Malware Analysis Report

2025-01-22 19:54

Sample ID 241016-1k5gaavbmc
Target 4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118
SHA256 1dd674bbc70fab5ef026214003ef504be485d74ac3c2adc040c95ea89b3f6b7b
Tags
discovery evasion persistence ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1dd674bbc70fab5ef026214003ef504be485d74ac3c2adc040c95ea89b3f6b7b

Threat Level: Known bad

The file 4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

discovery evasion persistence ransomware trojan

Modifies WinLogon for persistence

UAC bypass

Modifies visibility of file extensions in Explorer

Event Triggered Execution: Image File Execution Options Injection

Disables cmd.exe use via registry modification

Disables Task Manager via registry modification

Disables use of System Restore points

Disables RegEdit via registry modification

Loads dropped DLL

Modifies system executable filetype association

Executes dropped EXE

Enumerates connected drives

Adds Run key to start application

Checks whether UAC is enabled

Drops autorun.inf file

Sets desktop wallpaper using registry

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Modifies Control Panel

Suspicious use of WriteProcessMemory

Modifies registry class

System policy modification

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 21:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 21:43

Reported

2024-10-16 21:46

Platform

win7-20240903-en

Max time kernel

52s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\4K51K4.exe N/A

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A

Disables Task Manager via registry modification

evasion

Disables cmd.exe use via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A

Disables use of System Restore points

evasion

Event Triggered Execution: Image File Execution Options Injection

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe\Debugger = "cmd.exe /c del" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe\Debugger = "cmd.exe /c del" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgw.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-SE.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe\Debugger = "notepad.exe" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe\Debugger = "notepad.exe" C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgnt.exe C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgw.exe C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe\Debugger = "cmd.exe /c del" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avguard.exe C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avguard.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avguard.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe\Debugger = "notepad.exe" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe\Debugger = "cmd.exe /c del" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgnt.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe\Debugger = "notepad.exe" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe\Debugger = "cmd.exe /c del" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\Kantuk.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
N/A N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
N/A N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
N/A N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
N/A N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
N/A N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
N/A N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
N/A N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
N/A N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
N/A N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\Kantuk.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\GoldenGhost.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\J: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\K0L4B0R451.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Windows\SysWOW64\Kantuk.exe N/A
File opened for modification C:\autorun.inf C:\Windows\SysWOW64\Kantuk.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\4K51K4.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\Shell32.com C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\Kantuk.exe.tmp C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File created C:\Windows\SysWOW64\Kantuk.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Shell32.com C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\4K51K4.exe.tmp C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe.tmp C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\Kantuk.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Player.ico C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Word.ico C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File created C:\Windows\SysWOW64\Rar.ico C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File created C:\Windows\SysWOW64\Asli.ico C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Windows_3D.scr C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Folder.ico C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Rar.ico C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Windows_3D.scr C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\Shell32.com C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe.tmp C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\JPG.ico C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\JPG.ico C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe.tmp C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~ C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\4K51K4.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\K0L4B0R451.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Word.ico C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe.tmp C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\Shell32.com.tmp C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\4K51K4.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Shell32.com.tmp C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~ C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\Kantuk.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe.tmp C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\4K51K4.exe.tmp C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File created C:\Windows\SysWOW64\Folder.ico C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\GoldenGhost.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe.tmp C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Kantuk.exe.tmp C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Player.ico C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File created C:\Windows\SysWOW64\Asli.ico C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\K0L4B0R451.jpg" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\K0L4B0R451.jpg C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Kantuk.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\4K51K4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Kantuk.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\4K51K4.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\ C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\s2359 = "K0L4B0R451" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\ C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\s1159 = "K0L4B0R451" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\ C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\s1159 = "K0L4B0R451" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\s1159 = "K0L4B0R451" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\WallpaperStyle = "0" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\s1159 = "K0L4B0R451" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\s2359 = "K0L4B0R451" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\TileWallpaper = "0" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\s2359 = "K0L4B0R451" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\ C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\s2359 = "K0L4B0R451" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\ C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\s1159 = "K0L4B0R451" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\s1159 = "K0L4B0R451" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\s2359 = "K0L4B0R451" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\ C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\International\s2359 = "K0L4B0R451" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "logoff.exe" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "logoff.exe" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\NeverShowExt = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "logoff.exe" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\Shell\Edit\Command C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command\ = "logoff.exe" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\edit\command\ = "logoff.exe" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\shell\Install\command C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command\ = "logoff.exe" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "logoff.exe" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command\ = "logoff.exe" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "K0L4B0R451 File" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "logoff.exe" C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\Shell\Edit\Command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Install\command\ = "logoff.exe" C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\Shell\Edit\Command C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\edit\command\ = "logoff.exe" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "K0L4B0R451 File" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" C:\Windows\SysWOW64\4K51K4.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\4K51K4.exe N/A
N/A N/A C:\Windows\SysWOW64\GoldenGhost.exe N/A
N/A N/A C:\Windows\SysWOW64\Kantuk.exe N/A
N/A N/A C:\Windows\SysWOW64\K0L4B0R451.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2844 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
PID 2844 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
PID 2844 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
PID 2844 wrote to memory of 2008 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
PID 2008 wrote to memory of 1460 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
PID 2008 wrote to memory of 1460 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
PID 2008 wrote to memory of 1460 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
PID 2008 wrote to memory of 1460 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
PID 2008 wrote to memory of 1664 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\Kantuk.exe
PID 2008 wrote to memory of 1664 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\Kantuk.exe
PID 2008 wrote to memory of 1664 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\Kantuk.exe
PID 2008 wrote to memory of 1664 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\Kantuk.exe
PID 2008 wrote to memory of 2216 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\4K51K4.exe
PID 2008 wrote to memory of 2216 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\4K51K4.exe
PID 2008 wrote to memory of 2216 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\4K51K4.exe
PID 2008 wrote to memory of 2216 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\4K51K4.exe
PID 2008 wrote to memory of 2352 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\K0L4B0R451.exe
PID 2008 wrote to memory of 2352 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\K0L4B0R451.exe
PID 2008 wrote to memory of 2352 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\K0L4B0R451.exe
PID 2008 wrote to memory of 2352 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\K0L4B0R451.exe
PID 2008 wrote to memory of 2500 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\GoldenGhost.exe
PID 2008 wrote to memory of 2500 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\GoldenGhost.exe
PID 2008 wrote to memory of 2500 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\GoldenGhost.exe
PID 2008 wrote to memory of 2500 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\GoldenGhost.exe
PID 2844 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\Kantuk.exe
PID 2844 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\Kantuk.exe
PID 2844 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\Kantuk.exe
PID 2844 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\Kantuk.exe
PID 2844 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\4K51K4.exe
PID 2844 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\4K51K4.exe
PID 2844 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\4K51K4.exe
PID 2844 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\4K51K4.exe
PID 2844 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\K0L4B0R451.exe
PID 2844 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\K0L4B0R451.exe
PID 2844 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\K0L4B0R451.exe
PID 2844 wrote to memory of 1340 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\K0L4B0R451.exe
PID 2844 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\GoldenGhost.exe
PID 2844 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\GoldenGhost.exe
PID 2844 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\GoldenGhost.exe
PID 2844 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\GoldenGhost.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe"

