08f2ead8ad4e9ab19fcd0fa225c14e594b2d86d7dccf74dc01155eddde5eabef

Analysis

max time kernel
135s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
59c2bc9e023b75454aafc09f11cd3af4_JaffaCakes118.exe
Size 232KB
Sample240719-ay2pfavaqp
SHA256 08f2ead8ad4e9ab19fcd0fa225c14e594b2d86d7dccf74dc01155eddde5eabef
MD5 59c2bc9e023b75454aafc09f11cd3af4
SHA1 5000ed637ab364db7474e4a55f4b4d2d189ce53b
SHA512 bd505a2f12d7ab2fbf94eaaeb46f908db79ed1ef2fcf5fbd9c4490d574d060b7a8765f20f230ae6eb39cada6e713cdf9c490374ec3b30ea2f61ccbb5c92d9e35
SSDEEP 6144:9hbZ5hMTNFf8LAurlEzAX7o5hn8wVSZ2sXs6:vtXMzqrllX7618wC
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
3928	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202.exe
4036	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202a.exe
1228	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202b.exe
3564	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202c.exe
4876	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202d.exe
1972	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202e.exe
2216	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202f.exe
4672	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202g.exe
1100	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202h.exe
4692	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202i.exe
3204	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202j.exe
3840	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202k.exe
4244	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202l.exe
1080	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202m.exe
1756	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202n.exe
2128	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202o.exe
4620	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202p.exe
4484	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202q.exe
60	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202r.exe
4092	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202s.exe
4856	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202t.exe
1720	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202u.exe
4968	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202v.exe
3056	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202w.exe
3972	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202x.exe
112	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202y.exe

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Modifies registry class 54 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202h.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202d.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202p.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202w.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202w.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202o.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202q.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202y.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202a.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202i.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202l.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202l.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202b.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202c.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202s.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202t.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202j.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202n.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202p.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202n.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202u.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202m.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202x.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202c.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202d.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202u.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202x.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202g.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202m.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202q.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202h.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202s.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202v.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202k.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202r.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202t.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202g.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202i.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202v.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202y.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202k.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202o.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202r.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 4308943deedc6c9b	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202a.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202j.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3928	4476	59c2bc9e023b75454aafc09f11cd3af4_JaffaCakes118.exe	83
PID 4476 wrote to memory of 3928	4476	59c2bc9e023b75454aafc09f11cd3af4_JaffaCakes118.exe	83
PID 4476 wrote to memory of 3928	4476	59c2bc9e023b75454aafc09f11cd3af4_JaffaCakes118.exe	83
PID 3928 wrote to memory of 4036	3928	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202.exe	84
PID 3928 wrote to memory of 4036	3928	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202.exe	84
PID 3928 wrote to memory of 4036	3928	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202.exe	84
PID 4036 wrote to memory of 1228	4036	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202a.exe	85
PID 4036 wrote to memory of 1228	4036	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202a.exe	85
PID 4036 wrote to memory of 1228	4036	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202a.exe	85
PID 1228 wrote to memory of 3564	1228	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202b.exe	86
PID 1228 wrote to memory of 3564	1228	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202b.exe	86
PID 1228 wrote to memory of 3564	1228	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202b.exe	86
PID 3564 wrote to memory of 4876	3564	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202c.exe	87
PID 3564 wrote to memory of 4876	3564	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202c.exe	87
PID 3564 wrote to memory of 4876	3564	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202c.exe	87
PID 4876 wrote to memory of 1972	4876	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202d.exe	88
PID 4876 wrote to memory of 1972	4876	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202d.exe	88
PID 4876 wrote to memory of 1972	4876	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202d.exe	88
PID 1972 wrote to memory of 2216	1972	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202e.exe	90
PID 1972 wrote to memory of 2216	1972	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202e.exe	90
PID 1972 wrote to memory of 2216	1972	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202e.exe	90
PID 2216 wrote to memory of 4672	2216	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202f.exe	91
PID 2216 wrote to memory of 4672	2216	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202f.exe	91
PID 2216 wrote to memory of 4672	2216	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202f.exe	91
PID 4672 wrote to memory of 1100	4672	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202g.exe	93
PID 4672 wrote to memory of 1100	4672	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202g.exe	93
PID 4672 wrote to memory of 1100	4672	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202g.exe	93
PID 1100 wrote to memory of 4692	1100	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202h.exe	94
PID 1100 wrote to memory of 4692	1100	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202h.exe	94
PID 1100 wrote to memory of 4692	1100	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202h.exe	94
PID 4692 wrote to memory of 3204	4692	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202i.exe	96
PID 4692 wrote to memory of 3204	4692	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202i.exe	96
PID 4692 wrote to memory of 3204	4692	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202i.exe	96
PID 3204 wrote to memory of 3840	3204	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202j.exe	97
PID 3204 wrote to memory of 3840	3204	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202j.exe	97
PID 3204 wrote to memory of 3840	3204	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202j.exe	97
PID 3840 wrote to memory of 4244	3840	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202k.exe	98
PID 3840 wrote to memory of 4244	3840	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202k.exe	98
PID 3840 wrote to memory of 4244	3840	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202k.exe	98
PID 4244 wrote to memory of 1080	4244	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202l.exe	99
PID 4244 wrote to memory of 1080	4244	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202l.exe	99
PID 4244 wrote to memory of 1080	4244	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202l.exe	99
PID 1080 wrote to memory of 1756	1080	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202m.exe	100
PID 1080 wrote to memory of 1756	1080	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202m.exe	100
PID 1080 wrote to memory of 1756	1080	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202m.exe	100
PID 1756 wrote to memory of 2128	1756	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202n.exe	101
PID 1756 wrote to memory of 2128	1756	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202n.exe	101
PID 1756 wrote to memory of 2128	1756	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202n.exe	101
PID 2128 wrote to memory of 4620	2128	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202o.exe	102
PID 2128 wrote to memory of 4620	2128	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202o.exe	102
PID 2128 wrote to memory of 4620	2128	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202o.exe	102
PID 4620 wrote to memory of 4484	4620	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202p.exe	103
PID 4620 wrote to memory of 4484	4620	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202p.exe	103
PID 4620 wrote to memory of 4484	4620	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202p.exe	103
PID 4484 wrote to memory of 60	4484	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202q.exe	104
PID 4484 wrote to memory of 60	4484	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202q.exe	104
PID 4484 wrote to memory of 60	4484	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202q.exe	104
PID 60 wrote to memory of 4092	60	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202r.exe	105
PID 60 wrote to memory of 4092	60	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202r.exe	105
PID 60 wrote to memory of 4092	60	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202r.exe	105
PID 4092 wrote to memory of 4856	4092	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202s.exe	106
PID 4092 wrote to memory of 4856	4092	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202s.exe	106
PID 4092 wrote to memory of 4856	4092	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202s.exe	106
PID 4856 wrote to memory of 1720	4856	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202t.exe	107

