cffe54c4ec282e4b741a5441d8cf3381ede164ef54eae4904dddf18b07d5d83f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b38cf1fd80dbaf36e91c61504bdde401_JaffaCakes118.exe
Size

232KB
MD5

b38cf1fd80dbaf36e91c61504bdde401
SHA1

a15cc5b3e433cbd0a78bcddb2691ad20a1ed01a5
SHA256

cffe54c4ec282e4b741a5441d8cf3381ede164ef54eae4904dddf18b07d5d83f
SHA512

0a9cb2990caa43eb0d7a9d642a6f159848bac242e3217bbe005c78d3e101d39f4aea20aeb39922939c1962a7cc9a50024ee0407e0f71bd09464701032122d8b2
SSDEEP

6144:9hbZ5hMTNFf8LAurlEzAX7o5hn8wVSZ2sXO6:vtXMzqrllX7618wU

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 26 IoCs

pid	Process
2764	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202.exe
2216	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202a.exe
2872	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202b.exe
2560	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202c.exe
1584	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202d.exe
1768	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202e.exe
2980	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202f.exe
2008	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202g.exe
1272	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202h.exe
2244	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202i.exe
1472	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202j.exe
532	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202k.exe
2384	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202l.exe
2464	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202m.exe
2248	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202n.exe
2068	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202o.exe
2156	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202p.exe
1760	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202q.exe
1716	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202r.exe
3008	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202s.exe
2032	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202t.exe
3048	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202u.exe
284	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202v.exe
1448	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202w.exe
1600	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202x.exe
2776	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202y.exe

Loads dropped DLL 52 IoCs

pid	Process
2252	b38cf1fd80dbaf36e91c61504bdde401_JaffaCakes118.exe
2252	b38cf1fd80dbaf36e91c61504bdde401_JaffaCakes118.exe
2764	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202.exe
2764	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202.exe
2216	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202a.exe
2216	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202a.exe
2872	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202b.exe
2872	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202b.exe
2560	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202c.exe
2560	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202c.exe
1584	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202d.exe
1584	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202d.exe
1768	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202e.exe
1768	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202e.exe
2980	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202f.exe
2980	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202f.exe
2008	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202g.exe
2008	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202g.exe
1272	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202h.exe
1272	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202h.exe
2244	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202i.exe
2244	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202i.exe
1472	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202j.exe
1472	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202j.exe
532	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202k.exe
532	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202k.exe
2384	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202l.exe
2384	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202l.exe
2464	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202m.exe
2464	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202m.exe
2248	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202n.exe
2248	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202n.exe
2068	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202o.exe
2068	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202o.exe
2156	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202p.exe
2156	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202p.exe
1760	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202q.exe
1760	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202q.exe
1716	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202r.exe
1716	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202r.exe
3008	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202s.exe
3008	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202s.exe
2032	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202t.exe
2032	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202t.exe
3048	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202u.exe
3048	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202u.exe
284	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202v.exe
284	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202v.exe
1448	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202w.exe
1448	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202w.exe
1600	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202x.exe
1600	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202x.exe

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202i.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202g.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202t.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202l.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202w.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202y.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202j.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202m.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202u.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202v.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202h.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202k.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202o.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202q.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202e.exe

