Analysis
-
max time kernel
40s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 18:45
Behavioral task
behavioral1
Sample
7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
22 signatures
150 seconds
General
-
Target
7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe
-
Size
171KB
-
MD5
7544d64ca2ddfbd3650ceb2ea0942c43
-
SHA1
dfb8791a5ecab52beb2c800df416837adf40f334
-
SHA256
5db59eed776246fc75ceab615fdfc20ab11472ffb4d4fd5edd3bcc24c64e223a
-
SHA512
6ac0297caca4328249840593a8054a383cef7bfcf3c78c5d9faeb777feece5c7e540220d9ba51960de5db3e292b493422ebd2379be77b580e896da6de4ad1145
-
SSDEEP
1536:9ybiCx1bCV1LCHLWcB099lSaRO3SzQgEe6dmtq:9M3qIWcqbR+Scgf
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" zmxfh.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" zmxfh.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" zmxfh.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zmxfh.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" zmxfh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" zmxfh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" zmxfh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" zmxfh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" zmxfh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" zmxfh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" zmxfh.exe -
Disables Task Manager via registry modification
-
Deletes itself 1 IoCs
pid Process 11388 zmxfh.exe -
Executes dropped EXE 64 IoCs
pid Process 2776 atjpas.exe 2628 drmmrjzp.exe 2972 ducxbboj.exe 2852 ogjsh.exe 576 ctqyvedy.exe 1556 xnxonec.exe 580 ascqnrco.exe 1996 hlmrpgo.exe 2176 jxqvdd.exe 1616 wwmcenew.exe 1720 ruagu.exe 1112 wwrks.exe 828 bbazx.exe 2440 mjuesx.exe 1472 nmfvqihn.exe 876 frkhyxl.exe 636 ozyrjmo.exe 1988 kqhgeaz.exe 2988 zombri.exe 1904 bjnxd.exe 888 hejjtku.exe 2424 chjrzhpw.exe 2752 ihoft.exe 2732 eutfw.exe 2740 xtuipdi.exe 2608 kvlkd.exe 2856 ezidgoex.exe 1660 dlnwp.exe 1500 vgwju.exe 340 epgxzf.exe 760 sceomydf.exe 2544 dahlop.exe 2172 lapeqv.exe 2032 zgwts.exe 1788 zyizcr.exe 1944 sekfaub.exe 1404 bkmfr.exe 900 lylst.exe 1300 rmuoh.exe 1700 ktsccu.exe 1696 cohkr.exe 2412 xanhv.exe 2464 wijcl.exe 2892 rajznfsn.exe 2860 dgvqljb.exe 3876 nwjnpln.exe 1408 ypblng.exe 2756 qldauz.exe 2456 zgxagx.exe 808 bdwsfrlj.exe 2204 nueqrrqh.exe 1844 ashhsd.exe 1640 dqtjkj.exe 2640 yxgpwpp.exe 2768 rjddjyne.exe 3112 ujtejpz.exe 3172 jxwzpdx.exe 3256 znuenzko.exe 3320 jjznr.exe 3388 fbstld.exe 3460 soviqf.exe 3524 zbpxcq.exe 3588 ergyogdg.exe 3656 qpinlu.exe -
Loads dropped DLL 64 IoCs
pid Process 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2776 atjpas.exe 2776 atjpas.exe 2628 drmmrjzp.exe 2628 drmmrjzp.exe 2972 ducxbboj.exe 2972 ducxbboj.exe 2852 ogjsh.exe 2852 ogjsh.exe 576 ctqyvedy.exe 576 ctqyvedy.exe 1556 xnxonec.exe 1556 xnxonec.exe 580 ascqnrco.exe 580 ascqnrco.exe 1996 hlmrpgo.exe 1996 hlmrpgo.exe 2176 jxqvdd.exe 2176 jxqvdd.exe 1616 wwmcenew.exe 1616 wwmcenew.exe 1720 ruagu.exe 1720 ruagu.exe 1112 wwrks.exe 1112 wwrks.exe 828 bbazx.exe 828 bbazx.exe 2440 mjuesx.exe 2440 mjuesx.exe 1472 nmfvqihn.exe 1472 nmfvqihn.exe 876 frkhyxl.exe 876 frkhyxl.exe 636 ozyrjmo.exe 636 ozyrjmo.exe 1988 kqhgeaz.exe 1988 kqhgeaz.exe 2988 zombri.exe 2988 zombri.exe 1904 bjnxd.exe 1904 bjnxd.exe 888 hejjtku.exe 888 hejjtku.exe 2424 chjrzhpw.exe 2424 chjrzhpw.exe 2752 ihoft.exe 2752 ihoft.exe 2732 eutfw.exe 2732 eutfw.exe 2740 xtuipdi.exe 2740 xtuipdi.exe 2608 kvlkd.exe 2608 kvlkd.exe 2856 ezidgoex.exe 2856 ezidgoex.exe 1660 dlnwp.exe 1660 dlnwp.exe 1500 vgwju.exe 1500 vgwju.exe 340 epgxzf.exe 340 epgxzf.exe 760 sceomydf.exe 760 sceomydf.exe -
resource yara_rule behavioral1/memory/2668-0-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/files/0x000a0000000120fa-3.dat upx behavioral1/memory/2668-16-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2628-50-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2668-59-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2972-64-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2668-62-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2668-63-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2852-75-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2668-13-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2668-11-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2776-18-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2668-14-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2668-12-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/576-85-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2668-86-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2668-87-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2668-10-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/1556-100-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2668-98-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2668-97-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/580-112-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2776-111-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2176-135-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2628-134-