Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
67s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 18:45
Behavioral task
behavioral1
Sample
c9683c5b615f00d260307e04239ade84_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c9683c5b615f00d260307e04239ade84_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c9683c5b615f00d260307e04239ade84_JaffaCakes118.exe
-
Size
831KB
-
MD5
c9683c5b615f00d260307e04239ade84
-
SHA1
8863cc68bc0d0d813a0c6689ddee3fbe2d8f9888
-
SHA256
4bfb848ca54ce50688857ee50399b9af8b755d916ce502ff3e0107816ada44cf
-
SHA512
e7a97fc441d8d3f3c62575f6ad0c2c37c10e7968c327c30a6329059269611dd311af28e0687ef6b6d6e37ef248025b3095d6fac4d76efd2307855882ba5a2db5
-
SSDEEP
12288:hef9MTeKoFU8Pv7aJPfhfnuBYscce+UGy8imJMou2Imc:sfYLoFDuppfnuBY1+UGJ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2092 systemntfy.exe 1136 systemntfy.exe 2704 systemntfy.exe 2648 systemntfy.exe 2236 systemntfy.exe 1172 systemntfy.exe 2036 systemntfy.exe 2504 systemntfy.exe 2020 systemntfy.exe 2940 systemntfy.exe 1872 systemntfy.exe 2216 systemntfy.exe 796 systemntfy.exe 952 systemntfy.exe 988 systemntfy.exe 1488 systemntfy.exe 932 systemntfy.exe 1976 systemntfy.exe 552 systemntfy.exe 1672 systemntfy.exe 2564 systemntfy.exe 2376 systemntfy.exe 2416 systemntfy.exe 2688 systemntfy.exe 1632 systemntfy.exe 2724 systemntfy.exe 2768 systemntfy.exe 2612 systemntfy.exe 2320 systemntfy.exe 2844 systemntfy.exe 444 systemntfy.exe 2372 systemntfy.exe 2656 systemntfy.exe 2032 systemntfy.exe 2900 systemntfy.exe 2432 systemntfy.exe 2524 systemntfy.exe 2956 systemntfy.exe 704 systemntfy.exe 1600 systemntfy.exe 340 systemntfy.exe 1796 systemntfy.exe 2184 systemntfy.exe 2180 systemntfy.exe 2000 systemntfy.exe 1980 systemntfy.exe 1680 systemntfy.exe 808 systemntfy.exe 1672 systemntfy.exe 2360 systemntfy.exe 2424 systemntfy.exe 2412 systemntfy.exe 2416 systemntfy.exe 2688 systemntfy.exe 2820 systemntfy.exe 2732 systemntfy.exe 2880 systemntfy.exe 2608 systemntfy.exe 2628 systemntfy.exe 2640 systemntfy.exe 1172 systemntfy.exe 264 systemntfy.exe 1904 systemntfy.exe 1644 systemntfy.exe -
Loads dropped DLL 64 IoCs
pid Process 2412 c9683c5b615f00d260307e04239ade84_JaffaCakes118.exe 2412 c9683c5b615f00d260307e04239ade84_JaffaCakes118.exe 2092 systemntfy.exe 2092 systemntfy.exe 2092 systemntfy.exe 1136 systemntfy.exe 1136 systemntfy.exe 1136 systemntfy.exe 2704 systemntfy.exe 2704 systemntfy.exe 2704 systemntfy.exe 2648 systemntfy.exe 2648 systemntfy.exe 2648 systemntfy.exe 2236 systemntfy.exe 2236 systemntfy.exe 2236 systemntfy.exe 1172 systemntfy.exe 1172 systemntfy.exe 1172 systemntfy.exe 2036 systemntfy.exe 2036 systemntfy.exe 2036 systemntfy.exe 2504 systemntfy.exe 2504 systemntfy.exe 2504 systemntfy.exe 2020 systemntfy.exe 2020 systemntfy.exe 2020 systemntfy.exe 2940 systemntfy.exe 2940 systemntfy.exe 2940 systemntfy.exe 1872 systemntfy.exe 1872 systemntfy.exe 1872 systemntfy.exe 2216 systemntfy.exe 2216 systemntfy.exe 2216 systemntfy.exe 796 systemntfy.exe 796 systemntfy.exe 796 systemntfy.exe 952 systemntfy.exe 952 systemntfy.exe 952 systemntfy.exe 988 systemntfy.exe 988 systemntfy.exe 988 systemntfy.exe 1488 systemntfy.exe 1488 systemntfy.exe 1488 systemntfy.exe 932 systemntfy.exe 932 systemntfy.exe 932 systemntfy.exe 1976 systemntfy.exe 1976 systemntfy.exe 1976 systemntfy.exe 552 systemntfy.exe 552 systemntfy.exe 552 systemntfy.exe 1672 systemntfy.exe 1672 systemntfy.exe 1672 systemntfy.exe 2564 systemntfy.exe 2564 systemntfy.exe -
resource yara_rule behavioral1/memory/2412-0-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/files/0x0007000000012118-6.dat upx behavioral1/memory/2092-14-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2412-15-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2092-19-0x0000000003D90000-0x0000000003DA0000-memory.dmp upx behavioral1/memory/1136-23-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2092-24-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/1136-29-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2704-31-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2704-37-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2648-38-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2236-45-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2648-42-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2236-52-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/1172-54-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2036-62-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/1172-60-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/1172-59-0x0000000005380000-0x0000000005452000-memory.dmp upx behavioral1/memory/2036-70-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2504-78-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2236-76-0x0000000003D90000-0x0000000003E62000-memory.dmp upx behavioral1/memory/2020-85-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2940-90-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2216-97-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/1872-98-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/796-104-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2216-102-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/796-110-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/952-109-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/952-112-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/988-114-0x0000000003E40000-0x0000000003F12000-memory.dmp upx behavioral1/memory/1488-115-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/988-116-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/1488-119-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/952-120-0x0000000003C60000-0x0000000003D32000-memory.dmp upx behavioral1/memory/1976-123-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/932-124-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/1976-125-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/552-126-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/552-130-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/1672-129-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2564-132-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/1672-131-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2376-136-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2564-137-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2376-139-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2688-141-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2416-142-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2688-144-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/1632-145-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/1632-147-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2724-146-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2724-149-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2612-151-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2768-152-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2612-154-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2844-155-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2320-156-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/444-157-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2844-158-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/444-159-0x0000000000400000-0x00000000004D2000-memory.dmp upx behavioral1/memory/2372-160-0x0000000000400000-0x00000000004D2000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\systemntfy = "C:\\Windows\\system32\\systemntfy.exe" c9683c5b615f00d260307e04239ade84_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\systemntfy.exe c9683c5b615f00d260307e04239ade84_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\systemntfy.exe c9683c5b615f00d260307e04239ade84_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systemntfy.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2092 2412 c9683c5b615f00d260307e04239ade84_JaffaCakes118.exe 30 PID 2412 wrote to memory of 2092 2412 c9683c5b615f00d260307e04239ade84_JaffaCakes118.exe 30 PID 2412 wrote to memory of 2092 2412 c9683c5b615f00d260307e04239ade84_JaffaCakes118.exe 30 PID 2412 wrote to memory of 2092 2412 c9683c5b615f00d260307e04239ade84_JaffaCakes118.exe 30 PID 2092 wrote to memory of 1136 2092 systemntfy.exe 31 PID 2092 wrote to memory of 1136 2092 systemntfy.exe 31 PID 2092 wrote to memory of 1136 2092 systemntfy.exe 31 PID 2092 wrote to memory of 1136 2092 systemntfy.exe 31 PID 1136 wrote to memory of 2704 1136 systemntfy.exe 32 PID 1136 wrote to memory of 2704 1136 systemntfy.exe 32 PID 1136 wrote to memory of 2704 1136 systemntfy.exe 32 PID 1136 wrote to memory of 2704 1136 systemntfy.exe 32 PID 2704 wrote to memory of 2648 2704 systemntfy.exe 33 PID 2704 wrote to memory of 2648 2704 systemntfy.exe 33 PID 2704 wrote to memory of 2648 2704 systemntfy.exe 33 PID 2704 wrote to memory of 2648 2704 systemntfy.exe 33 PID 2648 wrote to memory of 2236 2648 systemntfy.exe 34 PID 2648 wrote to memory of 2236 2648 systemntfy.exe 34 PID 2648 wrote to memory of 2236 2648 systemntfy.exe 34 PID 2648 wrote to memory of 2236 2648 systemntfy.exe 34 PID 2236 wrote to memory of 1172 2236 systemntfy.exe 35 PID 2236 wrote to memory of 1172 2236 systemntfy.exe 35 PID 2236 wrote to memory of 1172 2236 systemntfy.exe 35 PID 2236 wrote to memory of 1172 2236 systemntfy.exe 35 PID 1172 wrote to memory of 2036 1172 systemntfy.exe 36 PID 1172 wrote to memory of 2036 1172 systemntfy.exe 36 PID 1172 wrote to memory of 2036 1172 systemntfy.exe 36 PID 1172 wrote to memory of 2036 1172 systemntfy.exe 36 PID 2036 wrote to memory of 2504 2036 systemntfy.exe 37 PID 2036 wrote to memory of 2504 2036 systemntfy.exe 37 PID 2036 wrote to memory of 2504 2036 systemntfy.exe 37 PID 2036 wrote to memory of 2504 2036 systemntfy.exe 37 PID 2504 wrote to memory of 2020 2504 systemntfy.exe 38 PID 2504 wrote to memory of 2020 2504 systemntfy.exe 38 PID 2504 wrote to memory of 2020 2504 systemntfy.exe 38 PID 2504 wrote to memory of 2020 2504 systemntfy.exe 38 PID 2020 wrote to memory of 2940 2020 systemntfy.exe 39 PID 2020 wrote to memory of 2940 2020 systemntfy.exe 39 PID 2020 wrote to memory of 2940 2020 systemntfy.exe 39 PID 2020 wrote to memory of 2940 2020 systemntfy.exe 39 PID 2940 wrote to memory of 1872 2940 systemntfy.exe 40 PID 2940 wrote to memory of 1872 2940 systemntfy.exe 40 PID 2940 wrote to memory of 1872 2940 systemntfy.exe 40 PID 2940 wrote to memory of 1872 2940 systemntfy.exe 40 PID 1872 wrote to memory of 2216 1872 systemntfy.exe 41 PID 1872 wrote to memory of 2216 1872 systemntfy.exe 41 PID 1872 wrote to memory of 2216 1872 systemntfy.exe 41 PID 1872 wrote to memory of 2216 1872 systemntfy.exe 41 PID 2216 wrote to memory of 796 2216 systemntfy.exe 42 PID 2216 wrote to memory of 796 2216 systemntfy.exe 42 PID 2216 wrote to memory of 796 2216 systemntfy.exe 42 PID 2216 wrote to memory of 796 2216 systemntfy.exe 42 PID 796 wrote to memory of 952 796 systemntfy.exe 43 PID 796 wrote to memory of 952 796 systemntfy.exe 43 PID 796 wrote to memory of 952 796 systemntfy.exe 43 PID 796 wrote to memory of 952 796 systemntfy.exe 43 PID 952 wrote to memory of 988 952 systemntfy.exe 44 PID 952 wrote to memory of 988 952 systemntfy.exe 44 PID 952 wrote to memory of 988 952 systemntfy.exe 44 PID 952 wrote to memory of 988 952 systemntfy.exe 44 PID 988 wrote to memory of 1488 988 systemntfy.exe 45 PID 988 wrote to memory of 1488 988 systemntfy.exe 45 PID 988 wrote to memory of 1488 988 systemntfy.exe 45 PID 988 wrote to memory of 1488 988 systemntfy.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9683c5b615f00d260307e04239ade84_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c9683c5b615f00d260307e04239ade84_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1976 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1672 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"23⤵
- Executes dropped EXE
PID:2376 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"24⤵
- Executes dropped EXE
PID:2416 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"25⤵
- Executes dropped EXE
PID:2688 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1632 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2724 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"28⤵
- Executes dropped EXE
PID:2768 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"29⤵
- Executes dropped EXE
PID:2612 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"30⤵
- Executes dropped EXE
PID:2320 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"31⤵
- Executes dropped EXE
PID:2844 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"32⤵
- Executes dropped EXE
PID:444 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"33⤵
- Executes dropped EXE
PID:2372 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"34⤵
- Executes dropped EXE
PID:2656 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"35⤵
- Executes dropped EXE
PID:2032 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"36⤵
- Executes dropped EXE
PID:2900 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"37⤵
- Executes dropped EXE
PID:2432 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"38⤵
- Executes dropped EXE
PID:2524 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2956 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"40⤵
- Executes dropped EXE
PID:704 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"41⤵
- Executes dropped EXE
PID:1600 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"42⤵
- Executes dropped EXE
PID:340 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1796 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"44⤵
- Executes dropped EXE
PID:2184 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"45⤵
- Executes dropped EXE
PID:2180 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2000 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1980 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"48⤵
- Executes dropped EXE
PID:1680 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"49⤵
- Executes dropped EXE
PID:808 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"50⤵
- Executes dropped EXE
PID:1672 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"51⤵
- Executes dropped EXE
PID:2360 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"52⤵
- Executes dropped EXE
PID:2424 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2412 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"54⤵
- Executes dropped EXE
PID:2416 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2688 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"56⤵
- Executes dropped EXE
PID:2820 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"58⤵
- Executes dropped EXE
PID:2880 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2608 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"60⤵
- Executes dropped EXE
PID:2628 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"61⤵
- Executes dropped EXE
PID:2640 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"62⤵