Modifies registry class 54 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202g.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202c.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202h.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202p.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202u.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202m.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202n.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202t.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202g.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202i.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202o.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202y.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202d.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202f.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202c.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202m.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202v.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202w.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202x.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202b.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202r.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202h.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202i.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202q.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202q.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202k.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202r.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202s.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202l.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202n.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202w.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202j.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202t.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202d.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202o.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202v.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202k.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202l.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202p.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = ce6d8954efdf11bb	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202s.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202u.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202x.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202y.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\Wow6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202j.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2764	2252	b38cf1fd80dbaf36e91c61504bdde401_JaffaCakes118.exe	30
PID 2252 wrote to memory of 2764	2252	b38cf1fd80dbaf36e91c61504bdde401_JaffaCakes118.exe	30
PID 2252 wrote to memory of 2764	2252	b38cf1fd80dbaf36e91c61504bdde401_JaffaCakes118.exe	30
PID 2252 wrote to memory of 2764	2252	b38cf1fd80dbaf36e91c61504bdde401_JaffaCakes118.exe	30
PID 2764 wrote to memory of 2216	2764	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202.exe	31
PID 2764 wrote to memory of 2216	2764	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202.exe	31
PID 2764 wrote to memory of 2216	2764	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202.exe	31
PID 2764 wrote to memory of 2216	2764	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202.exe	31
PID 2216 wrote to memory of 2872	2216	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202a.exe	32
PID 2216 wrote to memory of 2872	2216	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202a.exe	32
PID 2216 wrote to memory of 2872	2216	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202a.exe	32
PID 2216 wrote to memory of 2872	2216	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202a.exe	32
PID 2872 wrote to memory of 2560	2872	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202b.exe	33
PID 2872 wrote to memory of 2560	2872	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202b.exe	33
PID 2872 wrote to memory of 2560	2872	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202b.exe	33
PID 2872 wrote to memory of 2560	2872	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202b.exe	33
PID 2560 wrote to memory of 1584	2560	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202c.exe	34
PID 2560 wrote to memory of 1584	2560	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202c.exe	34
PID 2560 wrote to memory of 1584	2560	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202c.exe	34
PID 2560 wrote to memory of 1584	2560	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202c.exe	34
PID 1584 wrote to memory of 1768	1584	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202d.exe	35
PID 1584 wrote to memory of 1768	1584	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202d.exe	35
PID 1584 wrote to memory of 1768	1584	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202d.exe	35
PID 1584 wrote to memory of 1768	1584	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202d.exe	35
PID 1768 wrote to memory of 2980	1768	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202e.exe	36
PID 1768 wrote to memory of 2980	1768	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202e.exe	36
PID 1768 wrote to memory of 2980	1768	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202e.exe	36
PID 1768 wrote to memory of 2980	1768	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202e.exe	36
PID 2980 wrote to memory of 2008	2980	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202f.exe	37
PID 2980 wrote to memory of 2008	2980	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202f.exe	37
PID 2980 wrote to memory of 2008	2980	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202f.exe	37
PID 2980 wrote to memory of 2008	2980	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202f.exe	37
PID 2008 wrote to memory of 1272	2008	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202g.exe	38
PID 2008 wrote to memory of 1272	2008	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202g.exe	38
PID 2008 wrote to memory of 1272	2008	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202g.exe	38
PID 2008 wrote to memory of 1272	2008	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202g.exe	38
PID 1272 wrote to memory of 2244	1272	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202h.exe	39
PID 1272 wrote to memory of 2244	1272	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202h.exe	39
PID 1272 wrote to memory of 2244	1272	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202h.exe	39
PID 1272 wrote to memory of 2244	1272	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202h.exe	39
PID 2244 wrote to memory of 1472	2244	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202i.exe	40
PID 2244 wrote to memory of 1472	2244	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202i.exe	40
PID 2244 wrote to memory of 1472	2244	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202i.exe	40
PID 2244 wrote to memory of 1472	2244	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202i.exe	40
PID 1472 wrote to memory of 532	1472	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202j.exe	41
PID 1472 wrote to memory of 532	1472	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202j.exe	41
PID 1472 wrote to memory of 532	1472	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202j.exe	41
PID 1472 wrote to memory of 532	1472	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202j.exe	41
PID 532 wrote to memory of 2384	532	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202k.exe	42
PID 532 wrote to memory of 2384	532	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202k.exe	42
PID 532 wrote to memory of 2384	532	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202k.exe	42
PID 532 wrote to memory of 2384	532	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202k.exe	42
PID 2384 wrote to memory of 2464	2384	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202l.exe	43
PID 2384 wrote to memory of 2464	2384	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202l.exe	43
PID 2384 wrote to memory of 2464	2384	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202l.exe	43
PID 2384 wrote to memory of 2464	2384	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202l.exe	43
PID 2464 wrote to memory of 2248	2464	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202m.exe	44
PID 2464 wrote to memory of 2248	2464	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202m.exe	44
PID 2464 wrote to memory of 2248	2464	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202m.exe	44
PID 2464 wrote to memory of 2248	2464	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202m.exe	44
PID 2248 wrote to memory of 2068	2248	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202n.exe	45
PID 2248 wrote to memory of 2068	2248	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202n.exe	45
PID 2248 wrote to memory of 2068	2248	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202n.exe	45
PID 2248 wrote to memory of 2068	2248	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202n.exe	45

