Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A

Modifies file permissions

discovery

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\takeown.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\icacls.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wlock = "C:\\Users\\Admin\\wlock\\wlock.exe"	C:\Windows\SysWOW64\reg.exe	N/A

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

defense_evasion

Enumerates physical storage devices

Modifies Control Panel

evasion

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\Desktop\ScreenSaveActive = "0"	C:\Users\Admin\wlock\wlock.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\takeown.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\wlock\wlock.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2576 wrote to memory of 2316	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\takeown.exe
PID 2576 wrote to memory of 2316	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\takeown.exe
PID 2576 wrote to memory of 2316	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\takeown.exe
PID 2576 wrote to memory of 1552	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\icacls.exe
PID 2576 wrote to memory of 1552	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\icacls.exe
PID 2576 wrote to memory of 1552	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\icacls.exe
PID 2576 wrote to memory of 4452	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 4452	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 4452	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 1204	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 1204	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 1204	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\cmd.exe
PID 1204 wrote to memory of 2176	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\reg.exe
PID 1204 wrote to memory of 2176	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\reg.exe
PID 1204 wrote to memory of 2176	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\reg.exe
PID 2576 wrote to memory of 2664	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Users\Admin\wlock\wlock.exe
PID 2576 wrote to memory of 2664	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Users\Admin\wlock\wlock.exe
PID 2576 wrote to memory of 2664	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Users\Admin\wlock\wlock.exe

Processes

C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe"

C:\Windows\SysWOW64\takeown.exe

"C:\Windows\System32\takeown.exe" /f "C:\Windows\System32\rstrui.exe"

C:\Windows\SysWOW64\icacls.exe

"C:\Windows\System32\icacls.exe" "C:\Windows\System32\rstrui.exe" /grant Admin:F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c del /f /q "C:\Windows\System32\rstrui.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v wlock /t REG_SZ /d "C:\Users\Admin\wlock\wlock.exe" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v wlock /t REG_SZ /d "C:\Users\Admin\wlock\wlock.exe" /f

C:\Users\Admin\wlock\wlock.exe

"C:\Users\Admin\wlock\wlock.exe" f

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	68.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	80.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp

Files

memory/2576-0-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2664-23-0x0000000000A30000-0x0000000000A31000-memory.dmp

memory/2664-25-0x0000000000A30000-0x0000000000A31000-memory.dmp

memory/2664-24-0x0000000000A30000-0x0000000000A31000-memory.dmp

memory/2664-27-0x0000000000A30000-0x0000000000A31000-memory.dmp

memory/2664-26-0x0000000000A30000-0x0000000000A31000-memory.dmp

memory/2664-22-0x0000000000A30000-0x0000000000A31000-memory.dmp

memory/2664-21-0x0000000000A30000-0x0000000000A31000-memory.dmp

memory/2664-20-0x0000000000A30000-0x0000000000A31000-memory.dmp

memory/2664-28-0x0000000000A30000-0x0000000000A31000-memory.dmp

memory/2664-30-0x0000000000A30000-0x0000000000A31000-memory.dmp

memory/2664-15-0x0000000000A40000-0x0000000000A41000-memory.dmp

memory/2664-19-0x0000000000A40000-0x0000000000A41000-memory.dmp

memory/2664-18-0x0000000000A40000-0x0000000000A41000-memory.dmp

memory/2664-17-0x0000000000A40000-0x0000000000A41000-memory.dmp

memory/2664-16-0x0000000000A40000-0x0000000000A41000-memory.dmp

memory/2664-14-0x0000000000A40000-0x0000000000A41000-memory.dmp

memory/2664-13-0x0000000000A30000-0x0000000000A31000-memory.dmp

memory/2664-12-0x0000000000A30000-0x0000000000A31000-memory.dmp

memory/2664-11-0x0000000000A30000-0x0000000000A31000-memory.dmp

memory/2576-10-0x0000000002070000-0x0000000002071000-memory.dmp

C:\Users\Admin\wlock\wlock.exe

MD5	68db28477509a770acbf114b0de781a8
SHA1	3ac88ce18f440b64e3a4bc3a16c11c01ef9b4a23
SHA256	69586e31e8feac35f72e7da461dd8d4b98ce0ff1c6fec68d88d20c37156cea88
SHA512	c6f9e406ea7b8d08f8d5b37b19a9849a4eeee47f60284297e0fa908bc8c94422cedabd5d6b3462c2545035578b9bc08b47cf58667c7fc8999aca7ee2e919fd5a

