31ce66c5b01490caa
SHA256 f4cf9ea37be23d4b9ccb2ae43d0b7b511b62c78bc0adde13e780d0061f2c0447
SHA512 5bcf23bcb7275b26915dbdf53dde866d14412140b726bb9152d20b3a2c415d1402500b8371a2ee5962594fffc092e349d18807bba354a25e38504a965d1db2e4

memory/4196-9-0x00000000006E0000-0x00000000006E2000-memory.dmp

memory/4196-12-0x00000000006E0000-0x00000000006E2000-memory.dmp

memory/4196-11-0x00000000006E0000-0x00000000006E2000-memory.dmp

memory/4196-5-0x00000000029E0000-0x0000000003A6D000-memory.dmp

memory/1668-21-0x0000000000400000-0x0000000000440000-memory.dmp

C:\Windows\System\spoolsv.exe

MD5 722192572dbfea0433f61b5fb3525c4d
SHA1 897c722fb2d3c2d854d045832d13d08574bff503
SHA256 5cc9a93800f655d3ae45e33e326750a43aef36ff97b0c2fbb2bd36868b06803f
SHA512 e452bd77b385f2e16fa7bacc31504c559c8c8e11b94465dde7bd1df335666f6c0178ea1e9dd6318c845741663dff7ff2b4a51dfa8c8223558b4e6fc00d51ace2

memory/3344-30-0x0000000000400000-0x0000000000440000-memory.dmp

C:\Windows\System\svchost.exe

MD5 2d40ffe83a7f126ee5a54aa778c65c67
SHA1 470b70361473418bf75a87c116e44b0a5d58a717
SHA256 f9577002dc4ee841ff420579c5e1e91561e5fe6223577f7d73c4b4b02bf43139
SHA512 827915c954e71c32f0ea2f20ba6519b587dea02ca3bc24227b4202a67145643d4d78db247d368c9d704eb92b560ff271b31c5f3f6539012683041438d15c2cdb

memory/1608-43-0x0000000000400000-0x0000000000440000-memory.dmp

memory/1608-47-0x0000000000400000-0x0000000000440000-memory.dmp

memory/4196-59-0x0000000000400000-0x0000000000440000-memory.dmp

memory/4196-50-0x00000000006E0000-0x00000000006E2000-memory.dmp

memory/4196-55-0x00000000029E0000-0x0000000003A6D000-memory.dmp

memory/3344-54-0x0000000000400000-0x0000000000440000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 3a8a9af95e597b3f688b8c1f08fc3726
SHA1 84bfe4da23e24ecb5a600188909862a9139e99ed
SHA256 5fff67ecae50ae5d106cd3dcf94fde426cbe5aac5b393337e1726706121c869b
SHA512 6690db6b6bb88572cdd6264d78a2096dec730fb5ad012a14dfd7547353df608d5a0902b3fac481a5184545f997b408ed9085deed0e63e336fb68d6a4cff6abcd

memory/1668-66-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-63-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-67-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-64-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/3596-73-0x0000000002EC0000-0x0000000002EC2000-memory.dmp

memory/1668-72-0x00000000020D0000-0x00000000020D2000-memory.dmp

memory/1668-65-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/3596-71-0x0000000004000000-0x0000000004001000-memory.dmp

memory/1668-69-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

memory/1668-61-0x0000000003550000-0x00000000045DD000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 4ce8a2f61801d01e4f69a5be8b85fb8e
SHA1 021cef4356c6ff0553f80a7173ebc6048cfa6556
SHA256 8cdb01e04fec34253a23e6e6291ff828c8c3d05bb3267c907eeb1cca83099cee
SHA512 83284f603a9396e1bf05aaa9d1ea64c3d8067f6b77a9ada681ad5ac1e6525a47d949fdcb2b2a06ce119dbf2ad4ab61a60b112efdccaa747534b5fe797a1e60e6

memory/1668-76-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-74-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-75-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-77-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-78-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-79-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-80-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-81-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-82-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-84-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-86-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-87-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-89-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-92-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-93-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-96-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-98-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-100-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-99-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-102-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-104-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-106-0x0000000003550000-0x00000000045DD000-memory.dmp

memory/1668-108-0x0000000003550000-0x00000000045DD000-memory.dmp