Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/10/2024, 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
19 signatures
150 seconds
General
-
Target
32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe
-
Size
364KB
-
MD5
32108bd2710ad6e446e2a9ae7c56bff6
-
SHA1
7eec7141af3bfc04af9017d2259f4115916a56ee
-
SHA256
938a4f66e8d694b129da1443341cdb731d9d6d8410d4d8ca90700b76f9e0e719
-
SHA512
3a7cb00bd8718eb524f321bb5e5cf403f9a546de1c56bed105a88f6dbc273914e7463942db05164d2a3d4c8001c2821cbd8c35fae65c4b5c0d7ccf62545be316
-
SSDEEP
6144:PuqgQ/Y2iY1fHAmRd3VVdqM182P906ZY94NGTuq:xxx1fgm7VVUMDVI9O
Malware Config
Signatures
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 64 IoCs
pid Process 2776 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe 2892 svchost.com 2748 32108B~1.EXE 2676 svchost.com 2628 32108B~1.EXE 2316 svchost.com 2816 32108B~1.EXE 2164 svchost.com 2060 32108B~1.EXE 1472 svchost.com 2828 32108B~1.EXE 2920 svchost.com 1468 32108B~1.EXE 2252 svchost.com 2204 32108B~1.EXE 2200 svchost.com 2172 32108B~1.EXE 2964 svchost.com 1648 32108B~1.EXE 1620 svchost.com 2108 32108B~1.EXE 3060 svchost.com 1960 32108B~1.EXE 1212 svchost.com 2056 32108B~1.EXE 2456 svchost.com 2528 32108B~1.EXE 984 svchost.com 2724 32108B~1.EXE 2772 svchost.com 2820 32108B~1.EXE 2612 svchost.com 2592 32108B~1.EXE 2740 svchost.com 2616 32108B~1.EXE 1108 svchost.com 2316 32108B~1.EXE 1416 svchost.com 2124 32108B~1.EXE 2660 svchost.com 2840 32108B~1.EXE 2952 svchost.com 1040 32108B~1.EXE 2268 svchost.com 2756 32108B~1.EXE 968 svchost.com 588 32108B~1.EXE 1764 svchost.com 2224 32108B~1.EXE 796 svchost.com 2368 32108B~1.EXE 2148 svchost.com 1076 32108B~1.EXE 2172 svchost.com 1136 32108B~1.EXE 2948 svchost.com 1708 32108B~1.EXE 1000 svchost.com 3056 32108B~1.EXE 1536 svchost.com 608 32108B~1.EXE 1068 svchost.com 3000 32108B~1.EXE 2264 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 3020 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe 3020 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe 2892 svchost.com 2892 svchost.com 2676 svchost.com 2676 svchost.com 2316 svchost.com 2316 svchost.com 2164 svchost.com 2164 svchost.com 1472 svchost.com 1472 svchost.com 2920 svchost.com 2920 svchost.com 2252 svchost.com 2252 svchost.com 3020 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe 2776 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe 2200 svchost.com 2200 svchost.com 2776 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe 2964 svchost.com 2964 svchost.com 1620 svchost.com 1620 svchost.com 3060 svchost.com 3060 svchost.com 1212 svchost.com 1212 svchost.com 2456 svchost.com 2456 svchost.com 984 svchost.com 984 svchost.com 2772 svchost.com 2772 svchost.com 2776 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe 2612 svchost.com 2612 svchost.com 2740 svchost.com 2740 svchost.com 1108 svchost.com 1108 svchost.com 1416 svchost.com 1416 svchost.com 2660 svchost.com 2660 svchost.com 2952 svchost.com 2952 svchost.com 2268 svchost.com 2268 svchost.com 968 svchost.com 968 svchost.com 1764 svchost.com 1764 svchost.com 796 svchost.com 796 svchost.com 2148 svchost.com 2148 svchost.com 2172 svchost.com 2172 svchost.com 2948 svchost.com 2948 svchost.com 1000 svchost.com 1000 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bpk = "C:\\Windows\\SysWOW64\\bpk.exe" bpk.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ = "PK IE Plugin" bpk.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dt\2024-10-10_22-28-47-259558254 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-29-07-259577520 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-29-14-259584618 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-27-50-259500455 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-28-06-259516680 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-29-34-259604898 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-28-01-259511610 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-28-52-259562310 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-29-11-259581576 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-29-35-259605912 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-28-06-259516680 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-28-36-259547100 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-28-30-259541016 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-28-31-259542030 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-28-42-259553184 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-29-25-259595772 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-27-30-259481189 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-28-07-259517694 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-28-14-259524792 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-27-33-259484231 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-27-53-259503497 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-27-47-259497429 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-28-04-259514652 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-28-43-259554198 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-27-39-259489301 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-27-45-259495385 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-28-05-259515681 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-28-05-259515681 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-27-41-259491329 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-27-54-259504511 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-29-27-259597800 