5487fc7318a66f540844ed151d8d7492b69e3a7a4c1a3a02c123d884278d7e26

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Size

336KB
MD5

b21c60989898e870e83ecbf9dad1cd88
SHA1

616356c1c5ce77e44244d8d0b833cbd80e0a974b
SHA256

5487fc7318a66f540844ed151d8d7492b69e3a7a4c1a3a02c123d884278d7e26
SHA512

f0b66d61b420daeb825866be291bc50c42f3236dd3165de760109be1153736561b6eeb9ec42eee52ca9d262e0ff08dcd9e56df88e08bdf8d4709d95bffb52023
SSDEEP

1536:QhUx2XSyQVgd54vFbd5uCFsvTEXb2Q+8PDB7+k54vTgzQvOVQ1moQCaXWc76A:Qyx2XSyL7OZsvxQT7+SdzMOVQ1mo9s

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~1\VideoLAN\VLC\locale\am\dispex.exe	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\FSDEFI~1\auxpad\comcat.exe	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
File opened for modification	C:\PROGRA~1\COMMON~1\System\OLEDB~1\de-DE\c_10082.exe	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
File opened for modification	C:\PROGRA~1\INTERN~1\de-DE\c_20424.exe	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
File opened for modification	C:\PROGRA~1\MICROS~1\PURBLE~1\en-US\dbnmpntw.exe	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
File opened for modification	C:\PROGRA~1\VideoLAN\VLC\locale\fr\dot3gpdo.cmd	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\TextConv\fr-FR\convert.pif	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\VSTO\10.0\1033\cryptext.com	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
File opened for modification	C:\PROGRA~1\MICROS~1\MOREGA~1\es-ES\c_950.com	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
File opened for modification	C:\PROGRA~1\COMMON~1\System\certmgr.exe	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
File opened for modification	C:\PROGRA~1\MICROS~1\FreeCell\de-DE\c_28605.exe	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
File opened for modification	C:\PROGRA~1\MOZILL~1\GMP-CL~1\0.1\devmgr.exe	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\da-DK\chxreach.exe	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\lt-LT\cmdkey.bat	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\win.com C:\PROGRA~1\DVDMAK~1\Shared\DVDSTY~1\Pets\c_20000.nls	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 23 IoCs

pid	Process
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 384	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	3
PID 1060 wrote to memory of 384	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	3
PID 1060 wrote to memory of 384	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	3
PID 1060 wrote to memory of 384	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	3
PID 1060 wrote to memory of 384	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	3
PID 1060 wrote to memory of 384	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	3
PID 1060 wrote to memory of 384	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	3
PID 1060 wrote to memory of 396	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	4
PID 1060 wrote to memory of 396	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	4
PID 1060 wrote to memory of 396	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	4
PID 1060 wrote to memory of 396	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	4
PID 1060 wrote to memory of 396	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	4
PID 1060 wrote to memory of 396	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	4
PID 1060 wrote to memory of 396	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	4
PID 1060 wrote to memory of 432	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	5
PID 1060 wrote to memory of 432	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	5
PID 1060 wrote to memory of 432	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	5
PID 1060 wrote to memory of 432	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	5
PID 1060 wrote to memory of 432	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	5
PID 1060 wrote to memory of 432	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	5
PID 1060 wrote to memory of 432	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	5
PID 1060 wrote to memory of 476	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	6
PID 1060 wrote to memory of 476	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	6
PID 1060 wrote to memory of 476	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	6
PID 1060 wrote to memory of 476	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	6
PID 1060 wrote to memory of 476	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	6
PID 1060 wrote to memory of 476	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	6
PID 1060 wrote to memory of 476	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	6
PID 1060 wrote to memory of 492	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	7
PID 1060 wrote to memory of 492	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	7
PID 1060 wrote to memory of 492	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	7
PID 1060 wrote to memory of 492	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	7
PID 1060 wrote to memory of 492	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	7
PID 1060 wrote to memory of 492	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	7
PID 1060 wrote to memory of 492	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	7
PID 1060 wrote to memory of 500	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	8
PID 1060 wrote to memory of 500	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	8
PID 1060 wrote to memory of 500	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	8
PID 1060 wrote to memory of 500	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	8
PID 1060 wrote to memory of 500	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	8
PID 1060 wrote to memory of 500	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	8
PID 1060 wrote to memory of 500	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	8
PID 1060 wrote to memory of 596	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	9
PID 1060 wrote to memory of 596	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	9
PID 1060 wrote to memory of 596	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	9
PID 1060 wrote to memory of 596	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	9
PID 1060 wrote to memory of 596	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	9
PID 1060 wrote to memory of 596	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	9
PID 1060 wrote to memory of 596	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	9
PID 1060 wrote to memory of 676	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	10
PID 1060 wrote to memory of 676	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	10
PID 1060 wrote to memory of 676	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	10
PID 1060 wrote to memory of 676	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	10
PID 1060 wrote to memory of 676	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	10
PID 1060 wrote to memory of 676	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	10
PID 1060 wrote to memory of 676	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	10
PID 1060 wrote to memory of 752	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	11
PID 1060 wrote to memory of 752	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	11
PID 1060 wrote to memory of 752	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	11
PID 1060 wrote to memory of 752	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	11
PID 1060 wrote to memory of 752	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	11
PID 1060 wrote to memory of 752	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	11
PID 1060 wrote to memory of 752	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	11
PID 1060 wrote to memory of 824	1060	b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe	12

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:596
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:764
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1080
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:676
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:752
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:824
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1184
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:864
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:976
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:280
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:344
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1040
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1120
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1680
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2124
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:1420
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1244
- C:\Users\Admin\AppData\Local\Temp\b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b21c60989898e870e83ecbf9dad1cd88_JaffaCakes118.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~1\COMMON~1\MICROS~1\ink\da-DK\chxreach.exe

Filesize
332KB

MD5
b9ed8f420276531d1a06e6c9eacf350d

SHA1
36a3bddd8dc4067320f6787228986c691672832a

SHA256
889711ed8e696b5fe1512c33f8c7206a091b4428eabaa1cbf8232047f3d921c9

SHA512
d9f53ca7acc9da3521675f60d186fb1421465cc25f687d79c27251617975cc22edeb639b946c59b78b7135dd28a1cf5eb3b95b59596ebd311e459215341ea039

Download Submit
memory/1060-0-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1060-1-0x0000000077D9F000-0x0000000077DA0000-memory.dmp

Filesize
4KB

Download
memory/1060-2-0x0000000077DA0000-0x0000000077DA1000-memory.dmp

Filesize
4KB

Download
memory/1060-40-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download