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe

C:\Windows\system32\~A~m~B~u~R~a~D~u~L~\winlogon.exe

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe

C:\Windows\system32\~A~m~B~u~R~a~D~u~L~\winlogon.exe

C:\Windows\SysWOW64\Kantuk.exe

C:\Windows\system32\Kantuk.exe

C:\Windows\SysWOW64\4K51K4.exe

C:\Windows\system32\4K51K4.exe

C:\Windows\SysWOW64\K0L4B0R451.exe

C:\Windows\system32\K0L4B0R451.exe

C:\Windows\SysWOW64\GoldenGhost.exe

C:\Windows\system32\GoldenGhost.exe

C:\Windows\SysWOW64\Kantuk.exe

C:\Windows\system32\Kantuk.exe

C:\Windows\SysWOW64\4K51K4.exe

C:\Windows\system32\4K51K4.exe

C:\Windows\SysWOW64\K0L4B0R451.exe

C:\Windows\system32\K0L4B0R451.exe

C:\Windows\SysWOW64\GoldenGhost.exe

C:\Windows\system32\GoldenGhost.exe

Network

N/A

Files

memory/2844-0-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Windows\SysWOW64\GoldenGhost.exe

MD5 4f2ff1d57ba15bb9a8c9f3176fc9600f
SHA1 c522f8502275a266a4d4ccfb20f51c1397838504
SHA256 1dd674bbc70fab5ef026214003ef504be485d74ac3c2adc040c95ea89b3f6b7b
SHA512 198d1daaf4add337978fa1f2a0775bd99fe24915fef36191e73992350d3ce7447a1381790592096e93562baa2ade921e426e37778c2921a88c46c363e8d57be5

C:\Aut0exec.bat.tmp

MD5 1e70a0cf27135eb873fc4fb1cf42b1ed
SHA1 2e6ebba57d1bfa985ad07f904b54836727ed9e4b
SHA256 1d0f3372daa90835157e708efac016c12efe323f26b59b9d24fab14e040ee9a6
SHA512 3ecf6aee3b5850fb8625c27247661e1809ac14765bb7e574d5a34177c7d680581f6304aa05ea6f560fbca5ca7ba8bc40b268aec1ede8c4572603bd0332ab11a2

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe.tmp

MD5 95ee7c7bc49f0d4292739c79adc75c03
SHA1 8d7024495a895c8ee98fcad935024abaac6b8b56
SHA256 97f8622cecbbcffbedbd4192d9729e57803daa8d9f8be358a793ebd2abe9dadd
SHA512 4b7d88107febb6886bbc5e6a604b57da6a6a89be5625da74bac09838f75b661e7a91599f02ea4e016f28f8e2cc163c55daae37f7a94fb7513b5d268b00983c62

C:\Windows\SysWOW64\Kantuk.exe.tmp

MD5 2066d9b5957c6b1625fd1c0bd0e2fdaa
SHA1 f42e77ac51ad29a4d67f527c99c99ca21a1d7e8a
SHA256 0e4e9e48fd648a3f5ba23895c46b02924f0aa0c9f99c1c763800a741a88425fe
SHA512 031852f4820d7e4b34f39256079228a5de353f7afb787f8b8abb294637f57a62120b31c336097db24464dc3f00ce488073c14300d0daede099b4c48f51f43eed

C:\Windows\SysWOW64\4K51K4.exe.tmp

MD5 b4521c994161e7931423b727ea2e8f56
SHA1 484bdcc64301cefa9c97532aef196ab49adf1890
SHA256 17a6542e56f0b155d05d5dd25bb4d8781cb952b25a6ed18678aa39d7b846fac9
SHA512 382c6e47941890a7ee7aede79e697d389b9674ca0741ed7b53ff9e5283d349eaf4d2ac738a00f665093cae3f114bfa877dacf91fdf17a6cf0d6cff7ca0a329e7

C:\Users\Admin\AppData\Local\Temp\Windows_3D.scr.tmp

MD5 d9adb98611cea7ccaba54bc121d62112
SHA1 a18f4ab1b814ec5512789c655807372a0e8a022a
SHA256 c93b383d10f646f926570e1f7a2332fa666e1f1e4ca5176ccf03d1a4c21c115b
SHA512 5ffb314ee827a1b2b9512a6a83326878dbbb8084089a279b4a24cfedfc852a3acdaf2c023160bb13cad3eaf47a2ae23ca5c99907c767dead6a8c208360feda16

C:\Windows\SysWOW64\K0L4B0R451.exe.tmp

MD5 9f47d5d7b02f9c83d32fd7c4e5e5c133
SHA1 24c51f0302680e60f39ed7879576595c39f843a4
SHA256 2b038dd48ac00b6fa3a95171aada62890b31c78182e8d804b4adc92b6efe75e0
SHA512 d46e6188231be639fc3f7519c8694fe3e45439ef8ec8208e146e9b1679d1dd241f484294d5dbb28157b3369b01ec6b97e3fb727f682391cb41fc69de4889a99d

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif.tmp

MD5 e36601413dbcd18166bcdfc7e36de65a
SHA1 712263b2ef626506a85ba5c5114afd22adbe65cb
SHA256 34078b7a98cefc1e2de2dba70afc8e94afca9e47263a8dd9ff22fa6d247f2cb5
SHA512 d8169977f280c768bdc96994ecf1d303efe998b178e6cc3670759251f27ba8d873a79da8d6682bc56069c2f2ed8d8bf2a9c350886657041852c5ab4118d46cb4