memory/2576-8-0x0000000002070000-0x0000000002071000-memory.dmp

memory/2576-32-0x0000000002070000-0x0000000002071000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-26 09:21

Reported

2024-06-26 09:24

Platform

win7-20240221-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe"

Signatures

Possible privilege escalation attempt

exploit

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\takeown.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\icacls.exe	N/A

Deletes itself

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\cmd.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	N/A

Modifies file permissions

discovery

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\takeown.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\icacls.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wlock = "C:\\Users\\Admin\\wlock\\wlock.exe"	C:\Windows\SysWOW64\reg.exe	N/A

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

defense_evasion

Enumerates physical storage devices

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Modifies Control Panel

evasion

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\ScreenSaveActive = "0"	C:\Users\Admin\wlock\wlock.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\takeown.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A
N/A	N/A	C:\Users\Admin\wlock\wlock.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1740 wrote to memory of 2268	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\takeown.exe
PID 1740 wrote to memory of 2268	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\takeown.exe
PID 1740 wrote to memory of 2268	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\takeown.exe
PID 1740 wrote to memory of 2268	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\takeown.exe
PID 1740 wrote to memory of 2936	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\icacls.exe
PID 1740 wrote to memory of 2936	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\icacls.exe
PID 1740 wrote to memory of 2936	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\icacls.exe
PID 1740 wrote to memory of 2936	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\icacls.exe
PID 1740 wrote to memory of 2036	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2036	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2036	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2036	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 2564	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Windows\SysWOW64\cmd.exe
PID 2564 wrote to memory of 2556	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\reg.exe
PID 2564 wrote to memory of 2556	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\reg.exe
PID 2564 wrote to memory of 2556	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\reg.exe
PID 2564 wrote to memory of 2556	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\reg.exe
PID 1740 wrote to memory of 2060	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Users\Admin\wlock\wlock.exe
PID 1740 wrote to memory of 2060	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Users\Admin\wlock\wlock.exe
PID 1740 wrote to memory of 2060	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Users\Admin\wlock\wlock.exe
PID 1740 wrote to memory of 2060	N/A	C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe	C:\Users\Admin\wlock\wlock.exe
PID 2060 wrote to memory of 2376	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2376	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2376	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2376	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 1484	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 1484	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 1484	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 1484	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2544	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2544	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2544	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2544	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2684	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2684	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2684	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2684	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2776	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2776	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2776	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2776	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 1796	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 1796	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 1796	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 1796	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2292	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2292	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2292	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2292	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2116	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2116	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2116	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 2116	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 1548	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 1548	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 1548	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 1548	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 832	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 832	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 832	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe
PID 2060 wrote to memory of 832	N/A	C:\Users\Admin\wlock\wlock.exe	C:\Windows\SysWOW64\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\117fc5afa709ad652f2e2cb9516c890e_JaffaCakes118.exe"

C:\Windows\SysWOW64\takeown.exe

"C:\Windows\System32\takeown.exe" /f "C:\Windows\System32\rstrui.exe"

C:\Windows\SysWOW64\icacls.exe

"C:\Windows\System32\icacls.exe" "C:\Windows\System32\rstrui.exe" /grant Admin:F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c del /f /q "C:\Windows\System32\rstrui.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v wlock /t REG_SZ /d "C:\Users\Admin\wlock\wlock.exe" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v wlock /t REG_SZ /d "C:\Users\Admin\wlock\wlock.exe" /f

C:\Users\Admin\wlock\wlock.exe

"C:\Users\Admin\wlock\wlock.exe" f