description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KISLnchr.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MagicSet.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pagefile.pif\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRun.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USBoot.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dfcxfeddsfddg.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isPwdSvc.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit32.Exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit32.Exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\appdllman.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\servet.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Discovery.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dfcxfeddsfddg.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\asxssffsddgfsxxsxdfcfdfcsssxxsxs.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmqczj.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safelive.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\XP.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\appdllman.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Wsyscheck.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\5784sdhdfdjfdfgd989sgsfsdfgdffhfg5gsfaabsfmfgdddsabc.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\asxssffsddgfsxxsxdfcfdfcsssxxsxs.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQDoctorMain.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TNT.Exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe\Debugger = "C:\\Windows\\system32\\Fuckbc.exe"	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\Fuckbc.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\Fuckbc.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Fuckbc.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Fuckbc.exe	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Local Page	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Internet Explorer\Main\default_page_url	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe

pid	Process
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe
2328	36e70acedb80215e3f68b5f346e94efe_JaffaCakes118.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.