C:\Windows\SysWOW64\Shell32.com.tmp

MD5 e734bcc3632b01eb9e9d10cd1430e273
SHA1 7b7af77ecece47642f7fe402f0b6a8dbc9ccbdd2
SHA256 67d6e8fcda072b9fe6be473fbcf4c4f89b3e89f508361c7f0698b54ade289cac
SHA512 0de67d1abf1f45cd7c042b4b8fc8d61f107cb2650c97aab718ebb73259285b0e41d0470d84ec547278517b27bfe08e10d4a4ca55223956695f91a94cfa886a5d

C:\Windows\SysWOW64\GoldenGhost.exe.tmp

MD5 8ed06756c04821448a42f3250b255c59
SHA1 24e5f1cac887e81592faa3f0216a9857da72e532
SHA256 346814914b1c1ed09c06aab6f8a6475e509a7ff5778d5a9979c85d1650a6286d
SHA512 76588903098a25c1975c83e52edc0e4b27c4e94c6b65f18037db63a6193630a7c5991aa1c048665a61c9f72456e50b75de87a658aabd31086992f24061e73517

C:\Windows\SysWOW64\Kantuk.exe.tmp

MD5 d7ba0e1498564d84564ff08fc41b3a5a
SHA1 d5407f41f21b67afdb59197158cfa7ae45568ca5
SHA256 14234de14166090e55abfcbcc1150e9417b5b823ca535354e84940e1e5faa8f6
SHA512 b7f1bec3ed9c769316e5ca8c324f0008bc34f63ba44dc9908ae870699203a6ba7c0157e927bc63a435707aa1427d2a9444ca0a3e3a30df7ecd0f9c4079647ffb

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe.tmp

MD5 eb7cdfbfa1b5e15a9f37f503c82087bf
SHA1 d0cd56211e2b72b717f86589390aff74ab11d898
SHA256 ac1e29aee1afc2289da45cfdc0a76138d0326517e30495f77d5e28d73c92385b
SHA512 686c5cfaf294da82cf2c870d2dfa7ae68d44db58cb6be3b1c0efc4dc6bdc7628991a511cea755f8d79db5f0826fe38ae2116f8bea6b9fef3ef88ef3b5dd2b5b4

memory/2008-166-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Windows\SysWOW64\GoldenGhost.exe

MD5 fcf48a69967a2486b5f8995c812973dc
SHA1 70c8f32d1a11fceb681ac3b1ea9e0b2d730a09bb
SHA256 c6b48c8baf4256a55e418d713e6e54528b7e450f10709deca1930e1044ff96a5
SHA512 7c45c2f5fcb5262b9ccc945c73be5739476cc602d7ea6d093ca2dba3c06b92d58085d776d8201335cd03259fe7af6096852f7e98295194283cd6f550d02fcdb7

C:\Aut0exec.bat.tmp

MD5 5b2b350742775938489dbd76ea936d1d
SHA1 42a087c343e6320ca0b9393a62e26cd3eb1d8c50
SHA256 e6b12950b4d63b0485f391212db676364f6e37cae598997f1bfc112ae209e655
SHA512 926d09d677bf0fde10957a334901c5a8367bcc2d35aa2a88f9a140c94f5b49ccb7eeb77f50a58e68e085dccfdf5bb75b2890f81e3ccd4d925eaef8a4d05c20ad

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif.tmp

MD5 aceed90d653efe0e8030b55fa11c8429
SHA1 aa2f672adfd3370b2f834452e3d213f1f690a055
SHA256 71e27e57011ba0635c26f71d5edfb082dc944474e2717f0773aa1e5e016ecdef
SHA512 9bf0557e069c6927c80e0f6575d03ca998c9a18aed3bb38dccfa38411201f5d27ada3bddce69423bf318754579b4eb8285c35c6f37e4cfe85309954f3ece0ebd

C:\Windows\SysWOW64\Player.ico

MD5 43be35d4fb3ebc6ca0970f05365440e3
SHA1 87bc28e5d9a6ab0c79a07118ca578726ce61b1bc
SHA256 5a15c1aab77f132e7ce5928996919ed66564c6082a7f94d0a42229c480113fc5
SHA512 b2e24ff3702805d2ff8ecf3ddde8a8e6258965f992f37104c2ed9b763e1448ab32c7609a607e1d90cfba281e7add1e839855656d6453433a42c0d6c8923c9395

C:\Windows\SysWOW64\Folder.ico

MD5 d7f9d9553c172cba8825fa161e8e9851
SHA1 e45bdc6609d9d719e1cefa846f17d3d66332a3a0
SHA256 cd2e513851d519098acef16d191188ac2586d2174dfd1a84f4db7f41a6970086
SHA512 a03a806d9db86c0c4f6f8efc4b40008aa51f1625fc1c703a929bfa57a5caf962119b3c76044775af607d4ee1a8a671e1d0a2be66d19ee551717398f9ddc8ad24

C:\Windows\SysWOW64\Word.ico

MD5 8482935ff2fab6025b44b5a23c750480
SHA1 d770c46d210c0fd302fa035a6054f5ac19f3bd13
SHA256 dcbcdce04483e9d2d8a5d7779b18b7f64cfc06e758b07f671493e38dfb9ab33c
SHA512 00c711d815815a88fc15f73c8cba6a81b2bfc505baff2cc67b456545151fe896029f11127e447c9bbc5a2d5dc561a06a52be9a9f9c0d28e98ea4e174cdd54398

C:\Windows\SysWOW64\Shell32.com.tmp

MD5 880dba8c2cf96a047befa2f7ce6f0a0d
SHA1 04034bb4ecda55d7e5914654c51edbad8e0ab314
SHA256 b72487a976bffab5a289b495f87fa557628e6ab5de7e185089f9e413ff073390
SHA512 fdc7175458dd76851d7ff907e3ea488494d2e3efcb244b2f82b08c5715ccaeb450ef506000375a82f19acd16c833bbe5679d5a6ff4cf50a21c806488a605b703

