Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14/07/2024, 09:49
Static task
static1
Behavioral task
behavioral1
Sample
454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe
-
Size
43KB
-
MD5
454d20ca3452c7ccc51da7a0ccb7e55d
-
SHA1
c218de2d7c18a788f0f655ac2a3db4c729a3d40b
-
SHA256
8e54e6d5ed7ea5338370375a1ed4caa74539389c78cedbcfc3b185354121c5f2
-
SHA512
b754b1a574c274f46d80d2d19932d6298a042d040c7f466cfa2bc40afbca3d55720d51610485bd3640702c4254bbc8425416b6ea67a3998119ad16576352e850
-
SSDEEP
768:3PJadenAqtYQnaXH96rV2kllriFqR7Atmqfvfj7sMC72ZWzFwKF/Kpplc:3PnAClrVLTrEqNAxvXsf7rzV/KpXc
Malware Config
Signatures
-
Executes dropped EXE 18 IoCs
pid Process 2612 scklchk.exe 3160 scklchk.exe 1916 scklchk.exe 3132 scklchk.exe 2084 scklchk.exe 3884 scklchk.exe 4540 scklchk.exe 2856 scklchk.exe 2796 scklchk.exe 2052 scklchk.exe 2660 scklchk.exe 1408 scklchk.exe 5052 scklchk.exe 4604 scklchk.exe 4272 scklchk.exe 3148 scklchk.exe 5008 scklchk.exe 1760 scklchk.exe -
Adds Run key to start application 2 TTPs 18 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" 454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scklchk = "C:\\Windows\\system32\\scklchk.exe" scklchk.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies WinLogon 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\StopScreenSaver = "WLEStopScreenSaver" 454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Asynchronous = "0" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Logon = "WLELogon" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Startup = "WLEStartup" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Startup = "WLEStartup" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Lock = "WLELock" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\StartScreenSaver = "WLEStartScreenSaver" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Startup = "WLEStartup" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Logon = "WLELogon" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Logoff = "WLELogoff" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Logoff = "WLELogoff" scklchk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Asynchronous = "0" scklchk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Asynchronous = "0" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\StopScreenSaver = "WLEStopScreenSaver" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\StartScreenSaver = "WLEStartScreenSaver" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Shutdown = "WLEShutdown" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Unlock = "WLEUnlock" scklchk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Impersonate = "0" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\StartScreenSaver = "WLEStartScreenSaver" scklchk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify scklchk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify scklchk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Logoff = "WLELogoff" scklchk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify scklchk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Logoff = "WLELogoff" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Shutdown = "WLEShutdown" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Unlock = "WLEUnlock" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\DllName = "scklchk.dll" scklchk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk 454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Startup = "WLEStartup" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Logon = "WLELogon" scklchk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\DllName = "scklchk.dll" 454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Startup = "WLEStartup" 454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Asynchronous = "0" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Startup = "WLEStartup" scklchk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk scklchk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\DllName = "scklchk.dll" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Lock = "WLELock" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Logoff = "WLELogoff" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Lock = "WLELock" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Logon = "WLELogon" scklchk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Lock = "WLELock" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Lock = "WLELock" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\StopScreenSaver = "WLEStopScreenSaver" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Unlock = "WLEUnlock" scklchk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Unlock = "WLEUnlock" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Shutdown = "WLEShutdown" scklchk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify 454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Logon = "WLELogon" 454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\StopScreenSaver = "WLEStopScreenSaver" scklchk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Logoff = "WLELogoff" scklchk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\DllName = "scklchk.dll" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Lock = "WLELock" scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\Logon = "WLELogon" scklchk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify scklchk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\scklchk\StopScreenSaver = "WLEStopScreenSaver" scklchk.exe -
Drops file in System32 directory 21 IoCs
