Analysis
-
max time kernel
61s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-10-2024 08:14
Behavioral task
behavioral1
Sample
1289cb9081b3188951ad7a023f352fc0_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
1289cb9081b3188951ad7a023f352fc0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
1289cb9081b3188951ad7a023f352fc0_JaffaCakes118.exe
-
Size
848KB
-
MD5
1289cb9081b3188951ad7a023f352fc0
-
SHA1
180ec90692c7062292ee1a2e3dabbc8fa044d16e
-
SHA256
f76a3936bbb22480dbf41a676ccf8fe5d4f1e3a51c77868a36217c10cf1100fe
-
SHA512
ffcf553cfbca916e76ea4ef92f6b18cae8e20fd9efeb90e9c3e478acb97bb9b9a654c4959392ee4760c825677c43fd607ec76fa6d0c0dcaf1e6dd46bda8d54cc
-
SSDEEP
12288:jJgAUN5yymszEDoH5lMTRmzF+xkRqBAH+T+sRgkgmZrQUDpu:q5yydIcZlkmzE2ABMctiI8eu
Score
8/10
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\aesabbjj srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\hmei\StubPath = "C:\\Windows\\system32\\hmei.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\twiq\StubPath = "C:\\Windows\\system32\\twiq.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\dvooqm\StubPath = "C:\\Windows\\system32\\dvooqm.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\dalry\StubPath = "C:\\Windows\\system32\\dalry.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\dorbppnr\StubPath = "C:\\Windows\\system32\\dorbppnr.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\glphyawb\StubPath = "C:\\Windows\\system32\\glphyawb.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\gqplen\StubPath = "C:\\Windows\\system32\\gqplen.exe" srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\myotebk srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\ofoa\StubPath = "C:\\Windows\\system32\\ofoa.exe" 1289cb9081b3188951ad7a023f352fc0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\ttydpqal\StubPath = "C:\\Windows\\system32\\ttydpqal.exe" srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\gtpoaboj srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\fmlnwf srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\bwiwycs srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\hkgqprd srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\hkgqprd\StubPath = "C:\\Windows\\system32\\hkgqprd.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\bocgjc\StubPath = "C:\\Windows\\system32\\bocgjc.exe" srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\xmfqu srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\lntehhr\StubPath = "C:\\Windows\\system32\\lntehhr.exe" srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\imtdo srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\wlkpf\StubPath = "C:\\Windows\\system32\\wlkpf.exe" srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\vqoek srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\sukple srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\nunwla\StubPath = "C:\\Windows\\system32\\nunwla.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\wuqssqmh\StubPath = "C:\\Windows\\system32\\wuqssqmh.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\cikhkxfd\StubPath = "C:\\Windows\\system32\\cikhkxfd.exe" srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\tkjur srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\gtpoaboj\StubPath = "C:\\Windows\\system32\\gtpoaboj.exe" srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\fhhv srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\uhmjhf srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\yvbi\StubPath = "C:\\Windows\\system32\\yvbi.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\jqlnbn\StubPath = "C:\\Windows\\system32\\jqlnbn.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\wfmjqbmd\StubPath = "C:\\Windows\\system32\\wfmjqbmd.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\odqiey\StubPath = "C:\\Windows\\system32\\odqiey.exe" srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\pdsvf srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\jdco\StubPath = "C:\\Windows\\system32\\jdco.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\krixwqr\StubPath = "C:\\Windows\\system32\\krixwqr.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\vwdncsgk\StubPath = "C:\\Windows\\system32\\vwdncsgk.exe" srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\drcvk srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\cphywnr\StubPath = "C:\\Windows\\system32\\cphywnr.exe" srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\nbqj srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\nfrgl srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\vpbhmp\StubPath = "C:\\Windows\\system32\\vpbhmp.exe" srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\vcfnsyc srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\ytep\StubPath = "C:\\Windows\\system32\\ytep.exe" srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\nfcwlsa srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\nacsgr\StubPath = "C:\\Windows\\system32\\nacsgr.exe" srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\iqbu srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\dalry srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\udanpo\StubPath = "C:\\Windows\\system32\\udanpo.