C:\Windows\SysWOW64\K0L4B0R451.exe.tmp

MD5 239f49d0f9ed68737377358bf5e6698f
SHA1 27ddc2b7ef3555cc49a45afa8f96b573f88fc1f3
SHA256 f622aba20e05338fb5605b37d5ce7bbd1de22cc6e948260fbf81ed125ff1e97c
SHA512 76c1ff0467a3900bfb71e8d705faaee972e4694b630076132fb305e3846062b7848ddc441352a638402341118583eeaac51b1a28cab8cf8ddd7e044908fc1a8c

C:\Users\Admin\AppData\Local\Temp\Windows_3D.scr.tmp

MD5 c41466a595602d2b9b6ab21f3621bafb
SHA1 e15cb7d9a73f145d71bd9dbf952f3189a08a611a
SHA256 1734be17ffa8f7279894ba90b4ea4191771366dc5cbefb8c055d71243fc0aa34
SHA512 ba89f896caadaa8b4f58ad5d989009aa471a583278e8e34a55f4ebffd1da5a7894723c35330690f9bf1cff36f08586e67bce841b3c0eb76e9f498cc9a32aabe5

C:\Windows\SysWOW64\GoldenGhost.exe.tmp

MD5 6d51bbf0846fd61c3fb928ab28cd19cf
SHA1 68785ff31f9f3217527a1cd0b626227757928a97
SHA256 d3bced1e62fe46f5032316af78a27b5ad64cd015d5683c14e329077190ebc7a5
SHA512 d527c025c1b15cf82f59b18d33479d8d5f00c52174154ad3fdd9456b8de4bf8fd4ef590a4997ee31720c39cb72d6d5edb4f779cc584b2dde799a02c690378c32

C:\Windows\SysWOW64\4K51K4.exe.tmp

MD5 a4db4719fab7370e19b52d9132e472f7
SHA1 479af00cf2a49b5bdb02a8d77b552a40b86fa389
SHA256 34171a0c524ca393ba0cca1f9650c4634040854b14cc99c8d4dc3107f9a3adc6
SHA512 aaa8b8ef537d1b7d1ea73fa369bbd1abc90559e2c5e49766b8884af330e6bc63016313288acfc91504dd6311bd2998cbf0d38ed5f406adceec437c9e656b8a2f

C:\Windows\SysWOW64\Kantuk.exe.tmp

MD5 225a6f9a397aedb1037823faf3ad8035
SHA1 abaca5af2297fb1ef81068febdda6ddfa2540607
SHA256 7cb1ad85524c452dd672ab6140682d236976a959d8da90dcc7325753788afd37
SHA512 8c2bb7adb90dcb8ec72d7d1d0a3615346ac2aea5929490dd730b0560aeb529604e2d6d45ab3f7c708fa3813bce1bddb1be853701dcf1a35b3b4964fc55e1dfcd

\Windows\SysWOW64\Kantuk.exe

MD5 33f356def4cfce4108ce9a07aedfd2c1
SHA1 6cdacf025814659e4d0faae568991d5eaf8a8c36
SHA256 71f09aebe190257c7a2364aaa4aec877a48259dbc1470f80f4930075b32ec75e
SHA512 a08037447a1a43a73d6866cb7e84443fffa3eac52b1570f8f31e7da678ff882499ff63b4d84499405f95346b7704d217ff5b75b0c6370b6ffe279407c4d94f7d

memory/1664-278-0x0000000000400000-0x0000000000451000-memory.dmp

C:\JPG.ico

MD5 62b7610403ea3ac4776df9eb93bf4ba4
SHA1 b4a6cd17516f8fba679f15eda654928dc44dc502
SHA256 b0fd7ffb4c8f0e4566658a7284ca0652961648aaab44a53c5b9713664b122c29
SHA512 fa1995a21ffe073a15fa00a3a8717492b0a67f3615abe4c7e6bce054bb23cf545e10e21cfe3625b665c8bb199577815dbeccc7c6107cdb49f673b8d53f23888d

memory/2216-301-0x0000000000400000-0x0000000000451000-memory.dmp

\Windows\SysWOW64\4K51K4.exe

MD5 5dd07380597b28f34f7106cf984bdd1d
SHA1 5b5f44fe1e53c825404119fbb67b31b450741822
SHA256 379cb826a2013fb70eb982eb63bfddf0497085d13a8ab23eed3308f49d39a928
SHA512 98237cdad37c2c6951ffe7fd3d0a55f72366365010767c50c88cf30d399810b177049146aaee09dd7600ebfcac667c032fba66e5a686a54d874b110f4d89888e

memory/2352-307-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Windows\SysWOW64\GoldenGhost.exe

MD5 f97c6330fd0949944a6a1a479bd3c499
SHA1 c20963c2fa9f85882f763554eff76fec34126ffc
SHA256 057488c3e6e07ce7435c5a33b0f4a44821c8a89c20db48a73489365c04d439ea
SHA512 4cc2d21ba7fd5130b0fd37f3a6f1a3994478cd6861f112e56312aae5ba5c7b7b2db225cc8cab8ca62e53c90b84bb59e5fc0dd437f90cf559d87eec3e7e209b2d

memory/2500-317-0x0000000000400000-0x0000000000451000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 21:43

Reported

2024-10-16 21:46

Platform

win10v2004-20241007-en

Max time kernel

51s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\K0L4B0R451.exe\"" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\K0L4B0R451.exe" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A

