Malware Analysis Report

2024-10-18 23:06

Sample ID 240726-v677eaxare
Target 750c43951edc0fddfa0268e37b60582a_JaffaCakes118
SHA256 18ec9b34c321f9f834a2c102ac50c181c6794fe50c8b141d32bf8674fdd1474b
Tags
discovery ardamax sality backdoor evasion keylogger persistence privilege_escalation stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

18ec9b34c321f9f834a2c102ac50c181c6794fe50c8b141d32bf8674fdd1474b

Threat Level: Known bad

The file 750c43951edc0fddfa0268e37b60582a_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

discovery ardamax sality backdoor evasion keylogger persistence privilege_escalation stealer trojan upx

Modifies WinLogon for persistence

Sality

Windows security bypass

Ardamax main executable

Ardamax

UAC bypass

Modifies Windows Firewall

Disables Task Manager via registry modification

Disables RegEdit via registry modification

Windows security modification

Executes dropped EXE

UPX packed file

Checks whether UAC is enabled

Checks installed software on the system

Enumerates connected drives

Adds Run key to start application

Drops file in System32 directory

AutoIT Executable

Drops file in Program Files directory

Drops file in Windows directory

Program crash

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

System policy modification

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-26 17:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-26 17:37

Reported

2024-07-26 21:54

Platform

win7-20240704-en

Max time kernel

140s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 192

Network

N/A

Files

memory/2708-0-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/2708-1-0x0000000000400000-0x00000000004CE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-26 17:37

Reported

2024-07-26 21:53

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

151s

Command Line

"fontdrvhost.exe"

Signatures

Ardamax

keylogger stealer ardamax

Ardamax main executable

Description Indicator Process Target
N/A N/A N/A N/A

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe regsvr.exe" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A

Disables Task Manager via registry modification

evasion

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\28463\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Msn Messsenger = "C:\\Windows\\system32\\regsvr.exe" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost Agent = "C:\\Windows\\SysWOW64\\28463\\svchost.exe" C:\Windows\SysWOW64\28463\svchost.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\a: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\b: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\28463\svchost.exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\28463\svchost.exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\regsvr.exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\setting.ini C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\SysWOW64\REGSVR.EXE C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\svchost .exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\28463\svchost.001 C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\28463\svchost.001 C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\regsvr.exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\28463 C:\Windows\SysWOW64\28463\svchost.exe N/A
File opened for modification C:\Windows\SysWOW64\28463 C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\svchost .exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\setup.ini C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\setting.ini C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\WINDOWS\SysWOW64\28463\SVCHOST.EXE C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File created C:\Windows\regsvr.exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\regsvr.exe C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\NOTEPAD.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\NOTEPAD.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\28463\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\28463\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3336 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3336 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3336 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 3336 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 3336 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3336 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 3336 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3336 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3336 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3336 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3336 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3336 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3336 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3336 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 3336 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3336 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3336 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3336 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 3336 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 3336 wrote to memory of 2476 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SysWOW64\netsh.exe
PID 3336 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SysWOW64\28463\svchost.exe
PID 3336 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SysWOW64\28463\svchost.exe
PID 3336 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SysWOW64\28463\svchost.exe
PID 3336 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3336 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3336 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4472 wrote to memory of 4920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 4472 wrote to memory of 4920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 4472 wrote to memory of 4920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 3336 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3336 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3336 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1476 wrote to memory of 4712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 1476 wrote to memory of 4712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 1476 wrote to memory of 4712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\at.exe
PID 3336 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3336 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3336 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 3336 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 3336 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3336 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 3336 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\Explorer.EXE
PID 3336 wrote to memory of 3700 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3336 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3336 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 3336 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3336 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 3336 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3336 wrote to memory of 1744 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 3336 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3336 wrote to memory of 4536 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3336 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\backgroundTaskHost.exe
PID 3336 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SysWOW64\28463\svchost.exe
PID 3336 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\SysWOW64\28463\svchost.exe
PID 3336 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3336 wrote to memory of 5060 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\System32\RuntimeBroker.exe
PID 3336 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\DllHost.exe
PID 3336 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3336 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\fontdrvhost.exe
PID 3336 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\dwm.exe
PID 3336 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\sihost.exe
PID 3336 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\svchost.exe
PID 3336 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\system32\taskhostw.exe
PID 3336 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\750c43951edc0fddfa0268e37b60582a_JaffaCakes118.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall set opmode disable

C:\Windows\SysWOW64\28463\svchost.exe

C:\Windows\system32\28463\svchost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /C AT /delete /yes

