Analysis
-
max time kernel
28s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 07:24
Static task
static1
Behavioral task
behavioral1
Sample
5f8e6d96614b4f1473f899fb123d3c0a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5f8e6d96614b4f1473f899fb123d3c0a_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5f8e6d96614b4f1473f899fb123d3c0a_JaffaCakes118.exe
-
Size
18KB
-
MD5
5f8e6d96614b4f1473f899fb123d3c0a
-
SHA1
0bffd748926c735ae5bcd70a8dcead93afb7253f
-
SHA256
72c751f5975a56485812f433510398a83072272e0a35b2da76ebd282fdc8ac61
-
SHA512
88932c6df10cc6cb4dcfa953a4509d159b8e236e580f9fb60d8a4e9cb531bd9f54857ab45113273436271fc7e3220950877ec7f185378329fd35b6786f2d211a
-
SSDEEP
384:MBmv+1Aw+E16JBLlVG3kYrlk+bZX0VT0+RPOOZpEjGVLx1mxznEySDCD:erv6Lq3kYrnbZX0hptO4qjGVgznELDg
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2772 cmd.exe -
Executes dropped EXE 64 IoCs
pid Process 2680 itunes.exe 2808 itunes.exe 1776 itunes.exe 868 itunes.exe 2876 itunes.exe 2936 itunes.exe 1892 itunes.exe 2384 itunes.exe 408 itunes.exe 952 itunes.exe 1140 itunes.exe 2468 itunes.exe 1000 itunes.exe 880 itunes.exe 1512 itunes.exe 2800 itunes.exe 2684 itunes.exe 2388 itunes.exe 2188 itunes.exe 2668 itunes.exe 1388 itunes.exe 2316 itunes.exe 3024 itunes.exe 2228 itunes.exe 1900 itunes.exe 1684 itunes.exe 1396 itunes.exe 1232 itunes.exe 1624 itunes.exe 884 itunes.exe 1096 itunes.exe 2940 itunes.exe 2968 itunes.exe 1708 itunes.exe 2688 itunes.exe 348 itunes.exe 536 itunes.exe 3036 itunes.exe 2544 itunes.exe 3028 itunes.exe 1732 itunes.exe 2060 itunes.exe 1856 itunes.exe 888 itunes.exe 1852 itunes.exe 2720 itunes.exe 2704 itunes.exe 860 itunes.exe 2872 itunes.exe 2948 itunes.exe 308 itunes.exe 2188 itunes.exe 2028 itunes.exe 1788 itunes.exe 2544 itunes.exe 2440 itunes.exe 1740 itunes.exe 3052 itunes.exe 1832 itunes.exe 624 itunes.exe 2032 itunes.exe 2776 itunes.exe 2768 itunes.exe 2612 itunes.exe -
Loads dropped DLL 64 IoCs
pid Process 2756 5f8e6d96614b4f1473f899fb123d3c0a_JaffaCakes118.exe 2756 5f8e6d96614b4f1473f899fb123d3c0a_JaffaCakes118.exe 2680 itunes.exe 2680 itunes.exe 2808 itunes.exe 2808 itunes.exe 1776 itunes.exe 1776 itunes.exe 868 itunes.exe 868 itunes.exe 2876 itunes.exe 2876 itunes.exe 2936 itunes.exe 2936 itunes.exe 1892 itunes.exe 1892 itunes.exe 2384 itunes.exe 2384 itunes.exe 408 itunes.exe 408 itunes.exe 952 itunes.exe 952 itunes.exe 1140 itunes.exe 1140 itunes.exe 2468 itunes.exe 2468 itunes.exe 1000 itunes.exe 1000 itunes.exe 880 itunes.exe 880 itunes.exe 1512 itunes.exe 1512 itunes.exe 2800 itunes.exe 2800 itunes.exe 2684 itunes.exe 2684 itunes.exe 2388 itunes.exe 2388 itunes.exe 2188 itunes.exe 2188 itunes.exe 2668 itunes.exe 2668 itunes.exe 1388 itunes.exe 1388 itunes.exe 2316 itunes.exe 2316 itunes.exe 3024 itunes.exe 3024 itunes.exe 2228 itunes.exe 2228 itunes.exe 1900 itunes.exe 1900 itunes.exe 1684 itunes.exe 1684 itunes.exe 1396 itunes.exe 1396 itunes.exe 1232 itunes.exe 1232 itunes.exe 1624 itunes.exe 1624 itunes.exe 884 itunes.exe 884 itunes.exe 1096 itunes.exe 1096 itunes.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Itunes Player = "itunes.exe" itunes.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe 5f8e6d96614b4f1473f899fb123d3c0a_JaffaCakes118.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File created C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe File opened for modification C:\Windows\SysWOW64\itunes.exe itunes.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2756 5f8e6d96614b4f1473f899fb123d3c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2680 itunes.exe Token: SeIncBasePriorityPrivilege 2808 itunes.exe Token: SeIncBasePriorityPrivilege 1776 itunes.exe Token: SeIncBasePriorityPrivilege 868 itunes.exe Token: SeIncBasePriorityPrivilege 2876 itunes.exe Token: SeIncBasePriorityPrivilege 2936 itunes.exe Token: SeIncBasePriorityPrivilege 1892 itunes.exe Token: SeIncBasePriorityPrivilege 2384 itunes.exe Token: SeIncBasePriorityPrivilege 408 itunes.exe Token: SeIncBasePriorityPrivilege 952 itunes.exe Token: SeIncBasePriorityPrivilege 1140 itunes.exe Token: SeIncBasePriorityPrivilege 2468 itunes.exe Token: SeIncBasePriorityPrivilege 1000 itunes.exe Token: SeIncBasePriorityPrivilege 880 itunes.exe Token: SeIncBasePriorityPrivilege 1512 itunes.exe Token: SeIncBasePriorityPrivilege 2800 itunes.exe Token: SeIncBasePriorityPrivilege 2684 itunes.exe Token: SeIncBasePriorityPrivilege 2388 itunes.exe Token: SeIncBasePriorityPrivilege 2188 itunes.exe Token: SeIncBasePriorityPrivilege 2668 itunes.exe Token: SeIncBasePriorityPrivilege 1388 itunes.exe Token: SeIncBasePriorityPrivilege 2316 itunes.exe Token: SeIncBasePriorityPrivilege 3024 itunes.exe Token: SeIncBasePriorityPrivilege 2228 itunes.exe Token: SeIncBasePriorityPrivilege 