Disables Task Manager via registry modification

evasion

Disables cmd.exe use via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A

Disables use of System Restore points

evasion

Event Triggered Execution: Image File Execution Options Injection

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgw.exe\Debugger = "cmd.exe /c del" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe\Debugger = "notepad.exe" C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-SE.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avguard.exe C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe\Debugger = "cmd.exe /c del" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avguard.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe\Debugger = "cmd.exe /c del" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgw.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avguard.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-SE.exe C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgw.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.exe\Debugger = "notepad.exe" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-CLN.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avscan.exe C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgnt.exe C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Avgw.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV-RTP.exe C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe\Debugger = "cmd.exe /c del" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ansav.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe\Debugger = "cmd.exe /c del" C:\Windows\SysWOW64\Kantuk.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Windows\SysWOW64\GoldenGhost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\system32\\~A~m~B~u~R~a~D~u~L~\\winlogon.exe" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Revenger = "C:\\Windows\\system32\\K0L4B0R451.exe" C:\Windows\SysWOW64\GoldenGhost.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\O: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\G: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\W: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\T: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\I: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\V: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\H: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\P: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\Y: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\B: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\N: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\E: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\J: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\M: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\Z: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\K: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\X: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\R: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\U: C:\Windows\SysWOW64\Kantuk.exe N/A
File opened (read-only) \??\L: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\Q: C:\Windows\SysWOW64\K0L4B0R451.exe N/A
File opened (read-only) \??\S: C:\Windows\SysWOW64\K0L4B0R451.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Windows\SysWOW64\Kantuk.exe N/A
File opened for modification C:\autorun.inf C:\Windows\SysWOW64\Kantuk.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\K0L4B0R451.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Player.ico C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe.tmp C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\JPG.ico C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe.tmp C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\4K51K4.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\4K51K4.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe.tmp C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe.tmp C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Word.ico C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Shell32.com C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe.tmp C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File created C:\Windows\SysWOW64\Word.ico C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Kantuk.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Shell32.com C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe.tmp C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~ C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\Kantuk.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\Shell32.com C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\JPG.ico C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Folder.ico C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\Kantuk.exe.tmp C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File created C:\Windows\SysWOW64\Rar.ico C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~ C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\GoldenGhost.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Shell32.com.tmp C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Folder.ico C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File created C:\Windows\SysWOW64\Player.ico C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File created C:\Windows\SysWOW64\Asli.ico C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\K0L4B0R451.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Kantuk.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Kantuk.exe.tmp C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Rar.ico C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\4K51K4.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\4K51K4.exe.tmp C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Windows_3D.scr C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\4K51K4.exe.tmp C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File opened for modification C:\Windows\SysWOW64\Windows_3D.scr C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
File created C:\Windows\SysWOW64\GoldenGhost.exe C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Asli.ico C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Shell32.com.tmp C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\K0L4B0R451.jpg" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\K0L4B0R451.jpg C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Kantuk.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Kantuk.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\4K51K4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\4K51K4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\GoldenGhost.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\s1159 = "K0L4B0R451" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\s1159 = "K0L4B0R451" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\s2359 = "K0L4B0R451" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\s2359 = "K0L4B0R451" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\s1159 = "K0L4B0R451" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\ C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\ C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\TileWallpaper = "0" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\ C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\ C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\s2359 = "K0L4B0R451" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\s2359 = "K0L4B0R451" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\s1159 = "K0L4B0R451" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\s1159 = "K0L4B0R451" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\s1159 = "K0L4B0R451" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\WallpaperStyle = "0" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\ C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\ C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Windows_3D.scr" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\s2359 = "K0L4B0R451" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\s2359 = "K0L4B0R451" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\ScreenSaveTimeOut = "100" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\NeverShowExt = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "logoff.exe" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\Shell\Edit\Command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Install\command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\edit\command\ = "logoff.exe" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "K0L4B0R451 File" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "K0L4B0R451 File" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Install C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\Shell\Edit\Command C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "logoff.exe" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command\ = "logoff.exe" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command\ = "logoff.exe" C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "logoff.exe" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\edit\command\ = "logoff.exe" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "logoff.exe" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\Install\command C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "logoff.exe" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\Shell\Edit\Command C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\Shell\Edit\Command C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Edit\Command\ = "logoff.exe" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Edit\Command\ = "logoff.exe" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\NeverShowExt = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"C:\\Windows\\system32\\4K51K4.exe\" \"%1\"%*" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\NeverShowExt = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Install\command\ = "logoff.exe" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "K0L4B0R451 File" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\Install\command C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command C:\Windows\SysWOW64\Kantuk.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\4K51K4.exe N/A
N/A N/A C:\Windows\SysWOW64\GoldenGhost.exe N/A
N/A N/A C:\Windows\SysWOW64\Kantuk.exe N/A
N/A N/A C:\Windows\SysWOW64\K0L4B0R451.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4508 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
PID 4508 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
PID 4508 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
PID 1832 wrote to memory of 3328 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
PID 1832 wrote to memory of 3328 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
PID 1832 wrote to memory of 3328 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe
PID 1832 wrote to memory of 4540 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\Kantuk.exe
PID 1832 wrote to memory of 4540 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\Kantuk.exe
PID 1832 wrote to memory of 4540 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\Kantuk.exe
PID 1832 wrote to memory of 1100 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\4K51K4.exe
PID 1832 wrote to memory of 1100 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\4K51K4.exe
PID 1832 wrote to memory of 1100 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\4K51K4.exe
PID 1832 wrote to memory of 904 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\K0L4B0R451.exe
PID 1832 wrote to memory of 904 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\K0L4B0R451.exe
PID 1832 wrote to memory of 904 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\K0L4B0R451.exe
PID 1832 wrote to memory of 1964 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\GoldenGhost.exe
PID 1832 wrote to memory of 1964 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\GoldenGhost.exe
PID 1832 wrote to memory of 1964 N/A C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe C:\Windows\SysWOW64\GoldenGhost.exe
PID 4508 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\Kantuk.exe
PID 4508 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\Kantuk.exe
PID 4508 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\Kantuk.exe
PID 4508 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\4K51K4.exe
PID 4508 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\4K51K4.exe
PID 4508 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\4K51K4.exe
PID 4508 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\K0L4B0R451.exe
PID 4508 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\K0L4B0R451.exe
PID 4508 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\K0L4B0R451.exe
PID 4508 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\GoldenGhost.exe
PID 4508 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\GoldenGhost.exe
PID 4508 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe C:\Windows\SysWOW64\GoldenGhost.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\SysWOW64\Kantuk.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\Kantuk.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1" C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\SysWOW64\4K51K4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\SysWOW64\K0L4B0R451.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Windows\SysWOW64\GoldenGhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\4f2ff1d57ba15bb9a8c9f3176fc9600f_JaffaCakes118.exe"