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2668-136-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2668-137-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/1616-147-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/876-214-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/1988-229-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/1904-243-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/1616-242-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/888-250-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2424-257-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/1112-256-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/1720-249-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2988-236-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2752-264-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2732-272-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2440-270-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/828-263-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2176-235-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/1996-223-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/580-213-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2668-273-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/1472-279-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/1472-202-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/1556-201-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2440-191-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/828-181-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/576-180-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/1112-169-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2852-168-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/1720-158-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2972-157-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2608-289-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/876-286-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/636-292-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/2856-298-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/1988-297-0x0000000031420000-0x000000003143B000-memory.dmp upx behavioral1/memory/636-296-0x0000000000240000-0x000000000025B000-memory.dmp upx behavioral1/memory/2668-280-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2668-299-0x0000000001DA0000-0x0000000002E2E000-memory.dmp upx behavioral1/memory/2988-302-0x0000000031420000-0x000000003143B000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" zmxfh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" zmxfh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" zmxfh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" zmxfh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc zmxfh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" zmxfh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" zmxfh.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\oagjuckc.exe" lffebzgu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\qqecv.exe" rnyxhubd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\lkyyzbhm.exe" dsbvofsf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\zhtgqe.exe" qtyki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\vjvukd.exe" ghyrkzc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\nrevctl.exe" eodtt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\yhljh.exe" vhzrnys.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\wijcl.exe" xanhv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\brprlv.exe" dclszchv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\lfedif.exe" kjruizcu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\cyomrkcl.exe" zwnuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\rouhdwe.exe" rhgoqqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ribrfja.exe" rjfqs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\bdwsfrlj.exe" zgxagx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\oddpse.exe" vjvukd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\fckmvd.exe" eqjebcy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\vqtibne.exe" rouhdwe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\jbrdu.exe" ckwbsxce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\bbazx.exe" wwrks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\wllmpuw.exe" cczzzvg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\hclez.exe" lfedif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\khekagll.exe" cwmtsti.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\xgazsi.exe" hemoshg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\lywtd.exe" ymjwbzdx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\rgrixi.exe" ivwjdplv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\epgxzf.exe" vgwju.