- Executes dropped EXE
PID:1172 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"63⤵
- Executes dropped EXE
PID:264 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"64⤵
- Executes dropped EXE
PID:1904 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"65⤵
- Executes dropped EXE
PID:1644 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"66⤵PID:1768
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"67⤵PID:1080
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"68⤵PID:2220
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"69⤵PID:324
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"70⤵PID:1432
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"71⤵
- System Location Discovery: System Language Discovery
PID:1872 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"72⤵PID:2988
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"73⤵
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"74⤵
- System Location Discovery: System Language Discovery
PID:396 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"75⤵
- System Location Discovery: System Language Discovery
PID:2136 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"76⤵
- System Location Discovery: System Language Discovery
PID:640 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"77⤵PID:1652
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"78⤵PID:904
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"79⤵
- System Location Discovery: System Language Discovery
PID:1312 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"80⤵PID:3056
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"81⤵PID:1976
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"82⤵PID:552
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"83⤵
- System Location Discovery: System Language Discovery
PID:1684 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"84⤵PID:1584
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"85⤵PID:2564
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"86⤵PID:2284
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"87⤵PID:2276
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"88⤵PID:828
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"89⤵PID:1896
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"90⤵PID:1212
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"91⤵PID:2896
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"92⤵
- System Location Discovery: System Language Discovery
PID:2592 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"93⤵PID:2768
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"94⤵
- System Location Discovery: System Language Discovery
PID:1364 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"95⤵PID:536
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"96⤵PID:1088
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"97⤵PID:468
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"98⤵PID:1508
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"99⤵
- System Location Discovery: System Language Discovery
PID:2836 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"100⤵
- System Location Discovery: System Language Discovery
PID:1056 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"101⤵PID:1080
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"102⤵PID:2400
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"103⤵PID:2304
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"104⤵PID:2064
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"105⤵PID:1892
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"106⤵
- System Location Discovery: System Language Discovery
PID:1960 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"107⤵
- System Location Discovery: System Language Discovery
PID:616 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"108⤵PID:1800
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"109⤵PID:1188
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"110⤵PID:1268
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"111⤵PID:1388
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"112⤵PID:3000
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"113⤵PID:2180
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"114⤵
- System Location Discovery: System Language Discovery
PID:2000 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"115⤵
- System Location Discovery: System Language Discovery
PID:3040 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"116⤵PID:2544
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"117⤵
- System Location Discovery: System Language Discovery
PID:1580 -
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"118⤵PID:2408
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"119⤵PID:2396
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"120⤵PID:2336
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"121⤵PID:2444
-
C:\Windows\SysWOW64\systemntfy.exe"C:\Windows\system32\systemntfy.exe"122⤵PID:2416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-