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe

C:\Windows\system32\~A~m~B~u~R~a~D~u~L~\winlogon.exe

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe

C:\Windows\system32\~A~m~B~u~R~a~D~u~L~\winlogon.exe

C:\Windows\SysWOW64\Kantuk.exe

C:\Windows\system32\Kantuk.exe

C:\Windows\SysWOW64\4K51K4.exe

C:\Windows\system32\4K51K4.exe

C:\Windows\SysWOW64\K0L4B0R451.exe

C:\Windows\system32\K0L4B0R451.exe

C:\Windows\SysWOW64\GoldenGhost.exe

C:\Windows\system32\GoldenGhost.exe

C:\Windows\SysWOW64\Kantuk.exe

C:\Windows\system32\Kantuk.exe

C:\Windows\SysWOW64\4K51K4.exe

C:\Windows\system32\4K51K4.exe

C:\Windows\SysWOW64\K0L4B0R451.exe

C:\Windows\system32\K0L4B0R451.exe

C:\Windows\SysWOW64\GoldenGhost.exe

C:\Windows\system32\GoldenGhost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 27.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 68.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/4508-0-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Windows\SysWOW64\GoldenGhost.exe

MD5 4f2ff1d57ba15bb9a8c9f3176fc9600f
SHA1 c522f8502275a266a4d4ccfb20f51c1397838504
SHA256 1dd674bbc70fab5ef026214003ef504be485d74ac3c2adc040c95ea89b3f6b7b
SHA512 198d1daaf4add337978fa1f2a0775bd99fe24915fef36191e73992350d3ce7447a1381790592096e93562baa2ade921e426e37778c2921a88c46c363e8d57be5

C:\Aut0exec.bat.tmp

MD5 4052374f61f0181a83dfe32e4f0ce460
SHA1 a854ac8f6fce2e808fbbd3fd67c196b1e2100d88
SHA256 53cef32c5c5dbd7795ae06a025afe7c9cc0110725484a1fe80d29f1b3f25c12c
SHA512 a6066187f2c972076439013c8ac85bcf7ef0622f060206702fa987db42398a57fc2bf71ae72e58a04bf0ef097c786bbdda2938a94f6ff75c697d91d98d7aa9ec

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe.tmp

MD5 95ee7c7bc49f0d4292739c79adc75c03
SHA1 8d7024495a895c8ee98fcad935024abaac6b8b56
SHA256 97f8622cecbbcffbedbd4192d9729e57803daa8d9f8be358a793ebd2abe9dadd
SHA512 4b7d88107febb6886bbc5e6a604b57da6a6a89be5625da74bac09838f75b661e7a91599f02ea4e016f28f8e2cc163c55daae37f7a94fb7513b5d268b00983c62

C:\Windows\SysWOW64\Kantuk.exe.tmp

MD5 d7ba0e1498564d84564ff08fc41b3a5a
SHA1 d5407f41f21b67afdb59197158cfa7ae45568ca5
SHA256 14234de14166090e55abfcbcc1150e9417b5b823ca535354e84940e1e5faa8f6
SHA512 b7f1bec3ed9c769316e5ca8c324f0008bc34f63ba44dc9908ae870699203a6ba7c0157e927bc63a435707aa1427d2a9444ca0a3e3a30df7ecd0f9c4079647ffb

C:\Windows\SysWOW64\GoldenGhost.exe.tmp

MD5 b434b0bd004d49a0de9f3a2321399adc
SHA1 50415b0fd0507e9b2215e087f6a16b2b1336ae9c
SHA256 84388ee6f5c43958e45ff20d5480dee3f21e96a6f10fea2b783296d504817f87
SHA512 f98fdae5de1cf37501546aaf0dd1fce0a839699bd7d12c328b7d374d177cc24f9e8ed838fa84fa8a2bc9b9b4f06c1dd3cfb55d199c229b55f93c501c0c1cb116

C:\Windows\SysWOW64\4K51K4.exe.tmp

MD5 a4dadf5b38bfe5ec225582f0c5382f65
SHA1 63d64398dabf00b01f2620a256234ba6252909d2
SHA256 dc0c3701f9854d6c887a3633f5a74d673a6998955562fd565d80522812b7d9a1
SHA512 981772b60c47a4284df74d7bb6df6f5e2763dba0e17ffec4fa5e8f1602ca5c66ebcc22864d6d354e764978e79e88a368f9ee1ab63c4a70ad54d7bbe7e4cb3dbd

C:\Users\Admin\AppData\Local\Temp\Windows_3D.scr.tmp

MD5 709a49b540f1113eef90d84d34ac5d85
SHA1 514f33fd719b49f620131a5ec8e0d6c50d6b329a
SHA256 aea6287022058b6ba5e65a9053022bea5e0b26b8052de57a6a1f8a4c2491d971
SHA512 40601089eb1ee9450c8cefb6dc504b3734d19ad3d9d18e748b2b764684aa14dd4ddce70efa7233799a8a8f6ac71ea4be227563590c7aa6fb080534957cdadb4e

C:\Windows\SysWOW64\Shell32.com.tmp

MD5 d53ff1c3e945f315f9a826b5050d77bb
SHA1 fe265928a940c8d7763b5a7e86c64d76c9bc8bfd
SHA256 3931ffa6993b971370b4d2689a1fb0af8e7b95f760c07901e245395ca453288e
SHA512 72981d122641fc045f9112e1c4628040bf9c0e7a6e28c5e697247d652dbf85b79e520fb06ef7aae0d3b08001cadac44841ea2bccbb97fc71252a1a4fd5fb6602

C:\Windows\SysWOW64\K0L4B0R451.exe.tmp

MD5 ced543060fad107132c12c0732d69ee4
SHA1 21427cc87f363323295628a52d4326a9f1e16edc
SHA256 cf7ff8ea4e2dea72c3311f0289c68a209c3faf36c6e160b7dafaf69bfaf141b6
SHA512 fb7acf98eda28f8338d294d986612519efee752abf1673807506045de7ce439a12432cfbfc4728c0cb8ee27fd42400b3fb17d7c3fdd23fb18b35a0a1e67fb3e0

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Empty.pif

MD5 745fae0e39a3502ff68fed6466bf2c0e
SHA1 a6547ac6c04cd2dbf33d898164a4fe94e4c3c0c6
SHA256 71caa66a04ae560fecb603dabbd9133f7dc1dd298f246ec33a5889a366ea67a8
SHA512 e6513587d126f7cd7f0bc34c12bff7673331bf555cb4b611cb3126d5067904eac0775bdf7f8c8d0ce2133312c74bf911a8ee2a95844a0b4a6c3b8a12fd4f6650