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\gxmutgy.exe" kajkjzo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ohmvli.exe" svtsxwyn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\dsbvofsf.exe" ckdkcxo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ffqmgkc.exe" dejesnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\esipiz.exe" nvdvrd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\hfkvbri.exe" fmqlal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\rtxefdkq.exe" yueokp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ywerwba.exe" trqggbpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\wklrdzel.exe" ksdut.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\zwnuk.exe" tkshoqp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\jiasxf.exe" hqcsxz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ktcyq.exe" zunnjpe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\pkrmkggn.exe" rcqnatul.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\xqmms.exe" xuatlth.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\vayqbzp.exe" bepivwgx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\mxvrstj.exe" mszhtv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\haganxv.exe" hkcjjsri.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\qbtiovi.exe" hdbgmu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\wrtpb.exe" csztowsi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\tnnin.exe" yeqmwk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\vdqdyj.exe" bcooltv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\rnjhqihg.exe" vdqdyj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\bszmhdap.exe" gcrwkyt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\qqcoj.exe" ycuikb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\vwsod.exe" tdaprxk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ksdut.exe" lkyyzbhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\dolbl.exe" labso.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\sajowmwd.exe" nanitf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ycoded.exe" svlckwxo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\fujbemlx.exe" frtyo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\bjoghg.exe" wcucry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\ypblng.exe" nwjnpln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\jlmqh.exe" leypbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\scmjwrrq.exe" acmqjqfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\yxncdhv.exe" zjxfjua.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\fiyazvs.exe" qnmdtz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\lzbxm.exe" zdsjhag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cryptographic Service = "C:\\Windows\\system32\\nmfvqihn.exe" mjuesx.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zmxfh.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\S: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\T: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\V: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\X: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\H: zmxfh.exe File opened (read-only) \??\K: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\P: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\Q: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\R: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\W: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\G: zmxfh.exe File opened (read-only) \??\E: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\H: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\L: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\N: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\O: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\Y: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\G: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\I: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\M: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\U: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\Z: 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe File opened (read-only) \??\E: zmxfh.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\pkrmkggn.exe rcqnatul.exe File created C:\Windows\SysWOW64\cyomrkcl.exe zwnuk.exe File opened for modification C:\Windows\SysWOW64\vqgdfzg.exe comgepl.exe File opened for modification C:\Windows\SysWOW64\xtuipdi.exe eutfw.exe File created C:\Windows\SysWOW64\eugtlgfh.exe jlmqh.exe File created C:\Windows\SysWOW64\mvlxqnwa.exe eidlvszp.exe File opened for modification C:\Windows\SysWOW64\xqmms.exe xuatlth.exe File created C:\Windows\SysWOW64\cbfzbx.exe sjvkucej.exe File opened for modification C:\Windows\SysWOW64\exnqqqlj.exe nyzuxwz.exe File created C:\Windows\SysWOW64\bntsjpet.exe vqgdfzg.exe File created C:\Windows\SysWOW64\sekfaub.exe zyizcr.exe File opened for modification C:\Windows\SysWOW64\dwlbtyfc.exe khtbk.exe File created C:\Windows\SysWOW64\zjxfjua.exe cdsua.exe File opened for modification C:\Windows\SysWOW64\dfuvf.exe jxytomeo.exe File created C:\Windows\SysWOW64\dahlop.exe sceomydf.exe File created C:\Windows\SysWOW64\fiyazvs.exe qnmdtz.exe File opened for modification C:\Windows\SysWOW64\fujbemlx.exe frtyo.exe File opened for modification C:\Windows\SysWOW64\lffebzgu.exe eqmjdt.exe File created C:\Windows\SysWOW64\oagjuckc.exe lffebzgu.exe File opened for