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-29-31-259601856 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-27-45-259495385 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-28-43-259554198 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-28-49-259560282 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-28-08-259518708 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-28-33-259544058 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-29-06-259576506 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-29-32-259602870 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-28-35-259546086 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-28-56-259566366 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-29-10-259580562 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-29-17-259587660 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-29-30-259600842 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-27-52-259502483 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-28-29-259540002 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-29-03-259573464 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-29-19-259589688 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-28-34-259545072 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-29-02-259572450 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-29-28-259598814 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-28-50-259561296 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-29-16-259586646 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-28-38-259549128 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-28-41-259552170 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-29-17-259587660 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-28-12-259522764 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-28-37-259548114 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-28-27-259537974 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-28-55-259565352 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-29-07-259577520 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-27-53-259503497 bpk.exe File created C:\Windows\SysWOW64\dt\th_2024-10-10_22-28-00-259510595 bpk.exe File created C:\Windows\SysWOW64\dt\2024-10-10_22-29-08-259578534 bpk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 32108B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 32108B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 32108B~1.EXE File opened for modification C:\Windows\svchost.com 32108B~1.EXE File opened for modification C:\Windows\directx.sys 32108B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 32108B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 32108B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys 32108B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 32108B~1.EXE File opened for modification C:\Windows\directx.sys 32108B~1.EXE File opened for modification C:\Windows\svchost.com 32108B~1.EXE File opened for modification C:\Windows\svchost.com 32108B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 32108B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 32108B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 32108B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 32108B~1.EXE File opened for modification C:\Windows\directx.sys 32108B~1.EXE File opened for modification C:\Windows\directx.sys 32108B~1.EXE File opened for modification C:\Windows\svchost.com 32108B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys 32108B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 32108B~1.EXE File opened for modification C:\Windows\svchost.com 32108B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 32108B~1.EXE File opened for modification C:\Windows\directx.sys 32108B~1.EXE File opened for modification C:\Windows\directx.sys 32108B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 32108B~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 32108B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 32108B~1.EXE File opened for modification C:\Windows\svchost.com 32108B~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com 32108B~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32108B~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
NSIS installer 1 IoCs
resource yara_rule behavioral1/files/0x00060000000187a2-1932.dat nsis_installer_1 -
Modifies registry class 47 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\CLSID bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0\win32 bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32\ = "C:\\Windows\\SysWOW64\\bpkwb.dll" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\ = "BPK IE Plugin Type Library" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\HELPDIR bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32 bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\ = "IE Class" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CurVer\ = "PK.IE.1" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0 bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ = "IViewSource" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\Version = "1.0" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CLSID\ = "{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ProgID bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32 bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\CLSID\ = "{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\HELPDIR\ = "C:\\Windows\\SysWOW64\\" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32\ThreadingModel = "Apartment" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\FLAGS bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\ = "IE Plugin Class" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CLSID bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\TypeLib bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0\win32\ = "C:\\Windows\\SysWOW64\\bpkwb.dll" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1 bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CurVer bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ProgID\ = "PK.IE.1" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ = "IViewSource" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\Programmable bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\FLAGS\ = "0" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0 bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32 bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\Version = "1.0" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ = "IE Plugin Class" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\VersionIndependentProgID bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\VersionIndependentProgID\ = "PK.IE" bpk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 392 bpk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 392 bpk.exe 392 bpk.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe 392 bpk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2776 3020 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe 30 PID 3020 wrote to memory of 2776 3020 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe 30 PID 3020 wrote to memory of 2776 3020 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe 30 PID 3020 wrote to memory of 2776 3020 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe 30 PID 2776 wrote to memory of 2892 2776 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe 31 PID 2776 wrote to memory of 2892 2776 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe 31 PID 2776 wrote to memory of 2892 2776 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe 31 PID 2776 wrote to memory of 2892 2776 32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe 31 PID 2892 wrote to memory of 2748 2892 svchost.com 32 PID 2892 wrote to memory of 2748 2892 svchost.com 32 PID 2892 wrote to memory of 2748 2892 svchost.com 32 PID 2892 wrote to memory of 2748 2892 svchost.com 32 PID 2748 wrote to memory of 2676 2748 32108B~1.EXE 33 PID 2748 wrote to memory of 2676 2748 32108B~1.EXE 33 PID 2748 wrote to memory of 2676 2748 32108B~1.EXE 33 PID 2748 wrote to memory of 2676 2748 32108B~1.EXE 33 PID 2676 wrote to memory of 2628 2676 svchost.com 34 PID 2676 wrote to memory of 2628 2676 svchost.com 34 PID 2676 wrote to memory of 2628 2676 svchost.com 34 PID 2676 wrote to memory of 2628 2676 svchost.com 34 PID 2628 wrote to memory of 2316 2628 32108B~1.EXE 66 PID 2628 wrote to memory of 2316 2628 32108B~1.EXE 66 PID 2628 wrote to memory of 2316 2628 32108B~1.EXE 66 PID 2628 wrote to memory of 2316 2628 32108B~1.EXE 66 PID 2316 wrote to memory of 2816 2316 svchost.com 36 PID 2316 wrote to memory of 2816 2316 svchost.com 36 PID 2316 wrote to memory of 2816 2316 svchost.com 36 PID 2316 wrote to memory of 2816 2316 svchost.com 36 PID 2816 wrote to memory of 2164 2816 32108B~1.EXE 37 PID 2816 wrote to memory of 2164 2816 32108B~1.EXE 37 PID 2816 wrote to memory of 2164 2816 32108B~1.EXE 37 PID 2816 wrote to memory of 2164 2816 32108B~1.EXE 37 PID 2164 wrote to memory of 2060 2164 svchost.com 38 PID 2164 wrote to memory of 2060 2164 svchost.com 38 PID 2164 wrote to memory of 2060 2164 svchost.com 38 PID 2164 wrote to memory of 2060 2164 svchost.com 38 PID 2060 wrote to memory of 1472 2060 32108B~1.EXE 39 PID 2060 wrote to memory of 1472 2060 32108B~1.EXE 39 PID 2060 wrote to memory of 1472 2060 32108B~1.EXE 39 PID 2060 wrote to memory of 1472 2060 32108B~1.EXE 39 PID 1472 wrote to memory of 2828 1472 svchost.com 40 PID 1472 wrote to memory of 2828 1472 svchost.com 40 PID 1472 wrote to memory of 2828 1472 svchost.com 40 PID 1472 wrote to memory of 2828 1472 svchost.com 40 PID 2828 wrote to memory of 2920 2828 32108B~1.EXE 41 PID 2828 wrote to memory of 2920 2828 32108B~1.EXE 41 PID 2828 wrote to memory of 2920 2828 32108B~1.EXE 41 PID 2828 wrote to memory of 2920 2828 32108B~1.EXE 41 PID 2920 wrote to memory of 1468 2920 svchost.com 42 PID 2920 wrote to memory of 1468 2920 svchost.com 42 PID 2920 wrote to memory of 1468 2920 svchost.com 42 PID 2920 wrote to memory of 1468 2920 svchost.com 42 PID 1468 wrote to memory of 2252 1468 32108B~1.EXE 43 PID 1468 wrote to memory of 2252 1468 32108B~1.EXE 43 PID 1468 wrote to memory of 2252 1468 32108B~1.EXE 43 PID 1468 wrote to memory of 2252 1468 32108B~1.EXE 43 PID 2252 wrote to memory of 2204 2252 svchost.com 44 PID 2252 wrote to memory of 2204 2252 svchost.com 44 PID 2252 wrote to memory of 2204 2252 svchost.com 44 PID 2252 wrote to memory of 2204 2252 svchost.com 44 PID 2204 wrote to memory of 2200 2204 32108B~1.EXE 45 PID 2204 wrote to memory of 2200 2204 32108B~1.EXE 45 PID 2204 wrote to memory of 2200 2204 32108B~1.EXE 45 PID 2204 wrote to memory of 2200 2204 32108B~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\32108bd2710ad6e446e2a9ae7c56bff6_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE18⤵
- Executes dropped EXE
PID:2172 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE20⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE22⤵
- Executes dropped EXE