C:\Windows\SysWOW64\Kantuk.exe.tmp

MD5 755df74108bf8d8771800ccf73609abe
SHA1 358ad6f2b9379aaa8a91d93bd49b4d3cb801e7e8
SHA256 7527f8a1b6e045c199aaa479fcea8d6f3a4182d3f944908027ea2ede28270214
SHA512 44f39d77e0ef4b3bc0d36a885f315702153e83f4bad79a8d2d8b24805f496bb90757cde689e2f2b3d4819dd2bf0ef86e76936743357db8d91a5da6af7ff104b1

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Empty.pif

MD5 046ddcf4caf6ab3ea33bbf687ee43f7b
SHA1 c80c018daf891ff4020b187bcc7977eccd01b8fb
SHA256 da3f546ac997cd34b0013b4b7d28be3296f326a5644e3f912da5042949a898e3
SHA512 ffe391f99006b0656f7f445131d3dc2641ad827d55055004331cb8a743fddfd8f202bd43952971bd5309a0627402f63bc56ef91f56069f9f61f0750f13e5f9c6

memory/1832-207-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\winlogon.exe

MD5 c6a367cf3ae9cef3193b666c5400df15
SHA1 eea76337cb666f83ff68a616409b252479958528
SHA256 f20b0e80ac8e29c00d132f3634eb67c42ee7898f9698e43d1418896a95694b25
SHA512 dda8fea7745a4113a7af30d2201ae747413dee2965ae8d832805234881ad737cbb16b3bbc80aa274debfb9e40abbb3c27b65911291e4211182db19ea81fd74fc

C:\Windows\SysWOW64\Shell32.com.tmp

MD5 428ba69d60ab5dc6eba66ba3929d6f7e
SHA1 4721e0979115b6e40320f66e38144393b10bc2c6
SHA256 650d01e29e08cddea0af7e1881265b0b7b7af16baa0c4cc21c0d5475d4eb8651
SHA512 a24b18b4a326a9cb6bcfc4595302d040238d02ad0703519d37aa766bb073b01c5d269204012a8d2c7437c3e8ddf2e7bf207ca877d3a2133c896de387019bce8e

C:\Windows\SysWOW64\GoldenGhost.exe.tmp

MD5 f4af327aa9cb7c079de71fd897f690d5
SHA1 9e2d333ab8cfcdc14e8a0583153b4224f751f52f
SHA256 3b01e7f4636874fb146bf20f6ddc363e6133dbb696440473fbbe897f4db40998
SHA512 084331febae4a45d856f39f522b0874dd0744bd5aef683335b97939192418d1c8db2c9ff59c6905f834970839dd342675104978332138a64fb98e0f016433b36

C:\Aut0exec.bat.tmp

MD5 5516fce5a2f7202d845a5fdc6fd9cfb8
SHA1 1c2e66eb3c45ee90e940e2e1537ece9430a0bbcd
SHA256 dc2d2c53eae73f7003462c8439bcdee83f0a68328b091f2e1ea92b1425fb6a74
SHA512 591c89d5ee7b6497518b028a9dfd510a198e9a3d5da58fde25cdc7d1f0802c91442d0807f82f94c739ee79da1f869d1769b3814940279a5ee9282c2d46fb5bf3

C:\Windows\SysWOW64\GoldenGhost.exe

MD5 7803ff5d2dd15cecb9717d7362192f18
SHA1 3ccf46828a4630a3bed63dae9c1f92e09c1d958c
SHA256 6e1191ea97b74df2c1a5f5770571ce38362fedad3f07b98ddce2b02297c56d9f
SHA512 6d307565bbff10cbbc13b9f44cca201a33a97e57be2e871b8ffeb56fd6fe76234733cce302913bb3556bb72ce88a2190cad0b7db205aa57102a88cb50f78ca14

C:\Windows\SysWOW64\4K51K4.exe

MD5 980724210465b0a13968eb7f48b09eaf
SHA1 4b0a182652fb5aac462dd1267a29ecf9d3a368eb
SHA256 10d5baae0dba7f907601c0bbe91cfa6adcfa4de461c313369ff37fb9d0466d5c
SHA512 20d67484a50b1412664c8cff76ffe0f7f5490d38107fbcf5e2c8b4aa55c1f77d0cbfb5a458a47eaaae2c45d6bb25ee16afd061ee6ad0f32b63f654c16aaaf203

C:\Windows\SysWOW64\Kantuk.exe

MD5 4f3998774b873d99b06ce55266a87a68
SHA1 45916e5eecc8d93c5929e21ee565e91703e05b30
SHA256 2ee4b246353015adba977ad615c259a9b8ce32a014ea2a34706a5da01ee7b6f8
SHA512 7a475ecf9c7a40de11f031a0ea024875437f018c479b0df74f872ade9fb2af44e8bffa3244b7c1869c189a48fa120c57a1577e98d61c011295750166d94b78f2

C:\Aut0exec.bat.tmp

MD5 467fb18292011f3b6d61d31ce1382661
SHA1 17d62b495984f41203e56910498fa8f83c461e3f
SHA256 1d11104315f832641d9fe775a4f4a64d7cbd34ff6eb16168155e2af070df3cf5
SHA512 44a7626d45cb6f5f508c2d1eb6f1f8f0b5d28ddd971f7c6b8fe73a42c4e176105649ab361e14fc14cc502069456be3c7a693746f25aa637270991b167073c62e

C:\Users\Admin\AppData\Local\Temp\Windows_3D.scr.tmp

MD5 8eac2ee3ee51a9dbad5362aa188f071b
SHA1 7b1b73c82dd2b4d9a55263c6c993e4ad24390dd6
SHA256 ae2aa2703491a1d91b18208cb87af2d64f2d858850ca4fbdaa333f064237f406
SHA512 6945e12a8365da6c115593e7eda445f0baaf01acda5c3cfe88f5b7c0f9ecbff74e61379116b1e9edc7747b578d66ea9ee503cf0d38b85485d173ee677e72483b

