Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
48s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 07:52
Static task
static1
Behavioral task
behavioral1
Sample
776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe
-
Size
138KB
-
MD5
776ed0e635d7573f5c8227f3361cf351
-
SHA1
72ce529200364744fcf11ff76d9e7f1faae5d214
-
SHA256
7d76162a7e91d9274a18ef7a45ff36f4ce73b9a943ed7b8b089d396f6ee3c071
-
SHA512
6bd477e7acdc8413975c1646e99a4da854cece53568b492481e848bc6c9fbf929d7b3e8f74c33a3c631e04f9a5b458e24f9faaacdb54f35022581efc32bcf688
-
SSDEEP
3072:/huB4ykqbWlb1jVC1+INOWKeJ/ld945H2nI+l6zBGBhV57zBH:IB4ykqilJjFIIWKeJ9sx2IM6zBGB1h
Malware Config
Signatures
-
Blocklisted process makes network request 5 IoCs
flow pid Process 31 3884 sihclient.exe 34 3884 sihclient.exe 37 3884 sihclient.exe 38 3884 sihclient.exe 40 3884 sihclient.exe -
Executes dropped EXE 64 IoCs
pid Process 1828 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3152 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 1316 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 376 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4132 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3924 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4708 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4416 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3116 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3296 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4012 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4712 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4784 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2092 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3196 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2872 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4308 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3932 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2340 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2388 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3148 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 748 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3916 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2912 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4184 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 1188 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3120 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2248 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 956 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 916 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2320 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2108 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4364 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4064 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4876 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 1828 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 1732 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2096 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 1612 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3924 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2168 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3612 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 932 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 5028 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4500 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2500 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4028 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 1568 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2976 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4572 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2880 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4348 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 1116 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4532 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2960 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 5056 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4428 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 1904 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4400 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4644 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4928 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4424 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4788 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 1164 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe File created C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2124 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1828 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3152 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1316 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 376 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4132 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3924 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4708 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4416 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3116 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3296 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4012 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4712 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4784 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2092 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3196 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2872 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4308 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3932 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2340 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2388 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3148 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 748 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3916 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2912 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4184 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1188 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3120 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2248 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 956 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 916 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2320 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2108 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4364 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4064 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4876 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1828 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1732 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2096 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1612 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3924 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2168 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3612 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 932 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 5028 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4500 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2500 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4028 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1568 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2976 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4572 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2880 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4348 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1116 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4532 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2960 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 5056 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4428 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1904 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4400 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4644 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4928 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4424 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4788 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2124 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2124 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 1828 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 1828 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3152 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3152 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 1316 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 1316 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 376 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 376 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4132 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4132 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3924 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3924 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4708 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4708 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4416 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4416 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3116 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3116 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3296 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3296 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4012 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4012 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4712 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4712 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4784 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4784 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2092 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2092 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3196 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3196 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2872 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2872 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4308 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4308 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3932 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3932 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2340 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2340 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2388 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2388 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3148 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3148 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 748 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 748 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3916 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3916 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2912 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2912 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4184 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 4184 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 1188 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 1188 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3120 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 3120 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2248 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2248 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 956 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 956 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 916 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 916 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2320 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 2320 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 1828 2124 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 84 PID 2124 wrote to memory of 1828 2124 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 84 PID 2124 wrote to memory of 1828 2124 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 84 PID 1828 wrote to memory of 3152 1828 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 85 PID 1828 wrote to memory of 3152 1828 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 85 PID 1828 wrote to memory of 3152 1828 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 85 PID 2124 wrote to memory of 2512 2124 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 86 PID 2124 wrote to memory of 2512 2124 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 86 PID 2124 wrote to memory of 2512 2124 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 