Malware Analysis Report

2025-03-15 00:52

Sample ID 240626-18y96szekp
Target 13ad479f43406e00dd2eb7599be31527_JaffaCakes118
SHA256 0d1dc5f2f30c132fa08fb762029057458f71c115c71eae8184e45a87e2607353
Tags
defense_evasion evasion persistence upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0d1dc5f2f30c132fa08fb762029057458f71c115c71eae8184e45a87e2607353

Threat Level: Known bad

The file 13ad479f43406e00dd2eb7599be31527_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

defense_evasion evasion persistence upx

Modifies WinLogon for persistence

Modifies firewall policy service

UPX packed file

Impair Defenses: Safe Mode Boot

Checks computer location settings

Deletes itself

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Checks SCSI registry key(s)

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies registry key

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-26 22:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-26 22:19

Reported

2024-06-26 22:22

Platform

win7-20240611-en

Max time kernel

150s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\scss.exe = "C:\\Windows\\scss.exe:*:Enabled:Microsoft Windows Update Platform" C:\Windows\scss.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\svcchost.exe N/A
N/A N/A C:\Windows\exploree.exe N/A
N/A N/A C:\Windows\hsl.exe N/A
N/A N/A C:\Windows\scss.exe N/A

Impair Defenses: Safe Mode Boot

defense_evasion
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power C:\Windows\SysWOW64\REG.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc C:\Windows\SysWOW64\REG.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend C:\Windows\SysWOW64\REG.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SDKhlpUser = "C:\\Windows\\svcchost.exe" C:\Windows\svcchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\systme = "C:\\WINDOWS\\system32\\scss.exe" C:\Windows\scss.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\hsl.exe

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\REG.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\svcchost.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\svcchost.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskmgr.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\svcchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\svcchost.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\svcchost.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe N/A
N/A N/A C:\Windows\svcchost.exe N/A
N/A N/A C:\Windows\exploree.exe N/A
N/A N/A C:\Windows\scss.exe N/A
N/A N/A C:\Windows\hsl.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2736 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\svcchost.exe
PID 2736 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\svcchost.exe
PID 2736 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\svcchost.exe
PID 2736 wrote to memory of 3052 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\svcchost.exe
PID 2736 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\exploree.exe
PID 2736 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\exploree.exe
PID 2736 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\exploree.exe
PID 2736 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\exploree.exe
PID 2736 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\hsl.exe
PID 2736 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\hsl.exe
PID 2736 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\hsl.exe
PID 2736 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\hsl.exe
PID 2736 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\scss.exe
PID 2736 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\scss.exe
PID 2736 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\scss.exe
PID 2736 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\scss.exe
PID 3052 wrote to memory of 2620 N/A C:\Windows\svcchost.exe C:\Windows\SysWOW64\taskmgr.exe
PID 3052 wrote to memory of 2620 N/A C:\Windows\svcchost.exe C:\Windows\SysWOW64\taskmgr.exe
PID 3052 wrote to memory of 2620 N/A C:\Windows\svcchost.exe C:\Windows\SysWOW64\taskmgr.exe
PID 3052 wrote to memory of 2620 N/A C:\Windows\svcchost.exe C:\Windows\SysWOW64\taskmgr.exe
PID 3052 wrote to memory of 2616 N/A C:\Windows\svcchost.exe C:\Windows\SysWOW64\REG.exe
PID 3052 wrote to memory of 2616 N/A C:\Windows\svcchost.exe C:\Windows\SysWOW64\REG.exe
PID 3052 wrote to memory of 2616 N/A C:\Windows\svcchost.exe C:\Windows\SysWOW64\REG.exe
PID 3052 wrote to memory of 2616 N/A C:\Windows\svcchost.exe C:\Windows\SysWOW64\REG.exe
PID 2736 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2736 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2612 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2612 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2612 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2612 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2668 wrote to memory of 1752 N/A C:\Windows\hsl.exe C:\Windows\SysWOW64\WerFault.exe
PID 2668 wrote to memory of 1752 N/A C:\Windows\hsl.exe C:\Windows\SysWOW64\WerFault.exe
PID 2668 wrote to memory of 1752 N/A C:\Windows\hsl.exe C:\Windows\SysWOW64\WerFault.exe
PID 2668 wrote to memory of 1752 N/A C:\Windows\hsl.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe"

C:\Windows\svcchost.exe

"C:\Windows\svcchost.exe"

C:\Windows\exploree.exe

"C:\Windows\exploree.exe"

C:\Windows\hsl.exe

"C:\Windows\hsl.exe"

C:\Windows\scss.exe

"C:\Windows\scss.exe"

C:\Windows\SysWOW64\taskmgr.exe

"C:\Windows\System32\taskmgr.exe"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\154.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 1251