C:\Windows\SysWOW64\at.exe

AT /delete /yes

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe

C:\Windows\SysWOW64\at.exe

AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE"

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 yahoo.com udp
US 98.137.11.163:80 yahoo.com tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 98.137.11.163:443 yahoo.com tcp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 163.11.137.98.in-addr.arpa udp
US 8.8.8.8:53 www.yahoo.com udp
GB 87.248.114.12:443 www.yahoo.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 12.114.248.87.in-addr.arpa udp
GB 87.248.114.12:80 www.yahoo.com tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp

Files

memory/3336-0-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/3336-1-0x0000000003330000-0x0000000004363000-memory.dmp

memory/3336-3-0x0000000003330000-0x0000000004363000-memory.dmp

memory/3336-4-0x0000000003330000-0x0000000004363000-memory.dmp

memory/3336-9-0x0000000001760000-0x0000000001761000-memory.dmp

memory/3336-8-0x00000000001F0000-0x00000000001F2000-memory.dmp

C:\Windows\SysWOW64\svchost .exe

MD5 750c43951edc0fddfa0268e37b60582a
SHA1 5876e3d6c7e6186324e16b6ffa7f1b20e45ed549
SHA256 18ec9b34c321f9f834a2c102ac50c181c6794fe50c8b141d32bf8674fdd1474b
SHA512 6d9098e3fd5f2f54b241bc2d76d5f8a2eeb05c56ce8480ab2130f506683e78f7cfb6a14148244078f6aa27b4dcbe1ffe9b116adae3f453ead360a8788977729a

memory/3336-14-0x00000000001F0000-0x00000000001F2000-memory.dmp

memory/3336-13-0x0000000003330000-0x0000000004363000-memory.dmp

memory/3336-12-0x00000000001F0000-0x00000000001F2000-memory.dmp

C:\Windows\SysWOW64\28463\svchost.exe

MD5 0c7a714b8e1d2ead2afc90dcc43bbe18
SHA1 66736613f22771f5da5606ed8c80b572b3f5c103
SHA256 800bdf00e09f302a17e22d26dffbea037e3c077ef9f6d1d585c114f079397a9e
SHA512 35db0de86c168eb6302dcbaa1e1f9ec96b5a8814e7067e1a7bb682e9f35fc06c51148a08e6f7df1e8caeb2effde555c53966a8922e8fef6b7ce194dc81c984b4

C:\Windows\SysWOW64\28463\svchost.001

MD5 c427f41a9eb12166c278da8fed8a0c4a
SHA1 e0e1d1c8f6b58675a544f1461997cfc37a2e6c63
SHA256 ee74d1ba7e74e916f57ac4134aa5aa6eb7f920e7dae3b4cdb75af9225da616c6
SHA512 ea2e49983e04afaa0eec5b28eeed1e9c804326b49933e69962805c10a405cb7dd87061e50355f395e74107cb6ca674d4c8c0000ef13505ec58b1d7dec873aa85

memory/1368-35-0x0000000002330000-0x0000000002331000-memory.dmp

memory/3336-36-0x0000000003330000-0x0000000004363000-memory.dmp

memory/3336-38-0x0000000003330000-0x0000000004363000-memory.dmp

C:\Windows\SysWOW64\setup.ini

MD5 9ece103c47335f0cc777f1132b8d522f
SHA1 63afa171c64f86d99db81723e1335e960e85fa43
SHA256 69815d4932ddde240ce6b1353305d2fab58ca402e9c478452c8e37ce8a7b2ac9
SHA512 b1ac64c71c6338bf0ab33df938128822da680f20d0552edb2edb808f1c75bafb88467412fc8dc60ed8022a1f0c4f3fcbecb69a320ec871b3a766482f32d6eb05

C:\Windows\SysWOW64\setting.ini

MD5 e0aa021e21dddbd6d8cecec71e9cf564
SHA1 9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
SHA256 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
SHA512 900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874

memory/1368-82-0x0000000004030000-0x0000000004031000-memory.dmp

memory/1368-83-0x00000000023D0000-0x00000000023D2000-memory.dmp

memory/3336-84-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/3336-85-0x0000000003330000-0x0000000004363000-memory.dmp

memory/3336-90-0x0000000003330000-0x0000000004363000-memory.dmp

memory/3336-94-0x0000000003330000-0x0000000004363000-memory.dmp

memory/3336-105-0x0000000003330000-0x0000000004363000-memory.dmp

memory/3336-112-0x0000000000400000-0x00000000004CE000-memory.dmp

memory/3336-117-0x00000000001F0000-0x00000000001F2000-memory.dmp

memory/1368-127-0x0000000002330000-0x0000000002331000-memory.dmp