1900 itunes.exe Token: SeIncBasePriorityPrivilege 1684 itunes.exe Token: SeIncBasePriorityPrivilege 1396 itunes.exe Token: SeIncBasePriorityPrivilege 1232 itunes.exe Token: SeIncBasePriorityPrivilege 1624 itunes.exe Token: SeIncBasePriorityPrivilege 884 itunes.exe Token: SeIncBasePriorityPrivilege 1096 itunes.exe Token: SeIncBasePriorityPrivilege 2940 itunes.exe Token: SeIncBasePriorityPrivilege 2968 itunes.exe Token: SeIncBasePriorityPrivilege 1708 itunes.exe Token: SeIncBasePriorityPrivilege 2688 itunes.exe Token: SeIncBasePriorityPrivilege 348 itunes.exe Token: SeIncBasePriorityPrivilege 536 itunes.exe Token: SeIncBasePriorityPrivilege 3036 itunes.exe Token: SeIncBasePriorityPrivilege 2544 itunes.exe Token: SeIncBasePriorityPrivilege 3028 itunes.exe Token: SeIncBasePriorityPrivilege 1732 itunes.exe Token: SeIncBasePriorityPrivilege 2060 itunes.exe Token: SeIncBasePriorityPrivilege 1856 itunes.exe Token: SeIncBasePriorityPrivilege 888 itunes.exe Token: SeIncBasePriorityPrivilege 1852 itunes.exe Token: SeIncBasePriorityPrivilege 2720 itunes.exe Token: SeIncBasePriorityPrivilege 2704 itunes.exe Token: SeIncBasePriorityPrivilege 860 itunes.exe Token: SeIncBasePriorityPrivilege 2872 itunes.exe Token: SeIncBasePriorityPrivilege 2948 itunes.exe Token: SeIncBasePriorityPrivilege 308 itunes.exe Token: SeIncBasePriorityPrivilege 2188 itunes.exe Token: SeIncBasePriorityPrivilege 2028 itunes.exe Token: SeIncBasePriorityPrivilege 1788 itunes.exe Token: SeIncBasePriorityPrivilege 2544 itunes.exe Token: SeIncBasePriorityPrivilege 2440 itunes.exe Token: SeIncBasePriorityPrivilege 1740 itunes.exe Token: SeIncBasePriorityPrivilege 3052 itunes.exe Token: SeIncBasePriorityPrivilege 1832 itunes.exe Token: SeIncBasePriorityPrivilege 624 itunes.exe Token: SeIncBasePriorityPrivilege 2032 itunes.exe Token: SeIncBasePriorityPrivilege 2776 itunes.exe Token: SeIncBasePriorityPrivilege 2768 itunes.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2680 2756 5f8e6d96614b4f1473f899fb123d3c0a_JaffaCakes118.exe 31 PID 2756 wrote to memory of 2680 2756 5f8e6d96614b4f1473f899fb123d3c0a_JaffaCakes118.exe 31 PID 2756 wrote to memory of 2680 2756 5f8e6d96614b4f1473f899fb123d3c0a_JaffaCakes118.exe 31 PID 2756 wrote to memory of 2680 2756 5f8e6d96614b4f1473f899fb123d3c0a_JaffaCakes118.exe 31 PID 2756 wrote to memory of 2772 2756 5f8e6d96614b4f1473f899fb123d3c0a_JaffaCakes118.exe 32 PID 2756 wrote to memory of 2772 2756 5f8e6d96614b4f1473f899fb123d3c0a_JaffaCakes118.exe 32 PID 2756 wrote to memory of 2772 2756 5f8e6d96614b4f1473f899fb123d3c0a_JaffaCakes118.exe 32 PID 2756 wrote to memory of 2772 2756 5f8e6d96614b4f1473f899fb123d3c0a_JaffaCakes118.exe 32 PID 2680 wrote to memory of 2808 2680 itunes.exe 34 PID 2680 wrote to memory of 2808 2680 itunes.exe 34 PID 2680 wrote to memory of 2808 2680 itunes.exe 34 PID 2680 wrote to memory of 2808 2680 itunes.exe 34 PID 2680 wrote to memory of 2608 2680 itunes.exe 35 PID 2680 wrote to memory of 2608 2680 itunes.exe 35 PID 2680 wrote to memory of 2608 2680 itunes.exe 35 PID 2680 wrote to memory of 2608 2680 itunes.exe 35 PID 2808 wrote to memory of 1776 2808 itunes.exe 37 PID 2808 wrote to memory of 1776 2808 itunes.exe 37 PID 2808 wrote to memory of 1776 2808 itunes.exe 37 PID 2808 wrote to memory of 1776 2808 itunes.exe 37 PID 2808 wrote to memory of 2952 2808 itunes.exe 38 PID 2808 wrote to memory of 2952 2808 itunes.exe 38 PID 2808 wrote to memory of 2952 2808 itunes.exe 38 PID 2808 wrote to memory of 2952 2808 itunes.exe 38 PID 1776 wrote to memory of 868 1776 itunes.exe 40 PID 1776 wrote to memory of 868 1776 itunes.exe 40 PID 1776 wrote to memory of 868 1776 itunes.exe 40 PID 1776 wrote to memory of 868 1776 itunes.exe 40 PID 1776 wrote to memory of 2632 1776 itunes.exe 41 PID 1776 wrote to memory of 2632 1776 itunes.exe 41 PID 1776 wrote to memory of 2632 1776 itunes.exe 41 PID 1776 wrote to memory of 2632 1776 itunes.exe 41 PID 868 wrote to memory of 2876 868 itunes.exe 43 PID 868 wrote to memory of 2876 868 itunes.exe 43 PID 868 wrote to memory of 2876 868 itunes.exe 43 PID 868 wrote to memory of 2876 868 itunes.exe 43 PID 868 wrote to memory of 2300 868 itunes.exe 44 PID 868 wrote to memory of 2300 868 itunes.exe 44 PID 868 wrote to memory of 2300 868 itunes.exe 44 PID 868 wrote to memory of 2300 868 itunes.exe 44 PID 2876 wrote to memory of 2936 2876 itunes.exe 46 PID 2876 wrote to memory of 2936 2876 itunes.exe 46 PID 2876 wrote to memory of 2936 2876 itunes.exe 46 PID 2876 wrote to memory of 2936 2876 itunes.exe 46 PID 2876 wrote to memory of 1928 2876 itunes.exe 47 PID 2876 wrote to memory of 1928 2876 itunes.exe 47 PID 2876 wrote to memory of 1928 2876 itunes.exe 47 PID 2876 wrote to memory of 1928 2876 itunes.exe 47 PID 2936 wrote to memory