modification C:\Windows\SysWOW64\ezevpq.exe myrgwzb.exe File opened for modification C:\Windows\SysWOW64\sekazyi.exe xpkem.exe File opened for modification C:\Windows\SysWOW64\rmuoh.exe lylst.exe File opened for modification C:\Windows\SysWOW64\kajkjzo.exe defvki.exe File created C:\Windows\SysWOW64\gxmutgy.exe kajkjzo.exe File created C:\Windows\SysWOW64\lfnpg.exe wpfuma.exe File created C:\Windows\SysWOW64\ffqmgkc.exe dejesnn.exe File created C:\Windows\SysWOW64\hdbgmu.exe hljwxs.exe File created C:\Windows\SysWOW64\mijztra.exe bbtsvywr.exe File created C:\Windows\SysWOW64\wvipswu.exe xfjlyey.exe File created C:\Windows\SysWOW64\jqxazy.exe ywerwba.exe File opened for modification C:\Windows\SysWOW64\qqecv.exe rnyxhubd.exe File created C:\Windows\SysWOW64\xplmkaaz.exe nivtwi.exe File opened for modification C:\Windows\SysWOW64\acnyzus.exe wygsook.exe File created C:\Windows\SysWOW64\hevpjemt.exe zmmabhk.exe File opened for modification C:\Windows\SysWOW64\mccluea.exe ahoxc.exe File opened for modification C:\Windows\SysWOW64\ykktu.exe vqoax.exe File created C:\Windows\SysWOW64\ycoded.exe svlckwxo.exe File created C:\Windows\SysWOW64\ymjwbzdx.exe nqcdzgi.exe File created C:\Windows\SysWOW64\ivwjdplv.exe bcshu.exe File created C:\Windows\SysWOW64\tdjqn.exe euxotaz.exe File opened for modification C:\Windows\SysWOW64\uotmikbz.exe gxmutgy.exe File created C:\Windows\SysWOW64\gxihz.exe todrm.exe File opened for modification C:\Windows\SysWOW64\wphyqmso.exe qqope.exe File opened for modification C:\Windows\SysWOW64\rouhdwe.exe rhgoqqi.exe File created C:\Windows\SysWOW64\xfjlyey.exe amvltp.exe File opened for modification C:\Windows\SysWOW64\ffqmgkc.exe dejesnn.exe File opened for modification C:\Windows\SysWOW64\clzpxwr.exe zirrum.exe File created C:\Windows\SysWOW64\bgbjwu.exe ytznsrrw.exe File created C:\Windows\SysWOW64\csztowsi.exe kphlv.exe File created C:\Windows\SysWOW64\ogjsh.exe ducxbboj.exe File opened for modification C:\Windows\SysWOW64\tqhynlm.exe wukgmmgv.exe File opened for modification C:\Windows\SysWOW64\lgmvu.exe chnsoyfh.exe File opened for modification C:\Windows\SysWOW64\zjvsiav.exe pkrmkggn.exe File opened for modification C:\Windows\SysWOW64\mnggwv.exe hmbur.exe File created C:\Windows\SysWOW64\hljwxs.exe vmglynt.exe File created C:\Windows\SysWOW64\lfedif.exe kjruizcu.exe File created C:\Windows\SysWOW64\worjuv.exe jqvgb.exe File opened for modification C:\Windows\SysWOW64\vdqdyj.exe bcooltv.exe File opened for modification C:\Windows\SysWOW64\rhgwwt.exe pjjmhq.exe File opened for modification C:\Windows\SysWOW64\rcqnatul.exe lxmom.exe File created C:\Windows\SysWOW64\jmmyxftx.exe brihk.exe File opened for modification C:\Windows\SysWOW64\mkaeapoa.exe wqeeysaq.exe File created C:\Windows\SysWOW64\svlckwxo.exe niysoqr.exe File opened for modification C:\Windows\SysWOW64\exmte.exe yijlmk.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqhxbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jgzrhrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hqcsxz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ncsatzyf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ihoft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language soviqf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trqggbpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vqtibne.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfvnpm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sdlvsoao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vaahlpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qvdey.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dclszchv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fseynlos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdurugt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srbofvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wggms.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language epgxzf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ashhsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tzgzvzlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqeohbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language utfrbqbz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language euxotaz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uqbrcupi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfvrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wygsook.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language alucpsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qldauz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kqrmwl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ekmgy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxdehlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language elqwuzr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxaytcgu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qlwbxjq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uooevd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qfzvy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zmmabhk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zorpdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oaefao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbnpz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ujtejpz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rouhdwe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uiare.