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\qssykydu\StubPath = "C:\\Windows\\system32\\qssykydu.exe" srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\ubllgq srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\fdty srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\qxvebb\StubPath = "C:\\Windows\\system32\\qxvebb.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\agpshqyu\StubPath = "C:\\Windows\\system32\\agpshqyu.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\pbrm\StubPath = "C:\\Windows\\system32\\pbrm.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\novdxvdp\StubPath = "C:\\Windows\\system32\\novdxvdp.exe" srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\evdghdow srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\niftspr\StubPath = "C:\\Windows\\system32\\niftspr.exe" srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\mfhnuuba\StubPath = "C:\\Windows\\system32\\mfhnuuba.exe" srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\gqplen srv32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\uqlmg\StubPath = "C:\\Windows\\system32\\uqlmg.exe" srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\odqiey srv32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\ggwpu srv32.exe -
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe File opened for modification C:\Windows\system32\drivers\etc\services srv32.exe -
ACProtect 1.3x - 1.4x DLL software 6 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0005000000019642-83.dat acprotect behavioral1/files/0x000500000001964a-84.dat acprotect behavioral1/files/0x000500000001964b-85.dat acprotect behavioral1/files/0x00050000000197c2-86.dat acprotect behavioral1/files/0x0005000000019a72-87.dat acprotect behavioral1/files/0x0005000000019b0f-89.dat acprotect -
Executes dropped EXE 64 IoCs
pid Process 1608 srv32.exe 2852 srv32.exe 2860 srv32.exe 2628 srv32.exe 2468 srv32.exe 1936 srv32.exe 2160 srv32.exe 828 srv32.exe 1080 srv32.exe 2924 srv32.exe 1356 srv32.exe 328 srv32.exe 1148 srv32.exe 1708 srv32.exe 2828 srv32.exe 3060 srv32.exe 2748 srv32.exe 2636 srv32.exe 2000 srv32.exe 2172 srv32.exe 2084 srv32.exe 1320 srv32.exe 680 srv32.exe 940 srv32.exe 2168 srv32.exe 1816 srv32.exe 2512 srv32.exe 1604 srv32.exe 352 srv32.exe 2808 srv32.exe 2968 srv32.exe 2916 srv32.exe 2772 srv32.exe 620 srv32.exe 1788 srv32.exe 2188 srv32.exe 852 srv32.exe 2276 srv32.exe 2300 srv32.exe 1732 srv32.exe 2488 srv32.exe 1744 srv32.exe 2348 srv32.exe 3048 srv32.exe 1608 srv32.exe 2796 srv32.exe 2332 srv32.exe 764 srv32.exe 2212 srv32.exe 1476 srv32.exe 1704 srv32.exe 1124 srv32.exe 2548 srv32.exe 1940 srv32.exe 1432 srv32.exe 1532 srv32.exe 904 srv32.exe 2364 srv32.exe 2512 srv32.exe 2072 srv32.exe 2884 srv32.exe 2708 srv32.exe 2588 srv32.exe 780 srv32.exe -
Loads dropped DLL 64 IoCs
pid Process 1708 1289cb9081b3188951ad7a023f352fc0_JaffaCakes118.exe 1708 1289cb9081b3188951ad7a023f352fc0_JaffaCakes118.exe 1608 srv32.exe 1608 srv32.exe 2852 srv32.exe 2852 srv32.exe 2860 srv32.exe 2860 srv32.exe 2628 srv32.exe 2628 srv32.exe 2468 srv32.exe 2468 srv32.exe 1936 srv32.exe 1936 srv32.exe 2160 srv32.exe 2160 srv32.exe 828 srv32.exe 828 srv32.exe 1080 srv32.exe 1080 srv32.exe 2924 srv32.exe 2924 srv32.exe 1356 srv32.exe 1356 srv32.exe 328 srv32.exe 328 srv32.exe 1148 srv32.exe 1148 srv32.exe 1708 srv32.exe 1708 srv32.exe 2828 srv32.exe 2828 srv32.exe 3060 srv32.exe 3060 srv32.exe 2748 srv32.exe 2748 srv32.exe 2636 srv32.exe 2636 srv32.exe 2000 srv32.exe 2000 srv32.exe 2172 srv32.exe 2172 srv32.exe 2084 srv32.exe 2084 srv32.exe 1320 srv32.exe 1320 srv32.exe 680 srv32.exe 680 srv32.exe 940 srv32.exe 940 srv32.exe 2168 srv32.exe 2168 srv32.exe 1816 srv32.exe 1816 srv32.exe 2512 srv32.exe 2512 srv32.exe 1604 srv32.exe 1604 srv32.exe 352 srv32.exe 352 srv32.exe 2808 srv32.exe 2808 srv32.exe 2968 srv32.exe 2968 srv32.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wkjjwgx.siq srv32.exe File created C:\Windows\SysWOW64\shess.xgn srv32.exe File created C:\Windows\SysWOW64\abuhp.kka srv32.exe File opened for modification C:\Windows\SysWOW64\cctxfst.exe srv32.exe File created C:\Windows\SysWOW64\ivglnns.aqq srv32.exe File opened for modification C:\Windows\SysWOW64\jtkahgn.exe srv32.exe File created C:\Windows\SysWOW64\dqtdyfkv.rix srv32.exe File created C:\Windows\SysWOW64\kdfciwy.tol srv32.exe File created C:\Windows\SysWOW64\imrsd.kqv srv32.exe File created C:\Windows\SysWOW64\fodhs.har srv32.exe File created C:\Windows\SysWOW64\uqabt.vdr srv32.exe File opened for modification C:\Windows\SysWOW64\ygnytfvk.exe srv32.exe File created C:\Windows\SysWOW64\tkjkcwwm.anc srv32.exe File created C:\Windows\SysWOW64\fdxh.yfq srv32.exe File opened for modification C:\Windows\SysWOW64\jdco.exe srv32.exe File created C:\Windows\SysWOW64\nfkfywbs.vgm srv32.exe File opened for modification C:\Windows\SysWOW64\vulqdgqw.exe srv32.exe File opened for modification C:\Windows\SysWOW64\aedowkx.exe srv32.exe File created C:\Windows\SysWOW64\rgbd.emc srv32.exe File created C:\Windows\SysWOW64\ovgvyv.tas srv32.exe File created C:\Windows\SysWOW64\kpkf.mka srv32.exe File created C:\Windows\SysWOW64\mcxanyj.tgk srv32.exe File opened for modification C:\Windows\SysWOW64\vwydcp.exe srv32.exe File created C:\Windows\SysWOW64\plpyhc.pvj srv32.exe File created C:\Windows\SysWOW64\uvdaolqd.bvh srv32.exe File created C:\Windows\SysWOW64\admb.mmi srv32.exe File created C:\Windows\SysWOW64\enacs.ujm srv32.exe File created C:\Windows\SysWOW64\qcgru.iow srv32.exe File created C:\Windows\SysWOW64\wrgwx.ksp srv32.exe File created C:\Windows\SysWOW64\saja.cft srv32.exe File created C:\Windows\SysWOW64\kqmd.exe srv32.exe File created C:\Windows\SysWOW64\dvooqm.yqw srv32.exe File created C:\Windows\SysWOW64\qrudx.ucp srv32.exe File created C:\Windows\SysWOW64\rgvqfech.vde srv32.exe File created C:\Windows\SysWOW64\dalry.enc srv32.exe File created C:\Windows\SysWOW64\jlhv.syi srv32.exe File created C:\Windows\SysWOW64\akxvpqn.ktn srv32.exe File created C:\Windows\SysWOW64\ntfe.bju srv32.exe File created C:\Windows\SysWOW64\srv32.exe srv32.exe File created C:\Windows\SysWOW64\srv32.exe srv32.exe File created C:\Windows\SysWOW64\dalry.exe srv32.exe File opened for modification C:\Windows\SysWOW64\asdgetwa.exe srv32.exe File created C:\Windows\SysWOW64\awnyw.dhr srv32.exe File created C:\Windows\SysWOW64\dcqpuraq.wop srv32.exe File created C:\Windows\SysWOW64\kvgm.fqp srv32.exe File created C:\Windows\SysWOW64\segekwhh.efe srv32.exe File created C:\Windows\SysWOW64\srv32.exe srv32.exe File created C:\Windows\SysWOW64\eiqqbpmy.exe srv32.exe File created C:\Windows\SysWOW64\yfxpu.sxd srv32.exe File created C:\Windows\SysWOW64\xgmk.qfk srv32.exe File created C:\Windows\SysWOW64\kqmd.lpe srv32.exe File opened for modification C:\Windows\SysWOW64\siiu.exe srv32.exe File created C:\Windows\SysWOW64\srv32.exe srv32.exe File created C:\Windows\SysWOW64\okixrc.int srv32.exe File created C:\Windows\SysWOW64\srv32.exe srv32.exe File created C:\Windows\SysWOW64\umjjn.kad srv32.exe File created C:\Windows\SysWOW64\nsqeekc.hgh srv32.exe File created C:\Windows\SysWOW64\txab.irr srv32.exe File created C:\Windows\SysWOW64\kstu.ymf srv32.exe File created C:\Windows\SysWOW64\kanimtan.okq srv32.exe File created C:\Windows\SysWOW64\mrlkqrg.kvg srv32.exe File created C:\Windows\SysWOW64\dgwiye.kwc srv32.exe File created C:\Windows\SysWOW64\rtlxxue.dmr srv32.exe File created C:\Windows\SysWOW64\avgny.pds srv32.exe -
resource yara_rule behavioral1/memory/1708-0-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/files/0x00060000000190e1-13.dat upx behavioral1/memory/1608-24-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1708-23-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2852-43-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1608-41-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2860-63-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2852-62-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2860-79-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/files/0x0005000000019642-83.dat upx behavioral1/files/0x000500000001964a-84.dat upx behavioral1/files/0x000500000001964b-85.dat upx behavioral1/files/0x00050000000197c2-86.dat upx behavioral1/files/0x0005000000019a72-87.dat upx behavioral1/files/0x0005000000019b0f-89.dat upx behavioral1/memory/2628-98-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2468-99-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2468-117-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2160-137-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1936-136-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2160-153-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/828-173-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1080-171-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2924-191-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1080-189-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2924-208-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1356-224-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1148-243-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/328-242-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1148-261-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1708-280-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2828-298-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/3060-312-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2748-325-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2636-339-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2000-340-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2000-353-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2172-366-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2084-367-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2084-381-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/680-394-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1320-396-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/680-409-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2168-424-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/940-423-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2168-437-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2512-452-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1816-451-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2512-465-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/352-481-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1604-480-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2808-496-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/352-495-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2968-510-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2808-512-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2968-525-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2772-540-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2916-539-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2772-552-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1788-566-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/620-565-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1788-580-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2188-596-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/852-594-0x0000000000400000-0x000000000042B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1289cb9081b3188951ad7a023f352fc0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language srv32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSystemtimePrivilege 1708 1289cb9081b3188951ad7a023f352fc0_JaffaCakes118.exe Token: SeSystemtimePrivilege 1708 1289cb9081b3188951ad7a023f352fc0_JaffaCakes118.exe Token: SeSystemtimePrivilege 1708 1289cb9081b3188951ad7a023f352fc0_JaffaCakes118.exe Token: SeSystemtimePrivilege 1708 1289cb9081b3188951ad7a023f352fc0_JaffaCakes118.exe Token: SeSystemtimePrivilege 1608 srv32.exe Token: SeSystemtimePrivilege 1608 srv32.exe Token: SeSystemtimePrivilege 1608 srv32.exe Token: SeSystemtimePrivilege 1608 srv32.exe Token: SeSystemtimePrivilege 2852 srv32.exe Token: SeSystemtimePrivilege 2852 srv32.exe Token: SeSystemtimePrivilege 2852 srv32.exe Token: SeSystemtimePrivilege 2852 srv32.exe Token: SeSystemtimePrivilege 2860 srv32.exe Token: SeSystemtimePrivilege 2860 srv32.exe Token: SeSystemtimePrivilege 2860 srv32.exe Token: SeSystemtimePrivilege 2860 srv32.exe Token: SeSystemtimePrivilege 2628 srv32.exe Token: SeSystemtimePrivilege 2628 srv32.exe Token: SeSystemtimePrivilege 2628 srv32.exe Token: SeSystemtimePrivilege 2628 srv32.exe Token: SeSystemtimePrivilege 2468 srv32.exe Token: SeSystemtimePrivilege 2468 srv32.exe Token: SeSystemtimePrivilege 2468 srv32.exe Token: SeSystemtimePrivilege 2468 srv32.exe Token: SeSystemtimePrivilege 1936 srv32.exe Token: SeSystemtimePrivilege 1936 srv32.exe Token: SeSystemtimePrivilege 1936 srv32.exe Token: SeSystemtimePrivilege 1936 srv32.exe Token: SeSystemtimePrivilege 2160 srv32.exe Token: SeSystemtimePrivilege 2160 srv32.exe Token: SeSystemtimePrivilege 2160 srv32.exe Token: SeSystemtimePrivilege 2160 srv32.exe Token: SeSystemtimePrivilege 828 srv32.exe Token: SeSystemtimePrivilege 828 srv32.exe Token: SeSystemtimePrivilege 828 srv32.exe Token: SeSystemtimePrivilege 828 srv32.exe Token: SeSystemtimePrivilege 1080 srv32.exe Token: SeSystemtimePrivilege 1080 srv32.exe Token: SeSystemtimePrivilege 1080 srv32.exe Token: SeSystemtimePrivilege 1080 srv32.exe Token: SeSystemtimePrivilege 2924 srv32.exe Token: SeSystemtimePrivilege 2924 srv32.exe Token: SeSystemtimePrivilege 2924 srv32.exe Token: SeSystemtimePrivilege 2924 srv32.exe Token: SeSystemtimePrivilege 1356 srv32.exe Token: SeSystemtimePrivilege 1356 srv32.exe Token: SeSystemtimePrivilege 1356 srv32.exe Token: SeSystemtimePrivilege 1356 srv32.exe Token: SeSystemtimePrivilege 328 srv32.exe Token: SeSystemtimePrivilege 328 srv32.exe Token: SeSystemtimePrivilege 328 srv32.exe Token: SeSystemtimePrivilege 328 srv32.exe Token: SeSystemtimePrivilege 1148 srv32.exe Token: SeSystemtimePrivilege 1148 srv32.exe Token: SeSystemtimePrivilege 1148 srv32.exe Token: SeSystemtimePrivilege 1148 srv32.exe Token: SeSystemtimePrivilege 1708 srv32.exe Token: SeSystemtimePrivilege 1708 srv32.exe Token: SeSystemtimePrivilege 1708 srv32.exe Token: SeSystemtimePrivilege 1708 srv32.exe Token: SeSystemtimePrivilege 2828 srv32.exe Token: SeSystemtimePrivilege 2828 srv32.exe Token: SeSystemtimePrivilege 2828 srv32.exe Token: SeSystemtimePrivilege 2828 srv32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1608 1708 1289cb9081b3188951ad7a023f352fc0_JaffaCakes118.exe 31 PID 1708 wrote to memory of 1608 1708 1289cb9081b3188951ad7a023f352fc0_JaffaCakes118.exe 31 PID 1708 wrote to memory of 1608 1708 1289cb9081b3188951ad7a023f352fc0_JaffaCakes118.exe 31 PID 1708 wrote to memory of 1608 1708 1289cb9081b3188951ad7a023f352fc0_JaffaCakes118.exe 31 PID 1608 wrote to memory of 2852 1608 srv32.exe 32 PID 1608 wrote to memory of 2852 1608 srv32.exe 32 PID 1608 wrote to memory of 2852 1608 srv32.exe 32 PID 1608 wrote to memory of 2852 1608 srv32.exe 32 PID 2852 wrote to memory of 2860 2852 srv32.exe 33 PID 2852 wrote to memory of 2860 2852 srv32.exe 33 PID 2852 wrote to memory of 2860 2852 srv32.exe 33 PID 2852 wrote to memory of 2860 2852 srv32.exe 33 PID 2860 wrote to memory of 2628 2860 srv32.exe 34 PID 2860 wrote to memory of 2628 2860 srv32.exe 34 PID 2860 wrote to memory of 2628 2860 srv32.exe 34 PID 2860 wrote to memory of 2628 2860 srv32.exe 34 PID 2628 wrote to memory of 2468 2628 srv32.exe 35 PID 2628 wrote to memory of 2468 2628 srv32.exe 35 PID 2628 wrote to memory of 2468 2628 srv32.exe 35 PID 2628 wrote to memory of 2468 2628 srv32.exe 35 PID 2468 wrote to memory of 1936 2468 srv32.exe 36 PID 2468 wrote to memory of 1936 2468 srv32.exe 36 PID 2468 wrote to memory of 1936 2468 srv32.exe 36 PID 2468 wrote to memory of 1936 2468 srv32.exe 36 PID 1936 wrote to memory of 2160 1936 srv32.exe 37 PID 1936 wrote to memory of 2160 1936 srv32.exe 37 PID 1936 wrote to memory of 2160 1936 srv32.exe 37 PID 1936 wrote to memory of 2160 1936 srv32.exe 37 PID 2160 wrote to memory of 828 2160 srv32.exe 38 PID 2160 wrote to memory of 828 2160 srv32.exe 38 PID 2160 wrote to memory of 828 2160 srv32.exe 38 PID 2160 wrote to memory of 828 2160 srv32.exe 38 PID 828 wrote to memory of 1080 828 srv32.exe 39 PID 828 wrote to memory of 1080 828 srv32.exe 39 PID 828 wrote to memory of 1080 828 srv32.exe 39 PID 828 wrote to memory of 1080 828 srv32.exe 39 PID 1080 wrote to memory of 2924 1080 srv32.exe 40 PID 1080 wrote to memory of 2924 1080 srv32.exe 40 PID 1080 wrote to memory of 2924 1080 srv32.exe 40 PID 1080 wrote to memory of 2924 1080 srv32.exe 40 PID 2924 wrote to memory of 1356 2924 srv32.exe 41 PID 2924 wrote to memory of 1356 2924 srv32.exe 41 PID 2924 wrote to memory of 1356 2924 srv32.exe 41 PID 2924 wrote to memory of 1356 2924 srv32.exe 41 PID 1356 wrote to memory of 328 1356 srv32.exe 42 PID 1356 wrote to memory of 328 1356 srv32.exe 42 PID 1356 wrote to memory of 328 1356 srv32.exe 42 PID 1356 wrote to memory of 328 1356 srv32.exe 42 PID 328 wrote to memory of 1148 328 srv32.exe 43 PID 328 wrote to memory of 1148 328 srv32.exe 43 PID 328 wrote to memory of 1148 328 srv32.exe 43 PID 328 wrote to memory of 1148 328 srv32.exe 43 PID 1148 wrote to memory of 1708 1148 srv32.exe 44 PID 1148 wrote to memory of 1708 1148 srv32.exe 44 PID 1148 wrote to memory of 1708 1148 srv32.exe 44 PID 1148 wrote to memory of 1708 1148 srv32.exe 44 PID 1708 wrote to memory of 2828 1708 srv32.exe 45 PID 1708 wrote to memory of 2828 1708 srv32.exe 45 PID 1708 wrote to memory of 2828 1708 srv32.exe 45 PID 1708 wrote to memory of 2828 1708 srv32.exe 45 PID 2828 wrote to memory of 3060 2828 srv32.exe 46 PID 2828 wrote to memory of 3060 2828 srv32.exe 46 PID 2828 wrote to memory of 3060 2828 srv32.exe 46 PID 2828 wrote to memory of 3060 2828 srv32.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\1289cb9081b3188951ad7a023f352fc0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1289cb9081b3188951ad7a023f352fc0_JaffaCakes118.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 72⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 73⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 74⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 75⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 76⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 77⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 78⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 79⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 710⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 711⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 712⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 713⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 714⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 715⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 716⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 717⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 718⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 719⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2636 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 720⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 721⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2172 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 722⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2084 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 723⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 724⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 725⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 726⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 727⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 728⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 729⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 730⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:352 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 731⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 732⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 733⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:2916 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 734⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2772 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 735⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:620 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 736⤵
- Executes dropped EXE
PID:1788 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 737⤵
- Executes dropped EXE
PID:2188 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 738⤵
- Executes dropped EXE
PID:852 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 739⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
PID:2276 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 740⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2300 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 741⤵
- Executes dropped EXE
PID:1732 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 742⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2488 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 743⤵
- Executes dropped EXE
PID:1744 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 744⤵
- Executes dropped EXE
PID:2348 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 745⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3048 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 746⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1608 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 747⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:2796 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 748⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
PID:2332 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 749⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:764 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 750⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2212 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 751⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
PID:1476 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 752⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1704 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 753⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1124 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 754⤵
- Executes dropped EXE
PID:2548 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 755⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1940 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 756⤵
- Executes dropped EXE
PID:1432 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 757⤵
- Executes dropped EXE
PID:1532 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 758⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:904 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 759⤵
- Executes dropped EXE
PID:2364 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 760⤵
- Executes dropped EXE
PID:2512 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 761⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2072 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 762⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 763⤵
- Executes dropped EXE
PID:2708 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 764⤵
- Executes dropped EXE
PID:2588 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 765⤵
- Executes dropped EXE
PID:780 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 766⤵PID:840
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 767⤵PID:2620
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 768⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
PID:1476 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 769⤵
- Drops file in System32 directory
PID:2612 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 770⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2160 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 771⤵PID:2272
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 772⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1028 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 773⤵
- Drops file in System32 directory
PID:1032 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 774⤵PID:2448
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 775⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:904 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 776⤵PID:2116
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 777⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:1636 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 778⤵PID:2728
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 779⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:2576 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 780⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2708 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 781⤵PID:264
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 782⤵PID:736
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 783⤵PID:1904
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 784⤵
- Drops file in System32 directory
PID:2620 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 785⤵PID:1540
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 786⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:564 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 787⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:676 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 788⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2260 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 789⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:2128 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 790⤵PID:2308
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 791⤵PID:1400
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 792⤵PID:904
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 793⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2824 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 794⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2820 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 795⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2572 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 796⤵PID:1656
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 797⤵PID:2744
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 798⤵PID:2832
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 799⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1208 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7100⤵PID:2084
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7101⤵
- Drops file in Drivers directory
PID:1628 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7102⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1324 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7103⤵
- Drops file in System32 directory
PID:2272 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7104⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:896 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7105⤵PID:2124
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7106⤵PID:2448
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7107⤵
- Drops file in System32 directory
PID:1672 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7108⤵
- Drops file in Drivers directory
PID:2880 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7109⤵PID:2508
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7110⤵
- System Location Discovery: System Language Discovery
PID:2356 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7111⤵
- Drops file in Drivers directory
PID:2740 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7112⤵
- Drops file in Drivers directory
PID:2564 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7113⤵
- System Location Discovery: System Language Discovery
PID:2904 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7114⤵
- Drops file in Drivers directory
PID:1972 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7115⤵
- Drops file in Drivers directory
PID:1804 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7116⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:404 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7117⤵PID:2160
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7118⤵
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7119⤵
- Drops file in Drivers directory
- Drops file in System32 directory
PID:1028 -
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7120⤵PID:1356
-
C:\Windows\SysWOW64\srv32.exe"C:\Windows\system32\srv32.exe" 7121⤵
- System Location Discovery: System Language Discovery
PID:2384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-