of 1892 2936 itunes.exe 48 PID 2936 wrote to memory of 1892 2936 itunes.exe 48 PID 2936 wrote to memory of 1892 2936 itunes.exe 48 PID 2936 wrote to memory of 1892 2936 itunes.exe 48 PID 2936 wrote to memory of 2116 2936 itunes.exe 50 PID 2936 wrote to memory of 2116 2936 itunes.exe 50 PID 2936 wrote to memory of 2116 2936 itunes.exe 50 PID 2936 wrote to memory of 2116 2936 itunes.exe 50 PID 1892 wrote to memory of 2384 1892 itunes.exe 52 PID 1892 wrote to memory of 2384 1892 itunes.exe 52 PID 1892 wrote to memory of 2384 1892 itunes.exe 52 PID 1892 wrote to memory of 2384 1892 itunes.exe 52 PID 1892 wrote to memory of 2932 1892 itunes.exe 53 PID 1892 wrote to memory of 2932 1892 itunes.exe 53 PID 1892 wrote to memory of 2932 1892 itunes.exe 53 PID 1892 wrote to memory of 2932 1892 itunes.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f8e6d96614b4f1473f899fb123d3c0a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5f8e6d96614b4f1473f899fb123d3c0a_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2384 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:408 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:952 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1140 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2468 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1000 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:880 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1512 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2800 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2684 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2388 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2188 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2668 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1388 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2316 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3024 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"25⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2228 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1900 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1684 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1396 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1232 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1624 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:884 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1096 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"33⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2940 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2968 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1708 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2688 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:348 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"38⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:536 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3036 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2544 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3028 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1732 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2060 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"44⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1856 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:888 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"46⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1852 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2720 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"48⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2704 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:860 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2872 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2948 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"52⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:308 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2188 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2028 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1788 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2544 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2440 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"58⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1740 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3052 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"60⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1832 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:624 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"62⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2032 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"63⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2776 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"64⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2768 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"65⤵