C:\Users\Admin\AppData\Local\Temp\59c2bc9e023b75454aafc09f11cd3af4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\59c2bc9e023b75454aafc09f11cd3af4_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4476
- \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202.exe
  c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3928
- - \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202a.exe
    c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202a.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202b.exe
      c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202b.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1228
    - - \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202c.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202c.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3564
      - \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202d.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202d.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202e.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202e.exe
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202f.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202f.exe
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202g.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202g.exe
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4672
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202h.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202h.exe
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202i.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202i.exe
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202j.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202j.exe
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3204
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202k.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202k.exe
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3840
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202l.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202l.exe
        14⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202m.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202m.exe
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202n.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202n.exe
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202o.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202o.exe
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202p.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202p.exe
        18⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202q.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202q.exe
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202r.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202r.exe
        20⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:60
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202s.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202s.exe
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4092
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202t.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202t.exe
        22⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202u.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202u.exe
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:1720
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202v.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202v.exe
        24⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:4968
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202w.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202w.exe
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:3056
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202x.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202x.exe
        26⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:3972
        
        \??\c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202y.exe
        
        c:\users\admin\appdata\local\temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202y.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202.exe

Path C:\Users\Admin\AppData\Local\Temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202.exe
Size 232KB
SHA256 fc0158fb89a0a53210ccfad4b502f6f27a9087e2b4738a75fb32a7be020767da
MD5 89cc9468a2103f37f8d480eb94f157a4
SHA1 59644ee61882402018d1c448067692b447c32c53
SHA512 69d4f1a5bcb100a5eb25690b804619f09ac769913ac873b26b076d0a21921b7f91112c479cd6afc6faa25d6bcdd009c16ea9456aad2d1612e5d12a3c430c3d69
SSDEEP 6144:9hbZ5hMTNFf8LAurlEzAX7o5hn8wVSZ2sXQ6:vtXMzqrllX7618wy
MD5 SHA1 SHA512 SSDEEP

Submit Download

59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202l.exe

Path C:\Users\Admin\AppData\Local\Temp\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202l.exe
Size 232KB
SHA256 3cc987171ad74c2f061e930880f77ccd8ad8ea6a1da4a4758e1f339aa0e6b77c
MD5 6bd1fef94d0bb5153e47f48ff370e0d2
SHA1 9d5b25685ea011af8299a2954524d956070ee8eb
SHA512 0a92aaa4cace5f7e1b99615e42c7bd43e8aae68ce59e12dc19205f268832e44adfccc6dde6860b17e2de83f5e168792af6e9d0bfbc4df8fe5283b681983815a2
SSDEEP 6144:9hbZ5hMTNFf8LAurlEzAX7o5hn8wVSZ2sXA6:vtXMzqrllX7618wO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-180-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/60-188-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/112-248-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/112-249-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/1080-147-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/1100-95-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/1100-87-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/1228-30-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/1228-38-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/1720-215-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/1720-219-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/1756-157-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/1972-67-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/2128-151-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/2128-161-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/2216-76-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/3056-236-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/3204-112-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/3564-49-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/3564-40-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/3840-123-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/3928-18-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/3928-10-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/3972-246-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4036-29-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4036-20-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4092-198-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4092-191-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4244-122-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4244-131-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4476-9-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4476-0-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4484-183-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4484-177-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4620-168-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4672-85-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4692-103-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4856-209-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4876-58-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4876-55-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4968-225-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

memory/4968-227-0x0000000000400000-0x000000000043AB3B-memory.dmp

Download

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202d.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202p.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202o.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202u.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202t.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202y.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202c.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202i.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202h.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202w.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202m.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202s.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202r.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202t.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202v.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202b.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202f.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202h.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202k.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202a.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202l.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202k.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202.exe\""	59c2bc9e023b75454aafc09f11cd3af4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202o.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202n.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202r.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202e.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202g.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202j.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202i.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202n.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202q.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202p.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202x.exe\""	59c2bc9e023b75454aafc09f11cd3af4_jaffacakes118_3202w.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads