Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2024 15:21
Static task
static1
Behavioral task
behavioral1
Sample
faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe
-
Size
186KB
-
MD5
faa68f4cac61953b31bd4fdf8e11f765
-
SHA1
62aa856e75853bd4c7b96fe20d2dc34b448944da
-
SHA256
b394810f960459d683316463f67f7c95a2b2cdc736573b0b021f630f1b5754e3
-
SHA512
663474d3724ad9e96038900044f4c9f096f482542d727e60b9e7a48f481c07e21e544926ae20c71e58d00967a064565e940c409c0775847593c60cc32f8cbb4d
-
SSDEEP
3072:4LbKuZKzXw2RjwkfqrIWUEbskfsmbL9Nn0uNFi+O0xShCzukYr+:ehKDHpwspcb4mn9Nr5OCgCzuBK
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 764 wuauolts.exe 3208 wuauolts.exe 4604 wuauolts.exe 4556 wuauolts.exe 3588 wuauolts.exe 1792 wuauolts.exe 864 wuauolts.exe 2448 wuauolts.exe 684 wuauolts.exe 2044 wuauolts.exe 1916 wuauolts.exe 1612 wuauolts.exe 3324 wuauolts.exe 2008 wuauolts.exe 208 wuauolts.exe 4764 wuauolts.exe 4808 wuauolts.exe 2428 wuauolts.exe 3528 wuauolts.exe 1748 wuauolts.exe 4900 wuauolts.exe 3188 wuauolts.exe 1036 wuauolts.exe 4420 wuauolts.exe 1412 wuauolts.exe 4380 wuauolts.exe 3748 wuauolts.exe 4752 wuauolts.exe 1540 wuauolts.exe 4324 wuauolts.exe 2924 wuauolts.exe 5072 wuauolts.exe 3596 wuauolts.exe 2672 wuauolts.exe 3436 wuauolts.exe 2272 wuauolts.exe 4496 wuauolts.exe 1048 wuauolts.exe 3844 wuauolts.exe 2416 wuauolts.exe 1348 wuauolts.exe 3868 wuauolts.exe 2668 wuauolts.exe 868 wuauolts.exe 3420 wuauolts.exe 856 wuauolts.exe 4868 wuauolts.exe 4404 wuauolts.exe 1104 wuauolts.exe 1716 wuauolts.exe 4860 wuauolts.exe 4596 wuauolts.exe 1948 wuauolts.exe 1872 wuauolts.exe 3220 wuauolts.exe 4360 wuauolts.exe 1876 wuauolts.exe 748 wuauolts.exe 2040 wuauolts.exe 1388 wuauolts.exe 364 wuauolts.exe 5012 wuauolts.exe 2120 wuauolts.exe 2760 wuauolts.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\z: wuauolts.exe File opened (read-only) \??\v: wuauolts.exe File opened (read-only) \??\t: Process not Found File opened (read-only) \??\l: wuauolts.exe File opened (read-only) \??\i: Process not Found File opened (read-only) \??\x: Process not Found File opened (read-only) \??\m: Process not Found File opened (read-only) \??\l: Process not Found File opened (read-only) \??\e: Process not Found File opened (read-only) \??\y: Process not Found File opened (read-only) \??\m: Process not Found File opened (read-only) \??\y: Process not Found File opened (read-only) \??\m: Process not Found File opened (read-only) \??\i: Process not Found File opened (read-only) \??\x: Process not Found File opened (read-only) \??\i: Process not Found File opened (read-only) \??\o: Process not Found File opened (read-only) \??\i: Process not Found File opened (read-only) \??\g: wuauolts.exe File opened (read-only) \??\m: wuauolts.exe File opened (read-only) \??\y: wuauolts.exe File opened (read-only) \??\n: Process not Found File opened (read-only) \??\h: Process not Found File opened (read-only) \??\l: Process not Found File opened (read-only) \??\r: Process not Found File opened (read-only) \??\m: Process not Found File opened (read-only) \??\i: wuauolts.exe File opened (read-only) \??\r: Process not Found File opened (read-only) \??\j: Process not Found File opened (read-only) \??\z: Process not Found File opened (read-only) \??\j: Process not Found File opened (read-only) \??\j: Process not Found File opened (read-only) \??\j: Process not Found File opened (read-only) \??\y: Process not Found File opened (read-only) \??\s: Process not Found File opened (read-only) \??\o: Process not Found File opened (read-only) \??\z: Process not Found File opened (read-only) \??\j: wuauolts.exe File opened (read-only) \??\w: wuauolts.exe File opened (read-only) \??\h: wuauolts.exe File opened (read-only) \??\v: Process not Found File opened (read-only) \??\s: Process not Found File opened (read-only) \??\x: Process not Found File opened (read-only) \??\g: Process not Found File opened (read-only) \??\v: Process not Found File opened (read-only) \??\j: wuauolts.exe File opened (read-only) \??\x: Process not Found File opened (read-only) \??\p: Process not Found File opened (read-only) \??\e: Process not Found File opened (read-only) \??\m: Process not Found File opened (read-only) \??\k: Process not Found File opened (read-only) \??\g: wuauolts.exe File opened (read-only) \??\e: wuauolts.exe File opened (read-only) \??\p: wuauolts.exe File opened (read-only) \??\e: Process not Found File opened (read-only) \??\s: Process not Found File opened (read-only) \??\z: wuauolts.exe File opened (read-only) \??\h: wuauolts.exe File opened (read-only) \??\i: Process not Found File opened (read-only) \??\e: Process not Found File opened (read-only) \??\k: Process not Found File opened (read-only) \??\t: wuauolts.exe File opened (read-only) \??\u: wuauolts.exe File opened (read-only) \??\s: wuauolts.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 1588 faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe 764 wuauolts.exe 3208 wuauolts.exe 4604 wuauolts.exe 4556 wuauolts.exe 3588 wuauolts.exe 1792 wuauolts.exe 864 wuauolts.exe 2448 wuauolts.exe 684 wuauolts.exe 2044 wuauolts.exe 1916 wuauolts.exe 1612 wuauolts.exe 3324 wuauolts.exe 2008 wuauolts.exe 208 wuauolts.exe 4764 wuauolts.exe 4808 wuauolts.exe 2428 wuauolts.exe 3528 wuauolts.exe 1748 wuauolts.exe 4900 wuauolts.exe 3188 wuauolts.exe 1036 wuauolts.exe 4420 wuauolts.exe 1412 wuauolts.exe 4380 wuauolts.exe 3748 wuauolts.exe 4752 wuauolts.exe 1540 wuauolts.exe 4324 wuauolts.exe 2924 wuauolts.exe 5072 wuauolts.exe 3596 wuauolts.exe 2672 wuauolts.exe 3436 wuauolts.exe 2272 wuauolts.exe 4496 wuauolts.exe 1048 wuauolts.exe 3844 wuauolts.exe 2416 wuauolts.exe 1348 wuauolts.exe 3868 wuauolts.exe 2668 wuauolts.exe 868 wuauolts.exe 3420 wuauolts.exe 856 wuauolts.exe 4868 wuauolts.exe 4404 wuauolts.exe 1104 wuauolts.exe 1716 wuauolts.exe 4860 wuauolts.exe 4596 wuauolts.exe 1948 wuauolts.exe 1872 wuauolts.exe 3220 wuauolts.exe 4360 wuauolts.exe 1876 wuauolts.exe 748 wuauolts.exe 2040 wuauolts.exe 1388 wuauolts.exe 364 wuauolts.exe 5012 wuauolts.exe 2120 wuauolts.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1588 wrote to memory of 764 1588 faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe 84 PID 1588 wrote to memory of 764 1588 faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe 84 PID 1588 wrote to memory of 764 1588 faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe 84 PID 764 wrote to memory of 3208 764 wuauolts.exe 85 PID 764 wrote to memory of 3208 764 wuauolts.exe 85 PID 764 wrote to memory of 3208 764 wuauolts.exe 85 PID 3208 wrote to memory of 4604 3208 wuauolts.exe 86 PID 3208 wrote to memory of 4604 3208 wuauolts.exe 86 PID 3208 wrote to memory of 4604 3208 wuauolts.exe 86 PID 4604 wrote to memory of 4556 4604 wuauolts.exe 87 PID 4604 wrote to memory of 4556 4604 wuauolts.exe 87 PID 4604 wrote to memory of 4556 4604 wuauolts.exe 87 PID 4556 wrote to memory of 3588 4556 wuauolts.exe 88 PID 4556 wrote to memory of 3588 4556 wuauolts.exe 88 PID 4556 wrote to memory of 3588 4556 wuauolts.exe 88 PID 3588 wrote to memory of 1792 3588 wuauolts.exe 89 PID 3588 wrote to memory of 1792 3588 wuauolts.exe 89 PID 3588 wrote to memory of 1792 3588 wuauolts.exe 89 PID 1792 wrote to memory of 864 1792 wuauolts.exe 90 PID 1792 wrote to memory of 864 1792 wuauolts.exe 90 PID 1792 wrote to memory of 864 1792 wuauolts.exe 90 PID 864 wrote to memory of 2448 864 wuauolts.exe 91 PID 864 wrote to memory of 2448 864 wuauolts.exe 91 PID 864 wrote to memory of 2448 864 wuauolts.exe 91 PID 2448 wrote to memory of 684 2448 wuauolts.exe 92 PID 2448 wrote to memory of 684 2448 wuauolts.exe 92 PID 2448 wrote to memory of 684 2448 wuauolts.exe 92 PID 684 wrote to memory of 2044 684 wuauolts.exe 93 PID 684 wrote to memory of 2044 684 wuauolts.exe 93 PID 684 wrote to memory of 2044 684 wuauolts.exe 93 PID 2044 wrote to memory of 1916 2044 wuauolts.exe 94 PID 2044 wrote to memory of 1916 2044 wuauolts.exe 94 PID 2044 wrote to memory of 1916 2044 wuauolts.exe 94 PID 1916 wrote to memory of 1612 1916 wuauolts.exe 95 PID 1916 wrote to memory of 1612 1916 wuauolts.exe 95 PID 1916 wrote to memory of 1612 1916 wuauolts.exe 95 PID 1612 wrote to memory of 3324 1612 wuauolts.exe 96 PID 1612 wrote to memory of 3324 1612 wuauolts.exe 96 PID 1612 wrote to memory of 3324 1612 wuauolts.exe 96 PID 3324 wrote to memory of 2008 3324 wuauolts.exe 97 PID 3324 wrote to memory of 2008 3324 wuauolts.exe 97 PID 3324 wrote to memory of 2008 3324 wuauolts.exe 97 PID 2008 wrote to memory of 208 2008 wuauolts.exe 98 PID 2008 wrote to memory of 208 2008 wuauolts.exe 98 PID 2008 wrote to memory of 208 2008 wuauolts.exe 98 PID 208 wrote to memory of 4764 208 wuauolts.exe 99 PID 208 wrote to memory of 4764 208 wuauolts.exe 99 PID 208 wrote to memory of 4764 208 wuauolts.exe 99 PID 4764 wrote to memory of 4808 4764 wuauolts.exe 100 PID 4764 wrote to memory of 4808 4764 wuauolts.exe 100 PID 4764 wrote to memory of 4808 4764 wuauolts.exe 100 PID 4808 wrote to memory of 2428 4808 wuauolts.exe 101 PID 4808 wrote to memory of 2428 4808 wuauolts.exe 101 PID 4808 wrote to memory of 2428 4808 wuauolts.exe 101 PID 2428 wrote to memory of 3528 2428 wuauolts.exe 102 PID 2428 wrote to memory of 3528 2428 wuauolts.exe 102 PID 2428 wrote to memory of 3528 2428 wuauolts.exe 102 PID 3528 wrote to memory of 1748 3528 wuauolts.exe 103 PID 3528 wrote to memory of 1748 3528 wuauolts.exe 103 PID 3528 wrote to memory of 1748 3528 wuauolts.exe 103 PID 1748 wrote to memory of 4900 1748 wuauolts.exe 104 PID 1748 wrote to memory of 4900 1748 wuauolts.exe 104 PID 1748 wrote to memory of 4900 1748 wuauolts.exe 104 PID 4900 wrote to memory of 3188 4900 wuauolts.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe8⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe12⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe13⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe14⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe15⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe16⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe17⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe18⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe19⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe20⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe21⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe22⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe23⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3188 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe24⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1036 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe25⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4420 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe26⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1412 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe27⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4380 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe28⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3748 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe29⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4752 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe30⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1540 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe31⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4324 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe32⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2924 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe33⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5072 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe34⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3596 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe35⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2672 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe36⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3436 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe37⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2272 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe38⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4496 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1048 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe40⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3844 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe41⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2416 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe42⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1348 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe43⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3868 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe44⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2668 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe45⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:868 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe46⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3420 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe47⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:856 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe48⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4868 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe49⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4404 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe50⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1104 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe51⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1716 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe52⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4860 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe53⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4596 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe54⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1948 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe55⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1872 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe56⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3220 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe57⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4360 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe58⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1876 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe59⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:748 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe60⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2040 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe61⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1388 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe62⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:364 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe63⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5012 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe64⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2120 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe65⤵
- Executes dropped EXE
PID:2760 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe66⤵PID:1836
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe67⤵PID:640
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe68⤵PID:1692
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe69⤵PID:1052
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe70⤵PID:1468
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe71⤵PID:216
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe72⤵PID:376
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe73⤵PID:1920
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe74⤵PID:4724
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe75⤵PID:2364
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe76⤵PID:4508
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe77⤵PID:8
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe78⤵PID:4988
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe79⤵PID:3644
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe80⤵PID:2824
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe81⤵PID:1812
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe82⤵PID:644
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe83⤵PID:3044
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe84⤵PID:2456
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe85⤵PID:2932
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe86⤵PID:2396
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe87⤵
- Drops file in System32 directory
PID:2332 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe88⤵PID:2596
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe89⤵PID:2928
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe90⤵PID:4484
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe91⤵PID:3744
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe92⤵PID:5144
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe93⤵PID:5172
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe94⤵PID:5200
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe95⤵PID:5228
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe96⤵PID:5256
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe97⤵PID:5284
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe98⤵PID:5316
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe99⤵
- System Location Discovery: System Language Discovery
PID:5344 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe100⤵PID:5372
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe101⤵PID:5400
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe102⤵PID:5428
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe103⤵PID:5456
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe104⤵PID:5488
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe105⤵PID:5516
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe106⤵PID:5544
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe107⤵PID:5572
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe108⤵
- Enumerates connected drives
PID:5600 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe109⤵PID:5632
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe110⤵PID:5660
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe111⤵PID:5692
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe112⤵PID:5720
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe113⤵PID:5748
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe114⤵PID:5776
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe115⤵PID:5808
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe116⤵PID:5836
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe117⤵
- Enumerates connected drives
PID:5900 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe118⤵PID:5932
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe119⤵PID:5964
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe120⤵PID:5996
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe121⤵PID:6024
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe122⤵PID:6052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-