PID:2108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE24⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE26⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2528 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE30⤵
- Executes dropped EXE
PID:2724 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE32⤵
- Executes dropped EXE
PID:2820 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE34⤵
- Executes dropped EXE
PID:2592 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE36⤵
- Executes dropped EXE
PID:2616 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE40⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2124 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE42⤵
- Executes dropped EXE
PID:2840 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE44⤵
- Executes dropped EXE
PID:1040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE46⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE48⤵
- Executes dropped EXE
PID:588 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE50⤵
- Executes dropped EXE
PID:2224 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE52⤵
- Executes dropped EXE
PID:2368 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE54⤵
- Executes dropped EXE
PID:1076 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE56⤵
- Executes dropped EXE
PID:1136 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE60⤵
- Executes dropped EXE
PID:3056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"61⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE62⤵
- Executes dropped EXE
PID:608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"63⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE64⤵
- Executes dropped EXE
PID:3000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE66⤵PID:308
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"67⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE68⤵PID:1192
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"69⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE70⤵PID:1776
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"71⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE72⤵PID:2168
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"73⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE74⤵PID:1584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"75⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE76⤵PID:2748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"77⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE78⤵
- Drops file in Windows directory
PID:2728 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"79⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE80⤵PID:2236
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"81⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE82⤵
- System Location Discovery: System Language Discovery
PID:2072 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"83⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE84⤵PID:2292
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"85⤵
- Drops file in Windows directory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE86⤵PID:1808
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"87⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE88⤵PID:1316
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"89⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE90⤵
- System Location Discovery: System Language Discovery
PID:2260 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"91⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE92⤵PID:2088
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"93⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE94⤵PID:2432
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"95⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE96⤵
- Drops file in Windows directory
PID:1864 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"97⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE98⤵PID:860
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"99⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE100⤵
- Drops file in Windows directory
PID:404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"101⤵
- System Location Discovery: System Language Discovery
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE102⤵PID:1644
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"103⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE104⤵PID:2196
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"105⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE106⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"107⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE108⤵PID:3060
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"109⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE110⤵
- Drops file in Windows directory
PID:3068 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"111⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE112⤵PID:748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"113⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE114⤵PID:2524
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"115⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE116⤵PID:1412
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"117⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE118⤵PID:3008
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"119⤵
- Drops file in Windows directory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE120⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2944 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\32108B~1.EXE"121⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-