Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11/09/2024, 04:20
General
-
Target
d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe
-
Size
744KB
-
MD5
d999e95e47e14ed78bcf82903f5066e4
-
SHA1
dbced72e51a1d77e0bfea0920bc046ae24d211e3
-
SHA256
5ace2068d59ec186031434b1290a6341d0b237625caefebfefda792797d456bd
-
SHA512
c83bba4a38335242ffff6ea2ef95ef23cd63877dd987a8a48ddc6a586109aac61d1e164ce38cad954ec4f9e2c4a7569073a232d201caec96796d6432d7f4acd3
-
SSDEEP
12288:bVnxHTYOsbT6mPxKJekjyVgo5YYBKKSJQ1og9W5/cxdScCabuYyXi:9hTYqGK0KugjYBKlgW54iY/
Score
10/10
Malware Config
Signatures
-
UAC bypass 3 TTPs 64 IoCs
-
Checks whether UAC is enabled 1 TTPs 64 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 9 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 25 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe3⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe6⤵
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe7⤵
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe8⤵
- UAC bypass
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe9⤵
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe10⤵
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe11⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe12⤵
- UAC bypass
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe14⤵
- UAC bypass
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe15⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe17⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe18⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe19⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe20⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe21⤵
- UAC bypass
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe22⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe23⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe24⤵
- UAC bypass
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe25⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe26⤵
- UAC bypass
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe27⤵
- UAC bypass
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe28⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe29⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe30⤵
- Checks whether UAC is enabled
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe31⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe32⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe33⤵
- UAC bypass
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe34⤵
- UAC bypass
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe35⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe36⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe37⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe38⤵
- UAC bypass
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe39⤵
- UAC bypass
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe40⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe41⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe42⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe43⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe44⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe45⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe46⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe47⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe48⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe49⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe50⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe51⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe52⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe53⤵
- UAC bypass
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe54⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe55⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe56⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe57⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe58⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe59⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe60⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe61⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe62⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe63⤵
- UAC bypass
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe64⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe65⤵
- Checks whether UAC is enabled
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe66⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe67⤵
- UAC bypass
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe68⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe69⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe70⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe71⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe72⤵
- UAC bypass
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe73⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe74⤵
- UAC bypass
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe75⤵
- UAC bypass
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe76⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe77⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe78⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe79⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe80⤵
- UAC bypass
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe81⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe82⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe83⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe84⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe85⤵
- UAC bypass
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe86⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe87⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe88⤵
- Checks whether UAC is enabled
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe89⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe90⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe91⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe92⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe93⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe94⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe95⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe96⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe97⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe98⤵
- UAC bypass
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe99⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe100⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe101⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe102⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe103⤵
- UAC bypass
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe104⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe105⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe106⤵
- UAC bypass
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe107⤵
- UAC bypass
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe108⤵
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe109⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe110⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe111⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe112⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe113⤵
- UAC bypass
- Checks whether UAC is enabled
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe114⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe115⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe116⤵
- UAC bypass
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe117⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe118⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe119⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe120⤵
-
C:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d999e95e47e14ed78bcf82903f5066e4_JaffaCakes118.exe121⤵
- UAC bypass
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-