description ioc Process File created C:\Windows\SysWOW64\scklchk.exe 454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe File created C:\Windows\SysWOW64\scklchk.dll 454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe File created C:\Windows\SysWOW64\scklchk.exe scklchk.exe File created C:\Windows\SysWOW64\scklchk.exe scklchk.exe File created C:\Windows\SysWOW64\scklchk.exe scklchk.exe File created C:\Windows\SysWOW64\scklchk.exe scklchk.exe File opened for modification C:\Windows\SysWOW64\scklchk.exe 454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe File created C:\Windows\SysWOW64\scklchk.exe scklchk.exe File created C:\Windows\SysWOW64\scklchk.exe scklchk.exe File created C:\Windows\SysWOW64\scklchk.exe scklchk.exe File created C:\Windows\SysWOW64\scklchk.exe scklchk.exe File created C:\Windows\SysWOW64\scklchk.exe scklchk.exe File created C:\Windows\SysWOW64\scklchk.exe scklchk.exe File created C:\Windows\SysWOW64\scklchk.exe scklchk.exe File created C:\Windows\SysWOW64\scklchk.exe scklchk.exe File created C:\Windows\SysWOW64\scklchk.exe scklchk.exe File opened for modification C:\Windows\SysWOW64\scklchk.dll 454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe File created C:\Windows\SysWOW64\scklchk.exe scklchk.exe File created C:\Windows\SysWOW64\scklchk.exe scklchk.exe File created C:\Windows\SysWOW64\scklchk.exe scklchk.exe File created C:\Windows\SysWOW64\scklchk.exe scklchk.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 20068 19524 WerFault.exe 778 -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 3448 wrote to memory of 2612 3448 454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe 83 PID 3448 wrote to memory of 2612 3448 454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe 83 PID 3448 wrote to memory of 2612 3448 454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe 83 PID 2612 wrote to memory of 3160 2612 scklchk.exe 84 PID 2612 wrote to memory of 3160 2612 scklchk.exe 84 PID 2612 wrote to memory of 3160 2612 scklchk.exe 84 PID 3160 wrote to memory of 1916 3160 scklchk.exe 85 PID 3160 wrote to memory of 1916 3160 scklchk.exe 85 PID 3160 wrote to memory of 1916 3160 scklchk.exe 85 PID 1916 wrote to memory of 3132 1916 scklchk.exe 86 PID 1916 wrote to memory of 3132 1916 scklchk.exe 86 PID 1916 wrote to memory of 3132 1916 scklchk.exe 86 PID 3132 wrote to memory of 2084 3132 scklchk.exe 87 PID 3132 wrote to memory of 2084 3132 scklchk.exe 87 PID 3132 wrote to memory of 2084 3132 scklchk.exe 87 PID 2084 wrote to memory of 3884 2084 scklchk.exe 88 PID 2084 wrote to memory of 3884 2084 scklchk.exe 88 PID 2084 wrote to memory of 3884 2084 scklchk.exe 88 PID 3884 wrote to memory of 4540 3884 scklchk.exe 89 PID 3884 wrote to memory of 4540 3884 scklchk.exe 89 PID 3884 wrote to memory of 4540 3884 scklchk.exe 89 PID 4540 wrote to memory of 2856 4540 scklchk.exe 90 PID 4540 wrote to memory of 2856 4540 scklchk.exe 90 PID 4540 wrote to memory of 2856 4540 scklchk.exe 90 PID 2856 wrote to memory of 2796 2856 scklchk.exe 92 PID 2856 wrote to memory of 2796 2856 scklchk.exe 92 PID 2856 wrote to memory of 2796 2856 scklchk.exe 92 PID 2796 wrote to memory of 2052 2796 scklchk.exe 93 PID 2796 wrote to memory of 2052 2796 scklchk.exe 93 PID 2796 wrote to memory of 2052 2796 scklchk.exe 93 PID 2052 wrote to memory of 2660 2052 scklchk.exe 94 PID 2052 wrote to memory of 2660 2052 scklchk.exe 94 PID 2052 wrote to memory of 2660 2052 scklchk.exe 94 PID 2660 wrote to memory of 1408 2660 scklchk.exe 95 PID 2660 wrote to memory of 1408 2660 scklchk.exe 95 PID 2660 wrote to memory of 1408 2660 scklchk.exe 95 PID 1408 wrote to memory of 5052 1408 scklchk.exe 96 PID 1408 wrote to memory of 5052 1408 scklchk.exe 96 PID 1408 wrote to memory of 5052 1408 scklchk.exe 96 PID 5052 wrote to memory of 4604 5052 scklchk.exe 97 PID 5052 wrote to memory of 4604 5052 scklchk.exe 97 PID 5052 wrote to memory of 4604 5052 scklchk.exe 97 PID 4604 wrote to memory of 4272 4604 scklchk.exe 98 PID 4604 wrote to memory of 4272 4604 scklchk.exe 98 PID 4604 wrote to memory of 4272 4604 scklchk.exe 98 PID 4272 wrote to memory of 3148 4272 scklchk.exe 99 PID 4272 wrote to memory of 3148 4272 scklchk.exe 99 PID 4272 wrote to memory of 3148 4272 scklchk.exe 99 PID 3148 wrote to memory of 5008 3148 scklchk.exe 100 PID 3148 wrote to memory of 5008 3148 scklchk.exe 100 PID 3148 wrote to memory of 5008 3148 scklchk.exe 100 PID 5008 wrote to memory of 1760 5008 scklchk.exe 101 PID 5008 wrote to memory of 1760 5008 scklchk.exe 101 PID 5008 wrote to memory of 1760 5008 scklchk.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\454d20ca3452c7ccc51da7a0ccb7e55d_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe8⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe9⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe10⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe11⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe12⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe13⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe14⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe15⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe16⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe17⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe18⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe19⤵
- Executes dropped EXE
PID:1760 -
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe20⤵PID:3688
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe21⤵PID:4256
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe22⤵PID:1792
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe23⤵PID:2332
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe24⤵PID:3880
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe25⤵PID:4104
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe26⤵PID:5028
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe27⤵PID:964
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe28⤵PID:4784
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe29⤵PID:1136
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe30⤵PID:2032
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe31⤵PID:1788
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe32⤵PID:3392
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe33⤵PID:3252
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe34⤵PID:3920
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe35⤵PID:4968
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe36⤵PID:2516
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe37⤵PID:4616
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe38⤵PID:4628
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe39⤵PID:3976
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe40⤵PID:3088
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe41⤵PID:1152
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe42⤵PID:4508
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe43⤵PID:5004
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe44⤵PID:2104
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe45⤵PID:4980
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe46⤵PID:2400
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe47⤵PID:3548
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe48⤵PID:3984
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe49⤵PID:1336
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe50⤵PID:4416
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe51⤵PID:1724
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe52⤵PID:396
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe53⤵PID:4056
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe54⤵PID:4756
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe55⤵PID:876
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe56⤵PID:2220
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe57⤵PID:4864
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe58⤵PID:2008
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe59⤵PID:4240
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe60⤵PID:4440
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe61⤵PID:3536
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe62⤵PID:3024
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe63⤵PID:4536
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe64⤵PID:2864
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe65⤵PID:2852
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe66⤵PID:1940
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe67⤵PID:748
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe68⤵PID:3240
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe69⤵PID:4368
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe70⤵PID:4432
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe71⤵PID:3192
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe72⤵PID:4652
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe73⤵PID:3804
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe74⤵PID:4608
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe75⤵PID:2284
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe76⤵PID:648
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe77⤵PID:3464
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe78⤵PID:2840
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe79⤵PID:3664
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe80⤵PID:4764
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe81⤵PID:2488
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe82⤵PID:4088
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe83⤵PID:2336
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe84⤵PID:2064
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe85⤵PID:1072
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe86⤵PID:4804
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe87⤵PID:5140
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe88⤵PID:5164
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe89⤵PID:5184
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe90⤵PID:5208
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe91⤵PID:5228
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe92⤵PID:5248
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe93⤵PID:5264
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe94⤵PID:5284
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe95⤵PID:5308
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe96⤵PID:5328
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe97⤵PID:5356
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe98⤵PID:5372
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe99⤵PID:5392
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe100⤵PID:5412
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe101⤵PID:5436
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe102⤵PID:5452
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe103⤵PID:5472
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe104⤵PID:5492
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe105⤵PID:5512
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe106⤵PID:5532
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe107⤵PID:5552
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe108⤵PID:5572
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe109⤵PID:5592
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe110⤵PID:5616
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe111⤵PID:5632
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe112⤵PID:5652
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe113⤵PID:5672
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe114⤵PID:5692
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe115⤵PID:5720
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe116⤵PID:5740
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe117⤵PID:5760
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe118⤵PID:5780
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe119⤵PID:5800
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe120⤵PID:5820
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe121⤵PID:5840
-
C:\Windows\SysWOW64\scklchk.exeC:\Windows\system32\scklchk.exe122⤵PID:5860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-