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ahoxc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vqoax.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hmbur.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qnvdvyrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eghpcb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bmiawuf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ccdvkkxi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jzeyib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wwrks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjznr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ksyutbqt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ydamozm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnnqk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csztowsi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnjhqihg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfsljwq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfjlyey.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language najnthvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vmglynt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uotmikbz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bcooltv.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe 11388 zmxfh.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Token: SeDebugPrivilege 2776 atjpas.exe Token: SeDebugPrivilege 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Token: SeDebugPrivilege 2628 drmmrjzp.exe Token: SeDebugPrivilege 2972 ducxbboj.exe Token: SeDebugPrivilege 2852 ogjsh.exe Token: SeDebugPrivilege 576 ctqyvedy.exe Token: SeDebugPrivilege 1556 xnxonec.exe Token: SeDebugPrivilege 580 ascqnrco.exe Token: SeDebugPrivilege 1996 hlmrpgo.exe Token: SeDebugPrivilege 2176 jxqvdd.exe Token: SeDebugPrivilege 1616 wwmcenew.exe Token: SeDebugPrivilege 1720 ruagu.exe Token: SeDebugPrivilege 1112 wwrks.exe Token: SeDebugPrivilege 828 bbazx.exe Token: SeDebugPrivilege 2440 mjuesx.exe Token: SeDebugPrivilege 1472 nmfvqihn.exe Token: SeDebugPrivilege 876 frkhyxl.exe Token: SeDebugPrivilege 636 ozyrjmo.exe Token: SeDebugPrivilege 1988 kqhgeaz.exe Token: SeDebugPrivilege 2988 zombri.exe Token: SeDebugPrivilege 1904 bjnxd.exe Token: SeDebugPrivilege 888 hejjtku.exe Token: SeDebugPrivilege 2424 chjrzhpw.exe Token: SeDebugPrivilege 2752 ihoft.exe Token: SeDebugPrivilege 2732 eutfw.exe Token: SeDebugPrivilege 2740 xtuipdi.exe Token: SeDebugPrivilege 2608 kvlkd.exe Token: SeDebugPrivilege 2856 ezidgoex.exe Token: SeDebugPrivilege 1660 dlnwp.exe Token: SeDebugPrivilege 1500 vgwju.exe Token: SeDebugPrivilege 340 epgxzf.exe Token: SeDebugPrivilege 760 sceomydf.exe Token: SeDebugPrivilege 2544 dahlop.exe Token: SeDebugPrivilege 2172 lapeqv.exe Token: SeDebugPrivilege 2032 zgwts.exe Token: SeDebugPrivilege 1788 zyizcr.exe Token: SeDebugPrivilege 1944 sekfaub.exe Token: SeDebugPrivilege 1404 bkmfr.exe Token: SeDebugPrivilege 900 lylst.exe Token: SeDebugPrivilege 1300 rmuoh.exe Token: SeDebugPrivilege 1700 ktsccu.exe Token: SeDebugPrivilege 1696 cohkr.exe Token: SeDebugPrivilege 2412 xanhv.exe Token: SeDebugPrivilege 2464 wijcl.exe Token: SeDebugPrivilege 2892 rajznfsn.exe Token: SeDebugPrivilege 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Token: SeDebugPrivilege 2860 dgvqljb.exe Token: SeDebugPrivilege 3876 nwjnpln.exe Token: SeDebugPrivilege 1408 ypblng.exe Token: SeDebugPrivilege 2756 qldauz.exe Token: SeDebugPrivilege 2456 zgxagx.exe Token: SeDebugPrivilege 808 bdwsfrlj.exe Token: SeDebugPrivilege 2204 nueqrrqh.exe Token: SeDebugPrivilege 1844 ashhsd.exe Token: SeDebugPrivilege 1640 dqtjkj.exe Token: SeDebugPrivilege 2640 yxgpwpp.exe Token: SeDebugPrivilege 2768 rjddjyne.exe Token: SeDebugPrivilege 3112 ujtejpz.exe Token: SeDebugPrivilege 3172 jxwzpdx.exe Token: SeDebugPrivilege 3256 znuenzko.exe Token: SeDebugPrivilege 3320 jjznr.exe Token: SeDebugPrivilege 3388 fbstld.exe Token: SeDebugPrivilege 3460 soviqf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2776 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 31 PID 2668 wrote to memory of 2776 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 31 PID 2668 wrote to memory of 2776 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 31 PID 2668 wrote to memory of 2776 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 31 PID 2668 wrote to memory of 1072 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 18 PID 2668 wrote to memory of 1080 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 19 PID 2668 wrote to memory of 1164 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 21 PID 2668 wrote to memory of 1272 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 23 PID 2668 wrote to memory of 2776 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 