C:\Users\Admin\AppData\Local\Temp\b38cf1fd80dbaf36e91c61504bdde401_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b38cf1fd80dbaf36e91c61504bdde401_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2252
- \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202.exe
  c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2764
- - \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202a.exe
    c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202a.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202b.exe
      c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202b.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2872
    - - \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202c.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202c.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2560
      - \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202d.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202d.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202e.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202e.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202f.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202f.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202g.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202g.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202h.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202h.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1272
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202i.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202i.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202j.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202j.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1472
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202k.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202k.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:532
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202l.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202l.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202m.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202m.exe
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202n.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202n.exe
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202o.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202o.exe
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2068
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202p.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202p.exe
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2156
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202q.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202q.exe
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1760
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202r.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202r.exe
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1716
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202s.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202s.exe
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3008
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202t.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202t.exe
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2032
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202u.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202u.exe
        23⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3048
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202v.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202v.exe
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:284
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202w.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202w.exe
        25⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1448
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202x.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202x.exe
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1600
        
        \??\c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202y.exe
        
        c:\users\admin\appdata\local\temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202y.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202.exe

Filesize
232KB

MD5
d0638f4f43521723c48ad53867d9eb29

SHA1
d5f89ba034102ba41a9037c55528cf6d35c77e94

SHA256
a9650934e52450f20107a90dfe6420e808761ef4704ba611e5d9d081d7da649a

SHA512
eb2e612db1fbfc1c1b7a8d89d326cea198125f92cad4f6e5ef4ff0d1c8f501d346363cf1ba6fc49f7013cb4d7fc48720d91fe3dd2566f295cfdc9ad34c95e462

Download Submit
\Users\Admin\AppData\Local\Temp\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202h.exe

Filesize
232KB

MD5
081dbe064b94529e554ea7dcdbd862ed

SHA1
705d5a4b4f318b902c2767fa522f520ebf79fa7c

SHA256
67db82c370691e797e70329e6a2146527057c7b523991dbd51dde3e47256a529

SHA512
fece7472f658a1ff3939c5e416f5a2adbcd92c50fbc91ca36f0f3681fdf39b1ba035fde1b3f90e072e7f14e544f09082b0ab530dd2c42ef931656287033f8891

Download Submit
memory/284-327-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/284-317-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/532-194-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1272-148-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1272-135-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1448-337-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1472-350-0x0000000000270000-0x00000000002AB000-memory.dmp

Filesize
236KB

Download
memory/1472-179-0x0000000000270000-0x00000000002AB000-memory.dmp

Filesize
236KB

Download
memory/1472-165-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1472-173-0x0000000000270000-0x00000000002AB000-memory.dmp

Filesize
236KB

Download
memory/1472-178-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1584-81-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1584-88-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1600-343-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1600-348-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1716-271-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1716-281-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1760-270-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1760-269-0x0000000002610000-0x000000000264B000-memory.dmp

Filesize
236KB

Download
memory/1768-103-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/1768-98-0x0000000001D10000-0x0000000001D4B000-memory.dmp

Filesize
236KB

Download
memory/2008-133-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2008-127-0x00000000005D0000-0x000000000060B000-memory.dmp

Filesize
236KB

Download
memory/2032-304-0x00000000003A0000-0x00000000003DB000-memory.dmp

Filesize
236KB

Download
memory/2032-293-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2032-305-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2032-300-0x00000000003A0000-0x00000000003DB000-memory.dmp

Filesize
236KB

Download
memory/2068-247-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2156-248-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2156-259-0x0000000000290000-0x00000000002CB000-memory.dmp

Filesize
236KB

Download
memory/2156-258-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2216-30-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2216-44-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2244-163-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2248-235-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2252-0-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2252-14-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2252-7-0x0000000000250000-0x000000000028B000-memory.dmp

Filesize
236KB

Download
memory/2384-207-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2464-221-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2560-74-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2764-15-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2764-28-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2776-349-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2872-51-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2872-60-0x0000000000250000-0x000000000028B000-memory.dmp

Filesize
236KB

Download
memory/2872-58-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2980-105-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/2980-118-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/3008-291-0x00000000002C0000-0x00000000002FB000-memory.dmp

Filesize
236KB

Download
memory/3008-292-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/3048-316-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download
memory/3048-306-0x0000000000400000-0x000000000043AB3B-memory.dmp

Filesize
234KB

Download

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202h.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202g.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202j.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202i.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202f.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202c.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202r.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202q.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202v.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202u.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202.exe\""	b38cf1fd80dbaf36e91c61504bdde401_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202x.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202w.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202y.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202x.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202u.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202t.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202d.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202i.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202h.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202k.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202j.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202b.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202l.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202k.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202m.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202l.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202p.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202o.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202t.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202s.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202w.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202v.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202a.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202e.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202g.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202n.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202q.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202p.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202s.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202r.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202o.exe\""	b38cf1fd80dbaf36e91c61504bdde401_jaffacakes118_3202n.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads