Analysis
-
max time kernel
35s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06-07-2024 22:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2976dc5057b59acb497d7804d499435e_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2976dc5057b59acb497d7804d499435e_JaffaCakes118.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
2976dc5057b59acb497d7804d499435e_JaffaCakes118.exe
-
Size
49KB
-
MD5
2976dc5057b59acb497d7804d499435e
-
SHA1
a284722cd00feabe6eda01a6ed9acdd8f4ee96c5
-
SHA256
1772c5ddeff552acaaf86ba5455da4a961e416677c2b9e6a60d94c746f5eb17e
-
SHA512
af3549f43c5fd0c1ae6394ceb51515f73de241be36252483339bbdf76f3b80b35dbc0687d324cd5b062a9b3067d4b40882f8ac12dd81acd2e71f6bb5d533b585
-
SSDEEP
768:6yOFf8qubkE6/8YUUGb6CNrUSPShEMOT2iXZmOTIvOTQ0uUEEWpRe8F8888cXeJC:shvRE60Y92nLWfOT2iXAOTqOTSHpmAE
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2524 Winsock.exe 2696 Winsock.exe 2176 Winsock.exe 2456 Winsock.exe 2744 Winsock.exe 2836 Winsock.exe 2888 Winsock.exe 2620 Winsock.exe 2732 Winsock.exe 952 Winsock.exe 2640 Winsock.exe 2784 Winsock.exe 2612 Winsock.exe 1740 Winsock.exe 2984 Winsock.exe 2336 Winsock.exe 2964 Winsock.exe 2980 Winsock.exe 2872 Winsock.exe 3004 Winsock.exe 2852 Winsock.exe 2684 Winsock.exe 1868 Winsock.exe 2184 Winsock.exe 1248 Winsock.exe 2928 Winsock.exe 1360 Winsock.exe 916 Winsock.exe 1368 Winsock.exe 2140 Winsock.exe 2148 Winsock.exe 2380 Winsock.exe 1608 Winsock.exe 2440 Winsock.exe 2368 Winsock.exe 2332 Winsock.exe 2800 Winsock.exe 540 Winsock.exe 1884 Winsock.exe 2388 Winsock.exe 564 Winsock.exe 2288 Winsock.exe 1096 Winsock.exe 1616 Winsock.exe 1636 Winsock.exe 2160 Winsock.exe 1296 Winsock.exe 980 Winsock.exe 1540 Winsock.exe 1688 Winsock.exe 1028 Winsock.exe 1812 Winsock.exe 3036 Winsock.exe 1628 Winsock.exe 2044 Winsock.exe 2012 Winsock.exe 2292 Winsock.exe 2260 Winsock.exe 472 Winsock.exe 584 Winsock.exe 776 Winsock.exe 2544 Winsock.exe 2568 Winsock.exe 1976 Winsock.exe -
Loads dropped DLL 64 IoCs
pid Process 2540 2976dc5057b59acb497d7804d499435e_JaffaCakes118.exe 2540 2976dc5057b59acb497d7804d499435e_JaffaCakes118.exe 2524 Winsock.exe 2524 Winsock.exe 2696 Winsock.exe 2696 Winsock.exe 2176 Winsock.exe 2176 Winsock.exe 2456 Winsock.exe 2456 Winsock.exe 2744 Winsock.exe 2744 Winsock.exe 2836 Winsock.exe 2836 Winsock.exe 2888 Winsock.exe 2888 Winsock.exe 2620 Winsock.exe 2620 Winsock.exe 2732 Winsock.exe 2732 Winsock.exe 952 Winsock.exe 952 Winsock.exe 2640 Winsock.exe 2640 Winsock.exe 2784 Winsock.exe 2784 Winsock.exe 2612 Winsock.exe 2612 Winsock.exe 1740 Winsock.exe 1740 Winsock.exe 2984 Winsock.exe 2984 Winsock.exe 2336 Winsock.exe 2336 Winsock.exe 2964 Winsock.exe 2964 Winsock.exe 2980 Winsock.exe 2980 Winsock.exe 2872 Winsock.exe 2872 Winsock.exe 3004 Winsock.exe 3004 Winsock.exe 2852 Winsock.exe 2852 Winsock.exe 2684 Winsock.exe 2684 Winsock.exe 1868 Winsock.exe 1868 Winsock.exe 2184 Winsock.exe 2184 Winsock.exe 1248 Winsock.exe 1248 Winsock.exe 2928 Winsock.exe 2928 Winsock.exe 1360 Winsock.exe 1360 Winsock.exe 916 Winsock.exe 916 Winsock.exe 1368 Winsock.exe 1368 Winsock.exe 2140 Winsock.exe 2140 Winsock.exe 2148 Winsock.exe 2148 Winsock.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe File created C:\Windows\SysWOW64\Winsock.exe Winsock.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Winsock.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e1900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd90b000000010000001200000044006900670069004300650072007400000014000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd155090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Winsock.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 2976dc5057b59acb497d7804d499435e_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 2976dc5057b59acb497d7804d499435e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Winsock.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e1900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd90b000000010000001200000044006900670069004300650072007400000014000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd155090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Winsock.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Winsock.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Winsock.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2524 2540 2976dc5057b59acb497d7804d499435e_JaffaCakes118.exe 29 PID 2540 wrote to memory of 2524 2540 2976dc5057b59acb497d7804d499435e_JaffaCakes118.exe 29 PID 2540 wrote to memory of 2524 2540 2976dc5057b59acb497d7804d499435e_JaffaCakes118.exe 29 PID 2540 wrote to memory of 2524 2540 2976dc5057b59acb497d7804d499435e_JaffaCakes118.exe 29 PID 2524 wrote to memory of 2696 2524 Winsock.exe 30 PID 2524 wrote to memory of 2696 2524 Winsock.exe 30 PID 2524 wrote to memory of 2696 2524 Winsock.exe 30 PID 2524 wrote to memory of 2696 2524 Winsock.exe 30 PID 2696 wrote to memory of 2176 2696 Winsock.exe 31 PID 2696 wrote to memory of 2176 2696 Winsock.exe 31 PID 2696 wrote to memory of 2176 2696 Winsock.exe 31 PID 2696 