31 PID 2668 wrote to memory of 2776 2668 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe 31 PID 2776 wrote to memory of 2628 2776 atjpas.exe 32 PID 2776 wrote to memory of 2628 2776 atjpas.exe 32 PID 2776 wrote to memory of 2628 2776 atjpas.exe 32 PID 2776 wrote to memory of 2628 2776 atjpas.exe 32 PID 2628 wrote to memory of 2972 2628 drmmrjzp.exe 33 PID 2628 wrote to memory of 2972 2628 drmmrjzp.exe 33 PID 2628 wrote to memory of 2972 2628 drmmrjzp.exe 33 PID 2628 wrote to memory of 2972 2628 drmmrjzp.exe 33 PID 2972 wrote to memory of 2852 2972 ducxbboj.exe 34 PID 2972 wrote to memory of 2852 2972 ducxbboj.exe 34 PID 2972 wrote to memory of 2852 2972 ducxbboj.exe 34 PID 2972 wrote to memory of 2852 2972 ducxbboj.exe 34 PID 2852 wrote to memory of 576 2852 ogjsh.exe 35 PID 2852 wrote to memory of 576 2852 ogjsh.exe 35 PID 2852 wrote to memory of 576 2852 ogjsh.exe 35 PID 2852 wrote to memory of 576 2852 ogjsh.exe 35 PID 576 wrote to memory of 1556 576 ctqyvedy.exe 36 PID 576 wrote to memory of 1556 576 ctqyvedy.exe 36 PID 576 wrote to memory of 1556 576 ctqyvedy.exe 36 PID 576 wrote to memory of 1556 576 ctqyvedy.exe 36 PID 1556 wrote to memory of 580 1556 xnxonec.exe 37 PID 1556 wrote to memory of 580 1556 xnxonec.exe 37 PID 1556 wrote to memory of 580 1556 xnxonec.exe 37 PID 1556 wrote to memory of 580 1556 xnxonec.exe 37 PID 580 wrote to memory of 1996 580 ascqnrco.exe 38 PID 580 wrote to memory of 1996 580 ascqnrco.exe 38 PID 580 wrote to memory of 1996 580 ascqnrco.exe 38 PID 580 wrote to memory of 1996 580 ascqnrco.exe 38 PID 1996 wrote to memory of 2176 1996 hlmrpgo.exe 39 PID 1996 wrote to memory of 2176 1996 hlmrpgo.exe 39 PID 1996 wrote to memory of 2176 1996 hlmrpgo.exe 39 PID 1996 wrote to memory of 2176 1996 hlmrpgo.exe 39 PID 2176 wrote to memory of 1616 2176 jxqvdd.exe 40 PID 2176 wrote to memory of 1616 2176 jxqvdd.exe 40 PID 2176 wrote to memory of 1616 2176 jxqvdd.exe 40 PID 2176 wrote to memory of 1616 2176 jxqvdd.exe 40 PID 1616 wrote to memory of 1720 1616 wwmcenew.exe 41 PID 1616 wrote to memory of 1720 1616 wwmcenew.exe 41 PID 1616 wrote to memory of 1720 1616 wwmcenew.exe 41 PID 1616 wrote to memory of 1720 1616 wwmcenew.exe 41 PID 1720 wrote to memory of 1112 1720 ruagu.exe 42 PID 1720 wrote to memory of 1112 1720 ruagu.exe 42 PID 1720 wrote to memory of 1112 1720 ruagu.exe 42 PID 1720 wrote to memory of 1112 1720 ruagu.exe 42 PID 1112 wrote to memory of 828 1112 wwrks.exe 43 PID 1112 wrote to memory of 828 1112 wwrks.exe 43 PID 1112 wrote to memory of 828 1112 wwrks.exe 43 PID 1112 wrote to memory of 828 1112 wwrks.exe 43 PID 828 wrote to memory of 2440 828 bbazx.exe 44 PID 828 wrote to memory of 2440 828 bbazx.exe 44 PID 828 wrote to memory of 2440 828 bbazx.exe 44 PID 828 wrote to memory of 2440 828 bbazx.exe 44 PID 2440 wrote to memory of 1472 2440 mjuesx.exe 45 PID 2440 wrote to memory of 1472 2440 mjuesx.exe 45 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zmxfh.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1072
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1080
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7544d64ca2ddfbd3650ceb2ea0942c43_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2668 -
C:\Windows\SysWOW64\atjpas.exeC:\Windows\system32\atjpas.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\drmmrjzp.exeC:\Windows\system32\drmmrjzp.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\ducxbboj.exeC:\Windows\system32\ducxbboj.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\ogjsh.exeC:\Windows\system32\ogjsh.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\ctqyvedy.exeC:\Windows\system32\ctqyvedy.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\SysWOW64\xnxonec.exeC:\Windows\system32\xnxonec.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\ascqnrco.exeC:\Windows\system32\ascqnrco.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\hlmrpgo.exeC:\Windows\system32\hlmrpgo.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\jxqvdd.exeC:\Windows\system32\jxqvdd.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\wwmcenew.exeC:\Windows\system32\wwmcenew.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\ruagu.exeC:\Windows\system32\ruagu.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\wwrks.exeC:\Windows\system32\wwrks.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\bbazx.exeC:\Windows\system32\bbazx.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\mjuesx.exeC:\Windows\system32\mjuesx.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\nmfvqihn.exeC:\Windows\system32\nmfvqihn.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1472 -
C:\Windows\SysWOW64\frkhyxl.exeC:\Windows\system32\frkhyxl.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:876 -
C:\Windows\SysWOW64\ozyrjmo.exeC:\Windows\system32\ozyrjmo.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:636 -
C:\Windows\SysWOW64\kqhgeaz.exeC:\Windows\system32\kqhgeaz.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1988 -
C:\Windows\SysWOW64\zombri.exeC:\Windows\system32\zombri.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2988 -
C:\Windows\SysWOW64\bjnxd.exeC:\Windows\system32\bjnxd.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1904 -
C:\Windows\SysWOW64\hejjtku.exeC:\Windows\system32\hejjtku.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:888 -
C:\Windows\SysWOW64\chjrzhpw.exeC:\Windows\system32\chjrzhpw.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2424 -
C:\Windows\SysWOW64\ihoft.exeC:\Windows\system32\ihoft.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2752 -
C:\Windows\SysWOW64\eutfw.exeC:\Windows\system32\eutfw.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2732 -
C:\Windows\SysWOW64\xtuipdi.exeC:\Windows\system32\xtuipdi.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2740 -
C:\Windows\SysWOW64\kvlkd.exeC:\Windows\system32\kvlkd.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2608 -
C:\Windows\SysWOW64\ezidgoex.exeC:\Windows\system32\ezidgoex.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2856 -
C:\Windows\SysWOW64\dlnwp.exeC:\Windows\system32\dlnwp.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1660 -
C:\Windows\SysWOW64\vgwju.exeC:\Windows\system32\vgwju.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1500 -
C:\Windows\SysWOW64\epgxzf.exeC:\Windows\system32\epgxzf.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:340 -
C:\Windows\SysWOW64\sceomydf.exeC:\Windows\system32\sceomydf.exe33⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:760 -
C:\Windows\SysWOW64\dahlop.exeC:\Windows\system32\dahlop.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2544 -
C:\Windows\SysWOW64\lapeqv.exeC:\Windows\system32\lapeqv.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Windows\SysWOW64\zgwts.exeC:\Windows\system32\zgwts.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2032 -
C:\Windows\SysWOW64\zyizcr.exeC:\Windows\system32\zyizcr.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1788 -
C:\Windows\SysWOW64\sekfaub.exeC:\Windows\system32\sekfaub.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1944 -
C:\Windows\SysWOW64\bkmfr.exeC:\Windows\system32\bkmfr.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1404 -
C:\Windows\SysWOW64\lylst.exeC:\Windows\system32\lylst.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:900 -
C:\Windows\SysWOW64\rmuoh.exeC:\Windows\system32\rmuoh.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1300 -
C:\Windows\SysWOW64\ktsccu.exeC:\Windows\system32\ktsccu.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1700 -
C:\Windows\SysWOW64\cohkr.exeC:\Windows\system32\cohkr.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1696 -
C:\Windows\SysWOW64\xanhv.exeC:\Windows\system32\xanhv.exe44⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2412 -
C:\Windows\SysWOW64\wijcl.exeC:\Windows\system32\wijcl.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2464 -
C:\Windows\SysWOW64\rajznfsn.exeC:\Windows\system32\rajznfsn.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2892 -
C:\Windows\SysWOW64\dgvqljb.exeC:\Windows\system32\dgvqljb.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2860 -
C:\Windows\SysWOW64\nwjnpln.exeC:\Windows\system32\nwjnpln.exe48⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3876 -
C:\Windows\SysWOW64\ypblng.exeC:\Windows\system32\ypblng.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1408 -
C:\Windows\SysWOW64\qldauz.exeC:\Windows\system32\qldauz.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2756 -
C:\Windows\SysWOW64\zgxagx.exeC:\Windows\system32\zgxagx.exe51⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2456 -
C:\Windows\SysWOW64\bdwsfrlj.exeC:\Windows\system32\bdwsfrlj.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:808 -
C:\Windows\SysWOW64\nueqrrqh.exeC:\Windows\system32\nueqrrqh.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2204 -
C:\Windows\SysWOW64\ashhsd.exeC:\Windows\system32\ashhsd.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1844 -
C:\Windows\SysWOW64\dqtjkj.exeC:\Windows\system32\dqtjkj.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1640 -
C:\Windows\SysWOW64\yxgpwpp.exeC:\Windows\system32\yxgpwpp.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2640 -
C:\Windows\SysWOW64\rjddjyne.exeC:\Windows\system32\rjddjyne.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2768 -
C:\Windows\SysWOW64\ujtejpz.exeC:\Windows\system32\ujtejpz.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3112 -
C:\Windows\SysWOW64\jxwzpdx.exeC:\Windows\system32\jxwzpdx.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3172 -
C:\Windows\SysWOW64\znuenzko.exeC:\Windows\system32\znuenzko.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3256 -
C:\Windows\SysWOW64\jjznr.exeC:\Windows\system32\jjznr.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3320 -
C:\Windows\SysWOW64\fbstld.exeC:\Windows\system32\fbstld.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3388 -
C:\Windows\SysWOW64\soviqf.exeC:\Windows\system32\soviqf.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3460 -
C:\Windows\SysWOW64\zbpxcq.exeC:\Windows\system32\zbpxcq.exe64⤵
- Executes dropped EXE
PID:3524 -
C:\Windows\SysWOW64\ergyogdg.exeC:\Windows\system32\ergyogdg.exe65⤵
- Executes dropped EXE
PID:3588 -
C:\Windows\SysWOW64\qpinlu.exeC:\Windows\system32\qpinlu.exe66⤵
- Executes dropped EXE
PID:3656 -
C:\Windows\SysWOW64\vgubikp.exeC:\Windows\system32\vgubikp.exe67⤵PID:3760
-
C:\Windows\SysWOW64\zevghekr.exeC:\Windows\system32\zevghekr.exe68⤵PID:3820
-
C:\Windows\SysWOW64\ppxghv.exeC:\Windows\system32\ppxghv.exe69⤵PID:3916
-
C:\Windows\SysWOW64\nsgvcf.exeC:\Windows\system32\nsgvcf.exe70⤵PID:3972
-
C:\Windows\SysWOW64\wukgmmgv.exeC:\Windows\system32\wukgmmgv.exe71⤵
- Drops file in System32 directory
PID:4040 -
C:\Windows\SysWOW64\tqhynlm.exeC:\Windows\system32\tqhynlm.exe72⤵PID:4076
-
C:\Windows\SysWOW64\zmmabhk.exeC:\Windows\system32\zmmabhk.exe73⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Windows\SysWOW64\hevpjemt.exeC:\Windows\system32\hevpjemt.exe74⤵PID:352
-
C:\Windows\SysWOW64\dclszchv.exeC:\Windows\system32\dclszchv.exe75⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:592 -
C:\Windows\SysWOW64\brprlv.exeC:\Windows\system32\brprlv.exe76⤵PID:3024
-
C:\Windows\SysWOW64\kjruizcu.exeC:\Windows\system32\kjruizcu.exe77⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1948 -
C:\Windows\SysWOW64\lfedif.exeC:\Windows\system32\lfedif.exe78⤵
- Adds Run key to start application
PID:1860 -
C:\Windows\SysWOW64\hclez.exeC:\Windows\system32\hclez.exe79⤵PID:2684
-
C:\Windows\SysWOW64\aoquvocv.exeC:\Windows\system32\aoquvocv.exe80⤵PID:3108
-
C:\Windows\SysWOW64\jqvgb.exeC:\Windows\system32\jqvgb.exe81⤵
- Drops file in System32 directory
PID:3144 -
C:\Windows\SysWOW64\worjuv.exeC:\Windows\system32\worjuv.exe82⤵PID:3284
-
C:\Windows\SysWOW64\eulnw.exeC:\Windows\system32\eulnw.exe83⤵PID:3428
-
C:\Windows\SysWOW64\lwggsur.exeC:\Windows\system32\lwggsur.exe84⤵PID:3548
-
C:\Windows\SysWOW64\defvki.exeC:\Windows\system32\defvki.exe85⤵
- Drops file in System32 directory
PID:3696 -
C:\Windows\SysWOW64\kajkjzo.exeC:\Windows\system32\kajkjzo.exe86⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:3812 -
C:\Windows\SysWOW64\gxmutgy.exeC:\Windows\system32\gxmutgy.exe87⤵
- Drops file in System32 directory
PID:3948 -
C:\Windows\SysWOW64\uotmikbz.exeC:\Windows\system32\uotmikbz.exe88⤵
- System Location Discovery: System Language Discovery
PID:3028 -
C:\Windows\SysWOW64\ilgjn.exeC:\Windows\system32\ilgjn.exe89⤵PID:4092
-
C:\Windows\SysWOW64\xdclvc.exeC:\Windows\system32\xdclvc.exe90⤵PID:1244
-
C:\Windows\SysWOW64\dwynnmgs.exeC:\Windows\system32\dwynnmgs.exe91⤵PID:2100
-
C:\Windows\SysWOW64\kkamsasx.exeC:\Windows\system32\kkamsasx.exe92⤵PID:1104
-
C:\Windows\SysWOW64\dlhxsph.exeC:\Windows\system32\dlhxsph.exe93⤵PID:2140
-
C:\Windows\SysWOW64\eshyyyjd.exeC:\Windows\system32\eshyyyjd.exe94⤵PID:3080
-
C:\Windows\SysWOW64\yfdgy.exeC:\Windows\system32\yfdgy.exe95⤵PID:3264
-
C:\Windows\SysWOW64\vlxesnri.exeC:\Windows\system32\vlxesnri.exe96⤵PID:3500
-
C:\Windows\SysWOW64\doiafl.exeC:\Windows\system32\doiafl.exe97⤵PID:3684
-
C:\Windows\SysWOW64\ahoxc.exeC:\Windows\system32\ahoxc.exe98⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3836 -
C:\Windows\SysWOW64\mccluea.exeC:\Windows\system32\mccluea.exe99⤵PID:2148
-
C:\Windows\SysWOW64\ccdvkkxi.exeC:\Windows\system32\ccdvkkxi.exe100⤵
- System Location Discovery: System Language Discovery
PID:1708 -
C:\Windows\SysWOW64\fseynlos.exeC:\Windows\system32\fseynlos.exe101⤵
- System Location Discovery: System Language Discovery
PID:1568 -
C:\Windows\SysWOW64\njryq.exeC:\Windows\system32\njryq.exe102⤵PID:1968
-
C:\Windows\SysWOW64\mcweawol.exeC:\Windows\system32\mcweawol.exe103⤵PID:3128
-
C:\Windows\SysWOW64\bcooltv.exeC:\Windows\system32\bcooltv.exe104⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3404 -
C:\Windows\SysWOW64\vdqdyj.exeC:\Windows\system32\vdqdyj.exe105⤵
- Adds Run key to start application
PID:3584 -
C:\Windows\SysWOW64\rnjhqihg.exeC:\Windows\system32\rnjhqihg.exe106⤵
- System Location Discovery: System Language Discovery
PID:3832 -
C:\Windows\SysWOW64\vtuyz.exeC:\Windows\system32\vtuyz.exe107⤵PID:3504
-
C:\Windows\SysWOW64\tuham.exeC:\Windows\system32\tuham.exe108⤵PID:1068
-
C:\Windows\SysWOW64\kdbelq.exeC:\Windows\system32\kdbelq.exe109⤵PID:1716
-
C:\Windows\SysWOW64\vlrzaor.exeC:\Windows\system32\vlrzaor.exe110⤵PID:3316
-
C:\Windows\SysWOW64\lrzgzyiv.exeC:\Windows\system32\lrzgzyiv.exe111⤵PID:3720
-
C:\Windows\SysWOW64\fufha.exeC:\Windows\system32\fufha.exe112⤵PID:3848
-
C:\Windows\SysWOW64\seazwb.exeC:\Windows\system32\seazwb.exe113⤵PID:804
-
C:\Windows\SysWOW64\qovjm.exeC:\Windows\system32\qovjm.exe114⤵PID:3244
-
C:\Windows\SysWOW64\todrm.exeC:\Windows\system32\todrm.exe115⤵
- Drops file in System32 directory
PID:4020 -
C:\Windows\SysWOW64\gxihz.exeC:\Windows\system32\gxihz.exe116⤵PID:2428
-
C:\Windows\SysWOW64\vqoax.exeC:\Windows\system32\vqoax.exe117⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1312 -
C:\Windows\SysWOW64\ykktu.exeC:\Windows\system32\ykktu.exe118⤵PID:1064
-
C:\Windows\SysWOW64\zbothd.exeC:\Windows\system32\zbothd.exe119⤵PID:2676
-
C:\Windows\SysWOW64\ejnuoh.exeC:\Windows\system32\ejnuoh.exe120⤵PID:2532
-
C:\Windows\SysWOW64\wtibxdxk.exeC:\Windows\system32\wtibxdxk.exe121⤵PID:4136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-