Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 22:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe
Resource
win7-20240708-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe
Resource
win10v2004-20240709-en
2 signatures
150 seconds
General
-
Target
3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe
-
Size
297KB
-
MD5
3aefc9bca134211327d24f3d12542aba
-
SHA1
854241404fabcd055c08abb2dfc124ee316b65f2
-
SHA256
f3729e5e57a33ea2d6a1d74a9c878e6ceddde719b7ea0cbe4c8ef7e3ad237e94
-
SHA512
757d76753cd342b1e6244a73ec13c350241a9de17a455dfd3b457d9f2cb5c3e9c196219d57e5ba1842424fb9248e61651a82fc217ff55afc43f661fdb873bff1
-
SSDEEP
6144:5OjjSIGNd37AMYwj5loIi/aQwUt7cbZQn1zW64lP71t2:8ad93lmb/a7Ut7yZQn1zWblz1t
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2780-8-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2780-6-0x0000000000400000-0x0000000000453000-memory.dmp upx -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 2668 set thread context of 2780 2668 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 30 PID 2780 set thread context of 2788 2780 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 31 PID 2788 set thread context of 2612 2788 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 32 PID 2612 set thread context of 2632 2612 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 33 PID 2632 set thread context of 3036 2632 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 34 PID 3036 set thread context of 1420 3036 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 35 PID 1420 set thread context of 1216 1420 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 36 PID 1216 set thread context of 2008 1216 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 37 PID 2008 set thread context of 3004 2008 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 38 PID 3004 set thread context of 2852 3004 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 39 PID 2852 set thread context of 2744 2852 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 40 PID 2744 set thread context of 1064 2744 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 41 PID 1064 set thread context of 1488 1064 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 42 PID 1488 set thread context of 1156 1488 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 43 PID 1156 set thread context of 2212 1156 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 44 PID 2212 set thread context of 1768 2212 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 45 PID 1768 set thread context of 2100 1768 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 46 PID 2100 set thread context of 596 2100 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 47 PID 596 set thread context of 540 596 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 48 PID 540 set thread context of 2484 540 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 49 PID 2484 set thread context of 1404 2484 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 50 PID 1404 set thread context of 3020 1404 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 51 PID 3020 set thread context of 2988 3020 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 52 PID 2988 set thread context of 812 2988 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 53 PID 812 set thread context of 1760 812 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 54 PID 1760 set thread context of 2224 1760 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 55 PID 2224 set thread context of 2492 2224 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 56 PID 2492 set thread context of 1580 2492 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 57 PID 1580 set thread context of 2928 1580 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 58 PID 2928 set thread context of 2664 2928 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 59 PID 2664 set thread context of 2800 2664 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 60 PID 2800 set thread context of 1872 2800 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 61 PID 1872 set thread context of 2636 1872 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 62 PID 2636 set thread context of 2740 2636 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 63 PID 2740 set thread context of 1984 2740 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 64 PID 1984 set thread context of 2956 1984 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 65 PID 2956 set thread context of 2236 2956 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 66 PID 2236 set thread context of 1616 2236 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 67 PID 1616 set thread context of 1620 1616 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 68 PID 1620 set thread context of 1904 1620 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 69 PID 1904 set thread context of 2080 1904 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 70 PID 2080 set thread context of 1244 2080 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 71 PID 1244 set thread context of 532 1244 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 72 PID 532 set thread context of 2396 532 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 73 PID 2396 set thread context of 1936 2396 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 74 PID 1936 set thread context of 1648 1936 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 75 PID 1648 set thread context of 2452 1648 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 76 PID 2452 set thread context of 1592 2452 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 77 PID 1592 set thread context of 2412 1592 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 78 PID 2412 set thread context of 2324 2412 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 79 PID 2324 set thread context of 3016 2324 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 80 PID 3016 set thread context of 2084 3016 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 81 PID 2084 set thread context of 2520 2084 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 82 PID 2520 set thread context of 1272 2520 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 83 PID 1272 set thread context of 876 1272 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 84 PID 876 set thread context of 1568 876 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 85 PID 1568 set thread context of 2492 1568 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 86 PID 2492 set thread context of 1580 2492 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 87 PID 1580 set thread context of 2928 1580 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 88 PID 2928 set thread context of 2664 2928 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 89 PID 2664 set thread context of 2800 2664 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 90 PID 2800 set thread context of 1872 2800 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 91 PID 1872 set thread context of 2172 1872 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 92 PID 2172 set thread context of 1676 2172 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 93 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2668 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2780 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2788 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2612 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2632 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 3036 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1420 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1216 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2008 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 3004 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2852 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2744 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1064 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1488 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1156 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2212 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1768 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2100 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 596 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 540 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2484 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1404 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 3020 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2988 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 812 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1760 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2224 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2492 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1580 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2928 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2664 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2800 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1872 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2636 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2740 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1984 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2956 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2236 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1616 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1620 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1904 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2080 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1244 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 532 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2396 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1936 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1648 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2452 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1592 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2412 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2324 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 3016 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2084 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2520 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1272 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 876 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1568 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2492 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1580 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2928 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2664 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2800 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 1872 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe Token: SeDebugPrivilege 2172 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2780 2668 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 30 PID 2668 wrote to memory of 2780 2668 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 30 PID 2668 wrote to memory of 2780 2668 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 30 PID 2668 wrote to memory of 2780 2668 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 30 PID 2668 wrote to memory of 2780 2668 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 30 PID 2668 wrote to memory of 2780 2668 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 30 PID 2780 wrote to memory of 2788 2780 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 31 PID 2780 wrote to memory of 2788 2780 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 31 PID 2780 wrote to memory of 2788 2780 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 31 PID 2780 wrote to memory of 2788 2780 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 31 PID 2780 wrote to memory of 2788 2780 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 31 