86 PID 3152 wrote to memory of 1316 3152 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 87 PID 3152 wrote to memory of 1316 3152 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 87 PID 3152 wrote to memory of 1316 3152 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 87 PID 1828 wrote to memory of 2188 1828 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 88 PID 1828 wrote to memory of 2188 1828 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 88 PID 1828 wrote to memory of 2188 1828 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 88 PID 1316 wrote to memory of 376 1316 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 89 PID 1316 wrote to memory of 376 1316 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 89 PID 1316 wrote to memory of 376 1316 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 89 PID 3152 wrote to memory of 2016 3152 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 90 PID 3152 wrote to memory of 2016 3152 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 90 PID 3152 wrote to memory of 2016 3152 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 90 PID 376 wrote to memory of 4132 376 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 91 PID 376 wrote to memory of 4132 376 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 91 PID 376 wrote to memory of 4132 376 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 91 PID 1316 wrote to memory of 212 1316 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 92 PID 1316 wrote to memory of 212 1316 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 92 PID 1316 wrote to memory of 212 1316 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 92 PID 4132 wrote to memory of 3924 4132 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 93 PID 4132 wrote to memory of 3924 4132 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 93 PID 4132 wrote to memory of 3924 4132 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 93 PID 376 wrote to memory of 880 376 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 94 PID 376 wrote to memory of 880 376 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 94 PID 376 wrote to memory of 880 376 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 94 PID 3924 wrote to memory of 4708 3924 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 95 PID 3924 wrote to memory of 4708 3924 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 95 PID 3924 wrote to memory of 4708 3924 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 95 PID 4132 wrote to memory of 3648 4132 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 96 PID 4132 wrote to memory of 3648 4132 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 96 PID 4132 wrote to memory of 3648 4132 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 96 PID 4708 wrote to memory of 4416 4708 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 97 PID 4708 wrote to memory of 4416 4708 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 97 PID 4708 wrote to memory of 4416 4708 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 97 PID 3924 wrote to memory of 544 3924 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 98 PID 3924 wrote to memory of 544 3924 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 98 PID 3924 wrote to memory of 544 3924 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 98 PID 4416 wrote to memory of 3116 4416 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 99 PID 4416 wrote to memory of 3116 4416 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 99 PID 4416 wrote to memory of 3116 4416 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 99 PID 4708 wrote to memory of 8 4708 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 100 PID 4708 wrote to memory of 8 4708 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 100 PID 4708 wrote to memory of 8 4708 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 100 PID 3116 wrote to memory of 3296 3116 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 101 PID 3116 wrote to memory of 3296 3116 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 101 PID 3116 wrote to memory of 3296 3116 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 101 PID 4416 wrote to memory of 2300 4416 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 102 PID 4416 wrote to memory of 2300 4416 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 102 PID 4416 wrote to memory of 2300 4416 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 102 PID 3296 wrote to memory of 4012 3296 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 103 PID 3296 wrote to memory of 4012 3296 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 103 PID 3296 wrote to memory of 4012 3296 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 103 PID 3116 wrote to memory of 3284 3116 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 104 PID 3116 wrote to memory of 3284 3116 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 104 PID 3116 wrote to memory of 3284 3116 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 104 PID 4012 wrote to memory of 4712 4012 776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4712 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4784 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2092 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3196 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2872 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4308 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3932 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2340 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2388 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3148 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:748 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3916 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2912 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4184 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe27⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1188 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3120 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2248 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe30⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:956 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:916 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe32⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2320 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2108 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4364 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4064 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4876 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1828 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1732 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2096 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1612 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3924 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2168 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3612 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:932 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe45⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5028 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4500 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2500 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4028 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1568 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2976 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4572 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2880 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4348 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1116 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe55⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4532 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2960 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5056 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4428 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1904 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4400 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4644 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe62⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4928 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4424 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4788 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe65⤵
- Executes dropped EXE
PID:1164 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe66⤵PID:4964
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe67⤵PID:3420
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe68⤵PID:5020
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe69⤵PID:980
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe70⤵PID:2000
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe71⤵PID:2140
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe72⤵
- Drops file in System32 directory
PID:1260 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe73⤵
- Modifies registry class
PID:1220 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe74⤵PID:376
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe75⤵PID:1752
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe76⤵PID:2096
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe77⤵
- System Location Discovery: System Language Discovery
PID:3100 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe78⤵PID:1408
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe79⤵PID:4628
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe80⤵PID:3244
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe81⤵PID:3328
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe82⤵PID:4712
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe83⤵PID:4808
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe84⤵PID:1144
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe85⤵PID:2464
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe86⤵PID:4900
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe87⤵PID:1352
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe88⤵PID:2880
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe89⤵PID:1604
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe90⤵PID:2340
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe91⤵PID:5036
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe92⤵PID:3268
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe93⤵PID:2732
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe94⤵PID:2852
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe95⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4008 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe96⤵
- System Location Discovery: System Language Discovery
PID:3120 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe97⤵PID:2720
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe98⤵PID:1164
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe99⤵PID:2588
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe100⤵PID:4636
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe101⤵PID:2108
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe102⤵PID:4876
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe103⤵
- Modifies registry class
PID:3968 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe104⤵PID:1576
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe105⤵
- Drops file in System32 directory
- Modifies registry class
PID:1732 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe106⤵PID:4132
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe107⤵PID:320
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe108⤵PID:5084
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe109⤵PID:4628
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe110⤵PID:956
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe111⤵PID:5044
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe112⤵PID:8
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe113⤵
- Modifies registry class
PID:4172 -
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe114⤵PID:1212
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe115⤵PID:3284
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe116⤵PID:2492
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe117⤵PID:1824
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe118⤵PID:1988
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe119⤵PID:3568
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe120⤵PID:1776
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe121⤵PID:4984
-
C:\Windows\SysWOW64\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exeC:\Windows\system32\776ed0e635d7573f5c8227f3361cf351_JaffaCakes118.exe122⤵
- Modifies registry class
PID:1692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-