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 132

Network

Country Destination Domain Proto
US 8.8.8.8:53 google.com udp
GB 142.250.179.238:80 google.com tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:80 www.google.com tcp
US 8.8.8.8:53 b18c.cn udp

Files

memory/2736-0-0x0000000000400000-0x000000000047B000-memory.dmp

memory/2736-1-0x0000000017180000-0x00000000171BB000-memory.dmp

memory/2736-3-0x0000000000400000-0x000000000043B000-memory.dmp

C:\Windows\svcchost.exe

MD5 96536128805788b05b9335d674c19e1d
SHA1 a44cde59321c0f9bb07ef975efc8370c8a51e23e
SHA256 69693ac781a21bad65c7962e0afe1157c7cfcd088675a62a6afd92347178f2be
SHA512 537e856222506c1200796ce750bfd12bb9933558f1e484c1cc4f1dfc2610385cfb4d2d0f72a9f4d125d97b47060289ff480fedfe64fb6e96c9c302cdd9ab6e1f

memory/3052-13-0x0000000000400000-0x000000000044C000-memory.dmp

memory/2736-11-0x00000000021D0000-0x000000000221C000-memory.dmp

memory/2736-10-0x00000000021D0000-0x000000000221C000-memory.dmp

C:\Windows\exploree.exe

MD5 31112dedf5f25bac5aef4c8e344b48f2
SHA1 104551348e450ea824d9469afc0189a342140290
SHA256 d346171cee29cb55204afeb44284480ebcbddee8000ec944a63f2655f0dcdb65
SHA512 2ee76e84b70109906ff37cafe58c24ea0b88a2846a43290fa7ecd3abc3b754072dddea8af2b2375df10a7da4c97ceccc03d6f4fcd8243f94b7838072cf03262f

memory/3052-25-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2116-37-0x0000000013140000-0x000000001317E000-memory.dmp

memory/2116-36-0x0000000017180000-0x0000000017187000-memory.dmp

memory/2668-35-0x0000000000400000-0x000000000044B000-memory.dmp

memory/2116-44-0x00000000003B0000-0x0000000000531000-memory.dmp

memory/2116-45-0x0000000013140000-0x000000001317E000-memory.dmp

memory/2736-34-0x00000000026B0000-0x00000000026FB000-memory.dmp

C:\Windows\scss.exe

MD5 875d7d741e71b84e8d620e96b442ffc8
SHA1 34b1d6223940df1e2c47e441a84451d11c24ed6a
SHA256 9820f333dbe7cbd6ba2064999e7368efc3b4ce114925ede6d96d5fdfe3b1e909
SHA512 7b0e3264197e52ebf6b701cb051f749008bf489ff02133b38e4a71111309d1eff3084b2428cc3ec0dce6472a2d0ac4ad3e6430daf701f2777f1852c69fd72180

C:\Windows\hsl.exe

MD5 bb389d8f47db4a872087c37249b5347a
SHA1 8b6c0121e46b4af94c941d25fac2f2e7a3092b8d
SHA256 7490c42628d70c748b16387e66c33b5989c24b6531a949d5fa10d3069d90adad
SHA512 7b6c0ba266a9a611c2e713aeceb0b78a0400a405dbf48482fd0cbe00ea674591e324ffadb7900d4e9d444e81522c111e982410ebfe2f98e9eb2870df9a0f3950

memory/3052-24-0x0000000017180000-0x000000001718C000-memory.dmp

memory/3052-23-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2116-22-0x0000000000400000-0x0000000000489000-memory.dmp

memory/2736-21-0x00000000026B0000-0x0000000002739000-memory.dmp

memory/2572-51-0x0000000017180000-0x0000000017189000-memory.dmp

memory/2668-50-0x0000000000400000-0x0000000000418000-memory.dmp

memory/2572-49-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2668-48-0x0000000017180000-0x0000000017194000-memory.dmp

memory/2572-47-0x0000000000400000-0x0000000000426000-memory.dmp

memory/2736-46-0x00000000026B0000-0x00000000026D6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\154.bat

MD5 ca936c1244fd78ec8a6b5f23c92f9f1b
SHA1 644f0296439c1c175d399a32bc8929cb692579a6
SHA256 076b593a8d250953a255ef4cead2ee673b36e194ccf5e24152ce8b4c2359a925
SHA512 44f179e904cfc5d1f8293ec5fe5768a438735850bb93e9da3eb3f956eb857dd86c05b15b1aa0c968a2bf4b3b473d71aa88c92c48a9db401e0d2cb7df6fc87c35

memory/2736-60-0x0000000000400000-0x000000000043B000-memory.dmp

memory/2620-65-0x0000000003150000-0x000000000319C000-memory.dmp

memory/2620-68-0x0000000002DD0000-0x0000000002DF6000-memory.dmp

memory/2620-67-0x0000000003150000-0x000000000319B000-memory.dmp

memory/2620-66-0x0000000003150000-0x000000000319C000-memory.dmp

memory/2572-74-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3052-75-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2668-76-0x0000000000400000-0x0000000000418000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-26 22:19