PID 2780 wrote to memory of 2788 2780 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 31 PID 2788 wrote to memory of 2612 2788 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 32 PID 2788 wrote to memory of 2612 2788 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 32 PID 2788 wrote to memory of 2612 2788 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 32 PID 2788 wrote to memory of 2612 2788 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 32 PID 2788 wrote to memory of 2612 2788 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 32 PID 2788 wrote to memory of 2612 2788 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 32 PID 2612 wrote to memory of 2632 2612 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 33 PID 2612 wrote to memory of 2632 2612 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 33 PID 2612 wrote to memory of 2632 2612 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 33 PID 2612 wrote to memory of 2632 2612 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 33 PID 2612 wrote to memory of 2632 2612 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 33 PID 2612 wrote to memory of 2632 2612 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 33 PID 2632 wrote to memory of 3036 2632 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 34 PID 2632 wrote to memory of 3036 2632 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 34 PID 2632 wrote to memory of 3036 2632 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 34 PID 2632 wrote to memory of 3036 2632 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 34 PID 2632 wrote to memory of 3036 2632 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 34 PID 2632 wrote to memory of 3036 2632 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 34 PID 3036 wrote to memory of 1420 3036 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 35 PID 3036 wrote to memory of 1420 3036 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 35 PID 3036 wrote to memory of 1420 3036 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 35 PID 3036 wrote to memory of 1420 3036 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 35 PID 3036 wrote to memory of 1420 3036 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 35 PID 3036 wrote to memory of 1420 3036 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 35 PID 1420 wrote to memory of 1216 1420 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 36 PID 1420 wrote to memory of 1216 1420 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 36 PID 1420 wrote to memory of 1216 1420 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 36 PID 1420 wrote to memory of 1216 1420 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 36 PID 1420 wrote to memory of 1216 1420 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 36 PID 1420 wrote to memory of 1216 1420 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 36 PID 1216 wrote to memory of 2008 1216 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 37 PID 1216 wrote to memory of 2008 1216 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 37 PID 1216 wrote to memory of 2008 1216 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 37 PID 1216 wrote to memory of 2008 1216 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 37 PID 1216 wrote to memory of 2008 1216 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 37 PID 1216 wrote to memory of 2008 1216 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 37 PID 2008 wrote to memory of 3004 2008 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 38 PID 2008 wrote to memory of 3004 2008 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 38 PID 2008 wrote to memory of 3004 2008 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 38 PID 2008 wrote to memory of 3004 2008 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 38 PID 2008 wrote to memory of 3004 2008 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 38 PID 2008 wrote to memory of 3004 2008 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 38 PID 3004 wrote to memory of 2852 3004 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 39 PID 3004 wrote to memory of 2852 3004 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 39 PID 3004 wrote to memory of 2852 3004 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 39 PID 3004 wrote to memory of 2852 3004 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 39 PID 3004 wrote to memory of 2852 3004 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 39 PID 3004 wrote to memory of 2852 3004 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 39 PID 2852 wrote to memory of 2744 2852 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 40 PID 2852 wrote to memory of 2744 2852 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 40 PID 2852 wrote to memory of 2744 2852 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 40 PID 2852 wrote to memory of 2744 2852 3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe5⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe8⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe9⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe10⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe11⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe12⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe13⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe14⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe15⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe16⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe17⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe18⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe19⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:596 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe20⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:540 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe21⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe22⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe23⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe24⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe25⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:812 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe26⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe27⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe28⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe29⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe30⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe31⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe32⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe33⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe34⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe35⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe36⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe37⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe38⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe39⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe40⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe41⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe42⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe43⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe44⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:532 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe45⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe46⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe47⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe48⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe49⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe50⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe51⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe52⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe53⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe54⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe55⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe56⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:876 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe57⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe58⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe59⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe60⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe61⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe62⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe63⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe64⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe65⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe66⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe67⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe68⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe69⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe70⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe71⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe72⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe73⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe74⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe75⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe76⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe77⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe78⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe79⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe80⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe81⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe82⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe83⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe84⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe85⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe86⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe87⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe88⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe89⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe90⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe91⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe92⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe93⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe94⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe95⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe96⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe97⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe98⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe99⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe100⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe101⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe102⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe103⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe104⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe105⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe106⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe107⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe108⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe109⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe110⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe111⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe112⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe113⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe114⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe115⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe116⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe117⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe118⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe119⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe120⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe121⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\3aefc9bca134211327d24f3d12542aba_JaffaCakes118.exe122⤵PID:2952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-