pid	Process
2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe
2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe

resource	yara_rule
behavioral1/memory/2904-34-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2904-36-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2904-26-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2904-30-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2904-38-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2904-24-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2904-40-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2904-41-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2904-39-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2904-43-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2904-42-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2904-52-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2904-57-0x0000000000400000-0x00000000004BA000-memory.dmp	upx

description	pid	Process
Token: SeDebugPrivilege	2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2904	svhost.exe
Token: SeSecurityPrivilege	2904	svhost.exe
Token: SeTakeOwnershipPrivilege	2904	svhost.exe
Token: SeLoadDriverPrivilege	2904	svhost.exe
Token: SeSystemProfilePrivilege	2904	svhost.exe
Token: SeSystemtimePrivilege	2904	svhost.exe
Token: SeProfSingleProcessPrivilege	2904	svhost.exe
Token: SeIncBasePriorityPrivilege	2904	svhost.exe
Token: SeCreatePagefilePrivilege	2904	svhost.exe
Token: SeBackupPrivilege	2904	svhost.exe
Token: SeRestorePrivilege	2904	svhost.exe
Token: SeShutdownPrivilege	2904	svhost.exe
Token: SeDebugPrivilege	2904	svhost.exe
Token: SeSystemEnvironmentPrivilege	2904	svhost.exe
Token: SeChangeNotifyPrivilege	2904	svhost.exe
Token: SeRemoteShutdownPrivilege	2904	svhost.exe
Token: SeUndockPrivilege	2904	svhost.exe
Token: SeManageVolumePrivilege	2904	svhost.exe
Token: SeImpersonatePrivilege	2904	svhost.exe
Token: SeCreateGlobalPrivilege	2904	svhost.exe
Token: 33	2904	svhost.exe
Token: 34	2904	svhost.exe
Token: 35	2904	svhost.exe

description	pid	Process	procid_target
PID 2240 wrote to memory of 2680	2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2680	2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2680	2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2680	2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2904	2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe	33
PID 2240 wrote to memory of 2904	2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe	33
PID 2240 wrote to memory of 2904	2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe	33
PID 2240 wrote to memory of 2904	2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe	33
PID 2680 wrote to memory of 2200	2680	cmd.exe	32
PID 2680 wrote to memory of 2200	2680	cmd.exe	32
PID 2680 wrote to memory of 2200	2680	cmd.exe	32
PID 2680 wrote to memory of 2200	2680	cmd.exe	32
PID 2240 wrote to memory of 2904	2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe	33
PID 2240 wrote to memory of 2904	2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe	33
PID 2240 wrote to memory of 2904	2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe	33
PID 2240 wrote to memory of 2904	2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe	33
PID 2240 wrote to memory of 2724	2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe	34
PID 2240 wrote to memory of 2724	2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe	34
PID 2240 wrote to memory of 2724	2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe	34
PID 2240 wrote to memory of 2724	2240	67abc4d8511bef88b5cd7b5884951bf5_JaffaCakes118.exe	34
PID 2200 wrote to memory of 1688	2200	wscript.exe	35
PID 2200 wrote to memory of 1688	2200	wscript.exe	35
PID 2200 wrote to memory of 1688	2200	wscript.exe	35
PID 2200 wrote to memory of 1688	2200	wscript.exe	35

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.