Reported

2024-06-26 22:22

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

49s

Command Line

winlogon.exe

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\sdra64.exe," C:\Windows\hsl.exe N/A

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\scss.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\scss.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\scss.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\scss.exe = "C:\\Windows\\scss.exe:*:Enabled:Microsoft Windows Update Platform" C:\Windows\scss.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Windows\svcchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\svcchost.exe N/A
N/A N/A C:\Windows\hsl.exe N/A
N/A N/A C:\Windows\exploree.exe N/A
N/A N/A C:\Windows\scss.exe N/A

Impair Defenses: Safe Mode Boot

defense_evasion
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager C:\Windows\SysWOW64\REG.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc C:\Windows\SysWOW64\REG.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys C:\Windows\SysWOW64\REG.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power C:\Windows\SysWOW64\REG.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc C:\Windows\SysWOW64\REG.exe N/A
Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys C:\Windows\SysWOW64\REG.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SDKhlpUser = "C:\\Windows\\svcchost.exe" C:\Windows\svcchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\systme = "C:\\WINDOWS\\system32\\scss.exe" C:\Windows\scss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\sdra64.exe C:\Windows\hsl.exe N/A
File created C:\Windows\SysWOW64\sdra64.exe C:\Windows\hsl.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\exploree.exe

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\SysWOW64\Taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\SysWOW64\Taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\SysWOW64\Taskmgr.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\REG.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\hsl.exe N/A
N/A N/A C:\Windows\hsl.exe N/A
N/A N/A C:\Windows\hsl.exe N/A
N/A N/A C:\Windows\hsl.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\svcchost.exe N/A
N/A N/A C:\Windows\svcchost.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\svcchost.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\hsl.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\svcchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\svcchost.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\svcchost.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe N/A
N/A N/A C:\Windows\svcchost.exe N/A
N/A N/A C:\Windows\hsl.exe N/A
N/A N/A C:\Windows\exploree.exe N/A
N/A N/A C:\Windows\scss.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4884 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\svcchost.exe
PID 4884 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\svcchost.exe
PID 4884 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\svcchost.exe
PID 4884 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\exploree.exe
PID 4884 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\exploree.exe
PID 4884 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\exploree.exe
PID 4884 wrote to memory of 100 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\hsl.exe
PID 4884 wrote to memory of 100 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\hsl.exe
PID 4884 wrote to memory of 100 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\hsl.exe
PID 4884 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\scss.exe
PID 4884 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\scss.exe
PID 4884 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\scss.exe
PID 4884 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4884 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4884 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2328 wrote to memory of 4580 N/A C:\Windows\svcchost.exe C:\Windows\SysWOW64\Taskmgr.exe
PID 2328 wrote to memory of 4580 N/A C:\Windows\svcchost.exe C:\Windows\SysWOW64\Taskmgr.exe
PID 2328 wrote to memory of 4580 N/A C:\Windows\svcchost.exe C:\Windows\SysWOW64\Taskmgr.exe
PID 2328 wrote to memory of 4772 N/A C:\Windows\svcchost.exe C:\Windows\SysWOW64\REG.exe
PID 2328 wrote to memory of 4772 N/A C:\Windows\svcchost.exe C:\Windows\SysWOW64\REG.exe
PID 2328 wrote to memory of 4772 N/A C:\Windows\svcchost.exe C:\Windows\SysWOW64\REG.exe
PID 2484 wrote to memory of 1056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2484 wrote to memory of 1056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2484 wrote to memory of 1056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe
PID 100 wrote to memory of 616 N/A C:\Windows\hsl.exe C:\Windows\system32\winlogon.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\13ad479f43406e00dd2eb7599be31527_JaffaCakes118.exe"

C:\Windows\svcchost.exe

"C:\Windows\svcchost.exe"

C:\Windows\exploree.exe

"C:\Windows\exploree.exe"

C:\Windows\hsl.exe

"C:\Windows\hsl.exe"

C:\Windows\scss.exe

"C:\Windows\scss.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\154.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 640 -ip 640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 344

C:\Windows\SysWOW64\Taskmgr.exe

"C:\Windows\System32\Taskmgr.exe"

C:\Windows\SysWOW64\REG.exe

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

C:\Windows\SysWOW64\chcp.com

chcp 1251

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp

Files

memory/4884-0-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4884-3-0x0000000000400000-0x000000000043B000-memory.dmp

memory/4884-2-0x0000000017180000-0x00000000171BB000-memory.dmp

C:\Windows\svcchost.exe

MD5 96536128805788b05b9335d674c19e1d
SHA1 a44cde59321c0f9bb07ef975efc8370c8a51e23e
SHA256 69693ac781a21bad65c7962e0afe1157c7cfcd088675a62a6afd92347178f2be
SHA512 537e856222506c1200796ce750bfd12bb9933558f1e484c1cc4f1dfc2610385cfb4d2d0f72a9f4d125d97b47060289ff480fedfe64fb6e96c9c302cdd9ab6e1f