wrote to memory of 2176 2696 Winsock.exe 31 PID 2176 wrote to memory of 2456 2176 Winsock.exe 32 PID 2176 wrote to memory of 2456 2176 Winsock.exe 32 PID 2176 wrote to memory of 2456 2176 Winsock.exe 32 PID 2176 wrote to memory of 2456 2176 Winsock.exe 32 PID 2456 wrote to memory of 2744 2456 Winsock.exe 33 PID 2456 wrote to memory of 2744 2456 Winsock.exe 33 PID 2456 wrote to memory of 2744 2456 Winsock.exe 33 PID 2456 wrote to memory of 2744 2456 Winsock.exe 33 PID 2744 wrote to memory of 2836 2744 Winsock.exe 34 PID 2744 wrote to memory of 2836 2744 Winsock.exe 34 PID 2744 wrote to memory of 2836 2744 Winsock.exe 34 PID 2744 wrote to memory of 2836 2744 Winsock.exe 34 PID 2836 wrote to memory of 2888 2836 Winsock.exe 35 PID 2836 wrote to memory of 2888 2836 Winsock.exe 35 PID 2836 wrote to memory of 2888 2836 Winsock.exe 35 PID 2836 wrote to memory of 2888 2836 Winsock.exe 35 PID 2888 wrote to memory of 2620 2888 Winsock.exe 36 PID 2888 wrote to memory of 2620 2888 Winsock.exe 36 PID 2888 wrote to memory of 2620 2888 Winsock.exe 36 PID 2888 wrote to memory of 2620 2888 Winsock.exe 36 PID 2620 wrote to memory of 2732 2620 Winsock.exe 37 PID 2620 wrote to memory of 2732 2620 Winsock.exe 37 PID 2620 wrote to memory of 2732 2620 Winsock.exe 37 PID 2620 wrote to memory of 2732 2620 Winsock.exe 37 PID 2732 wrote to memory of 952 2732 Winsock.exe 38 PID 2732 wrote to memory of 952 2732 Winsock.exe 38 PID 2732 wrote to memory of 952 2732 Winsock.exe 38 PID 2732 wrote to memory of 952 2732 Winsock.exe 38 PID 952 wrote to memory of 2640 952 Winsock.exe 39 PID 952 wrote to memory of 2640 952 Winsock.exe 39 PID 952 wrote to memory of 2640 952 Winsock.exe 39 PID 952 wrote to memory of 2640 952 Winsock.exe 39 PID 2640 wrote to memory of 2784 2640 Winsock.exe 40 PID 2640 wrote to memory of 2784 2640 Winsock.exe 40 PID 2640 wrote to memory of 2784 2640 Winsock.exe 40 PID 2640 wrote to memory of 2784 2640 Winsock.exe 40 PID 2784 wrote to memory of 2612 2784 Winsock.exe 41 PID 2784 wrote to memory of 2612 2784 Winsock.exe 41 PID 2784 wrote to memory of 2612 2784 Winsock.exe 41 PID 2784 wrote to memory of 2612 2784 Winsock.exe 41 PID 2612 wrote to memory of 1740 2612 Winsock.exe 42 PID 2612 wrote to memory of 1740 2612 Winsock.exe 42 PID 2612 wrote to memory of 1740 2612 Winsock.exe 42 PID 2612 wrote to memory of 1740 2612 Winsock.exe 42 PID 1740 wrote to memory of 2984 1740 Winsock.exe 43 PID 1740 wrote to memory of 2984 1740 Winsock.exe 43 PID 1740 wrote to memory of 2984 1740 Winsock.exe 43 PID 1740 wrote to memory of 2984 1740 Winsock.exe 43 PID 2984 wrote to memory of 2336 2984 Winsock.exe 44 PID 2984 wrote to memory of 2336 2984 Winsock.exe 44 PID 2984 wrote to memory of 2336 2984 Winsock.exe 44 PID 2984 wrote to memory of 2336 2984 Winsock.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2976dc5057b59acb497d7804d499435e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2976dc5057b59acb497d7804d499435e_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2980 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1248 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe33⤵
- Executes dropped EXE
PID:2380 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe34⤵
- Executes dropped EXE
PID:1608 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe35⤵
- Executes dropped EXE
PID:2440 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe36⤵
- Executes dropped EXE
PID:2368 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe37⤵
- Executes dropped EXE
PID:2332 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe38⤵
- Executes dropped EXE
PID:2800 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:540 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe40⤵
- Executes dropped EXE
PID:1884 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe41⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe42⤵
- Executes dropped EXE
PID:564 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe43⤵
- Executes dropped EXE
PID:2288 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe44⤵
- Executes dropped EXE
PID:1096 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe45⤵
- Executes dropped EXE
PID:1616 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe46⤵
- Executes dropped EXE
PID:1636 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe47⤵
- Executes dropped EXE
PID:2160 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe48⤵
- Executes dropped EXE
PID:1296 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe49⤵
- Executes dropped EXE
PID:980 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe50⤵
- Executes dropped EXE
PID:1540 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe51⤵
- Executes dropped EXE
PID:1688 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe52⤵
- Executes dropped EXE
PID:1028 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe53⤵
- Executes dropped EXE
PID:1812 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe54⤵
- Executes dropped EXE
PID:3036 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe55⤵