- Executes dropped EXE
PID:2612 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"66⤵PID:2968
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"67⤵PID:2868
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"68⤵PID:2688
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"69⤵PID:2392
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"70⤵PID:2088
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"71⤵PID:540
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"72⤵
- Drops file in System32 directory
PID:2448 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"73⤵PID:1732
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"74⤵
- Adds Run key to start application
PID:2468 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"75⤵
- Adds Run key to start application
PID:2476 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"76⤵PID:2292
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"77⤵PID:624
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"78⤵PID:3012
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"79⤵PID:2680
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"80⤵PID:2776
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"81⤵
- Adds Run key to start application
PID:1640 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"82⤵PID:868
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"83⤵
- Drops file in System32 directory
PID:2948 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"84⤵PID:2632
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"85⤵PID:1260
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"86⤵PID:1988
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"87⤵
- Drops file in System32 directory
PID:1176 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"88⤵
- Drops file in System32 directory
PID:832 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"89⤵PID:2448
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"90⤵
- Drops file in System32 directory
PID:1740 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"91⤵
- Drops file in System32 directory
PID:2520 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"92⤵PID:1676
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"93⤵PID:2924
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"94⤵PID:624
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"95⤵PID:1776
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"96⤵PID:2916
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"97⤵PID:2780
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"98⤵PID:2324
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"99⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1420 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"100⤵PID:2244
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"101⤵
- Adds Run key to start application
PID:2228 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"102⤵PID:1892
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"103⤵PID:2536
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"104⤵PID:2448
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"105⤵
- Adds Run key to start application
PID:2200 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"106⤵PID:1604
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"107⤵
- Drops file in System32 directory
PID:1416 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"108⤵PID:1508
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"109⤵
- Adds Run key to start application
PID:2604 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"110⤵PID:1928
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"111⤵
- Adds Run key to start application
PID:2400 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"112⤵PID:1856
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"113⤵PID:1936
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"114⤵PID:2664
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"115⤵PID:2988
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"116⤵PID:1632
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"117⤵
- Adds Run key to start application
PID:1664 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"118⤵
- Adds Run key to start application
PID:752 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"119⤵PID:1684
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"120⤵
- Adds Run key to start application
PID:1688 -
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"121⤵PID:2952
-
C:\Windows\SysWOW64\itunes.exe"C:\Windows\system32\itunes.exe"122⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-