C:\Windows\exploree.exe

MD5 31112dedf5f25bac5aef4c8e344b48f2
SHA1 104551348e450ea824d9469afc0189a342140290
SHA256 d346171cee29cb55204afeb44284480ebcbddee8000ec944a63f2655f0dcdb65
SHA512 2ee76e84b70109906ff37cafe58c24ea0b88a2846a43290fa7ecd3abc3b754072dddea8af2b2375df10a7da4c97ceccc03d6f4fcd8243f94b7838072cf03262f

memory/2328-32-0x0000000017180000-0x000000001718C000-memory.dmp

C:\Windows\hsl.exe

MD5 bb389d8f47db4a872087c37249b5347a
SHA1 8b6c0121e46b4af94c941d25fac2f2e7a3092b8d
SHA256 7490c42628d70c748b16387e66c33b5989c24b6531a949d5fa10d3069d90adad
SHA512 7b6c0ba266a9a611c2e713aeceb0b78a0400a405dbf48482fd0cbe00ea674591e324ffadb7900d4e9d444e81522c111e982410ebfe2f98e9eb2870df9a0f3950

memory/640-55-0x0000000013140000-0x000000001317E000-memory.dmp

C:\Windows\scss.exe

MD5 875d7d741e71b84e8d620e96b442ffc8
SHA1 34b1d6223940df1e2c47e441a84451d11c24ed6a
SHA256 9820f333dbe7cbd6ba2064999e7368efc3b4ce114925ede6d96d5fdfe3b1e909
SHA512 7b0e3264197e52ebf6b701cb051f749008bf489ff02133b38e4a71111309d1eff3084b2428cc3ec0dce6472a2d0ac4ad3e6430daf701f2777f1852c69fd72180

memory/100-53-0x0000000000400000-0x0000000000418000-memory.dmp

memory/100-52-0x0000000017180000-0x0000000017194000-memory.dmp

memory/640-50-0x0000000000400000-0x0000000000489000-memory.dmp

memory/2328-48-0x0000000000400000-0x000000000041E000-memory.dmp

memory/100-47-0x0000000000400000-0x000000000044B000-memory.dmp

memory/640-54-0x0000000017180000-0x0000000017187000-memory.dmp

memory/2328-39-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2328-31-0x0000000000400000-0x000000000044C000-memory.dmp

memory/2904-59-0x0000000017180000-0x0000000017189000-memory.dmp

memory/2904-58-0x0000000000400000-0x0000000000426000-memory.dmp

memory/2904-61-0x0000000000400000-0x000000000040C000-memory.dmp

memory/4884-63-0x0000000000400000-0x000000000043B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\154.bat

MD5 ca936c1244fd78ec8a6b5f23c92f9f1b
SHA1 644f0296439c1c175d399a32bc8929cb692579a6
SHA256 076b593a8d250953a255ef4cead2ee673b36e194ccf5e24152ce8b4c2359a925
SHA512 44f179e904cfc5d1f8293ec5fe5768a438735850bb93e9da3eb3f956eb857dd86c05b15b1aa0c968a2bf4b3b473d71aa88c92c48a9db401e0d2cb7df6fc87c35

memory/640-65-0x0000000013140000-0x000000001317E000-memory.dmp

memory/616-71-0x0000000000400000-0x0000000000418000-memory.dmp

memory/616-76-0x000000000CE70000-0x000000000CE88000-memory.dmp

memory/616-81-0x000000000CE90000-0x000000000CEA8000-memory.dmp

memory/616-86-0x000000000CEB0000-0x000000000CEC8000-memory.dmp

memory/616-92-0x000000000CED0000-0x000000000CEE8000-memory.dmp

memory/616-96-0x000000000CEF0000-0x000000000CF08000-memory.dmp

memory/616-101-0x000000000CF10000-0x000000000CF28000-memory.dmp

memory/616-106-0x000000000CF30000-0x000000000CF48000-memory.dmp

memory/616-111-0x000000000CF50000-0x000000000CF68000-memory.dmp

memory/616-116-0x000000000CF70000-0x000000000CF88000-memory.dmp

memory/616-121-0x000000000CF90000-0x000000000CFA8000-memory.dmp

memory/616-127-0x000000000CFB0000-0x000000000CFC8000-memory.dmp

memory/616-131-0x000000000CFD0000-0x000000000CFE8000-memory.dmp

memory/2328-2989-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2904-3745-0x0000000000400000-0x000000000040C000-memory.dmp