- Executes dropped EXE
PID:1628 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe56⤵
- Executes dropped EXE
PID:2044 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2012 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2292 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe59⤵
- Executes dropped EXE
PID:2260 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe60⤵
- Executes dropped EXE
PID:472 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe61⤵
- Executes dropped EXE
PID:584 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe62⤵
- Executes dropped EXE
PID:776 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe63⤵
- Executes dropped EXE
PID:2544 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe64⤵
- Executes dropped EXE
PID:2568 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe65⤵
- Executes dropped EXE
PID:1976 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe66⤵PID:2444
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe67⤵PID:1784
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe68⤵PID:1792
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe69⤵PID:892
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe70⤵
- Drops file in System32 directory
PID:1080 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe71⤵PID:2340
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe72⤵PID:1232
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe73⤵PID:2104
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe74⤵PID:1712
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe75⤵PID:1568
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe76⤵PID:1596
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe77⤵
- Drops file in System32 directory
PID:1768 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe78⤵PID:2084
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe79⤵PID:912
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe80⤵PID:2804
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe81⤵PID:2276
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe82⤵
- Drops file in System32 directory
PID:2164 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe83⤵PID:1044
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe84⤵PID:2760
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe85⤵PID:2828
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe86⤵PID:2832
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe87⤵
- Drops file in System32 directory
PID:2768 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe88⤵PID:2740
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe89⤵
- Drops file in System32 directory
PID:2748 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe90⤵PID:3064
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe91⤵PID:948
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe92⤵PID:2940
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe93⤵PID:2636
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe94⤵
- Drops file in System32 directory
PID:2008 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe95⤵PID:2864
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe96⤵
- Drops file in System32 directory
PID:2844 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe97⤵PID:2624
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe98⤵PID:1856
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe99⤵PID:2596
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe100⤵PID:2492
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe101⤵PID:904
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe102⤵PID:2372
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe103⤵PID:3044
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe104⤵PID:2952
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe105⤵
- Drops file in System32 directory
PID:2944 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe106⤵PID:2860
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe107⤵PID:3020
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe108⤵
- Drops file in System32 directory
PID:2876 -
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe109⤵PID:2672
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe110⤵PID:2856
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe111⤵PID:108
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe112⤵PID:1036
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe113⤵PID:396
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe114⤵PID:872
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe115⤵PID:1144
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe116⤵PID:1452
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe117⤵PID:1892
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe118⤵PID:1644
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe119⤵PID:2244
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe120⤵PID:2240
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe121⤵PID:2460
-
C:\Windows\SysWOW64\Winsock.exeC:\Windows\system32\Winsock.exe122⤵PID:2512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-