C:\Windows\SysWOW64\Shell32.com.tmp

MD5 aba48f5c2e82482d7c4f56fe54ccd819
SHA1 a8b6bd15f33cb418d753b9ec6efff06f02a9210f
SHA256 2f482ae6bf4a9d539f4fc2ae865e2a623c9bad2427b82d21b9c75ff624191f5e
SHA512 e0d5fc14d02897e49f419b7ba6dfe185051bf259a8a98ff0ba3e2f046f8e4836ee1911aba400b1e391ae705f1eeaf52852b8f9cd4aec35e7302dc8a23a4daf98

C:\Windows\SysWOW64\K0L4B0R451.exe.tmp

MD5 22f7ce7eafc1faa1bbed1aeed62c4e9a
SHA1 cc50817e4e17a8d341b23fe1df607181e1fa9e34
SHA256 b4f81da541dee2383dc0097dd18236df71cb3cdfcc95c9732f7d2cdb1e642e41
SHA512 edcb171c000892f60bde084073846204b559740225144b1df6cff891dad2d9e807abb1ce174bc39dcbca464b595d233cf7fee7ff2884a00a6eab9ee35ea4d60e

C:\Windows\SysWOW64\GoldenGhost.exe.tmp

MD5 a1cc249c50a24577492861fbd892ac08
SHA1 c2cd5bb36d29f73d60e9901f43d1ee8a3a96c613
SHA256 75b463007d4c6f1e815c599ea4cbda5bf80a5ec18a2d10652748de05f2ac5496
SHA512 f3745d8c01ffd9789c7f44daac4496888a8701f60cb47f5cf160213f55035ce11b6d145ef8affabca84cbf65918ace14d81f900d6c88eac3ba15226c5554b6de

C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~\JPG.ico

MD5 62b7610403ea3ac4776df9eb93bf4ba4
SHA1 b4a6cd17516f8fba679f15eda654928dc44dc502
SHA256 b0fd7ffb4c8f0e4566658a7284ca0652961648aaab44a53c5b9713664b122c29
SHA512 fa1995a21ffe073a15fa00a3a8717492b0a67f3615abe4c7e6bce054bb23cf545e10e21cfe3625b665c8bb199577815dbeccc7c6107cdb49f673b8d53f23888d

C:\Windows\SysWOW64\Player.ico

MD5 43be35d4fb3ebc6ca0970f05365440e3
SHA1 87bc28e5d9a6ab0c79a07118ca578726ce61b1bc
SHA256 5a15c1aab77f132e7ce5928996919ed66564c6082a7f94d0a42229c480113fc5
SHA512 b2e24ff3702805d2ff8ecf3ddde8a8e6258965f992f37104c2ed9b763e1448ab32c7609a607e1d90cfba281e7add1e839855656d6453433a42c0d6c8923c9395

C:\Windows\SysWOW64\Folder.ico

MD5 d7f9d9553c172cba8825fa161e8e9851
SHA1 e45bdc6609d9d719e1cefa846f17d3d66332a3a0
SHA256 cd2e513851d519098acef16d191188ac2586d2174dfd1a84f4db7f41a6970086
SHA512 a03a806d9db86c0c4f6f8efc4b40008aa51f1625fc1c703a929bfa57a5caf962119b3c76044775af607d4ee1a8a671e1d0a2be66d19ee551717398f9ddc8ad24

C:\Windows\SysWOW64\Word.ico

MD5 8482935ff2fab6025b44b5a23c750480
SHA1 d770c46d210c0fd302fa035a6054f5ac19f3bd13
SHA256 dcbcdce04483e9d2d8a5d7779b18b7f64cfc06e758b07f671493e38dfb9ab33c
SHA512 00c711d815815a88fc15f73c8cba6a81b2bfc505baff2cc67b456545151fe896029f11127e447c9bbc5a2d5dc561a06a52be9a9f9c0d28e98ea4e174cdd54398

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Empty.pif

MD5 e36601413dbcd18166bcdfc7e36de65a
SHA1 712263b2ef626506a85ba5c5114afd22adbe65cb
SHA256 34078b7a98cefc1e2de2dba70afc8e94afca9e47263a8dd9ff22fa6d247f2cb5
SHA512 d8169977f280c768bdc96994ecf1d303efe998b178e6cc3670759251f27ba8d873a79da8d6682bc56069c2f2ed8d8bf2a9c350886657041852c5ab4118d46cb4

C:\Windows\SysWOW64\4K51K4.exe.tmp

MD5 1a54e945550d640b01b5e173fd8a630a
SHA1 063a8c83bc5b01f38bbe71d3c53dbe696f1935a0
SHA256 8233813d38ec4960ca11a44f18720523b4159bd82fec216da9c6f09fae7ef885
SHA512 57a9a980ddf1ecf2c6f16700e92884a1e5e688e7984f33281f3ae8a7a3d468b3981c1e49c18e36123fda370f18c7dda452f8c24d118796a2cbd27b987cf46406

C:\Windows\SysWOW64\Kantuk.exe.tmp

MD5 ebaa7cad3578b863e419001b9ac9049b
SHA1 b7e122c378c4cc3510c64719b051a9febc4174bc
SHA256 6afc4521914d7e3b7b72f78c0c90e7381d221bcef33487619b3c959bb792b24b
SHA512 0aef6f777eaec6e6f719dce468c19ef27292147479607e78152a08fd1fac5bf7480efc1d4e4ad23a19562602563482e36374c165f50fb473b2bd6a072cbc38d2

C:\Windows\SysWOW64\Kantuk.exe

MD5 318fd9e0c6cb76589e28e663c629ece0
SHA1 41926783951a77abdf4d529c9ec3b4ed0dcbd648
SHA256 b9c8eb4ef08b6d5cff783d7b3650e92fce2bb1d8257f255c5e21038a1000497b
SHA512 eba1db43f98528d0e828e0819f8aa57bb7e531a34e88f20f54fb2b16c99d3c204485eb236959b6cb8c0785c80b137f89fe7254a973055ef356f23e25966adb24

memory/4540-312-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Windows\SysWOW64\4K51K4.exe

MD5 308af6b2e71555a98f3e4c617f62b7ce
SHA1 5e3ca714ebf5d2ada8316718ba237af929d6adb8
SHA256 d0fb80cd6f4e283e0dd75673a1b307094e9787d0cb378b99ff7758f426d144f0
SHA512 257c3405b2c54cb06cd4a5bee31374b88f1b836b4d1cd29df975f10188142f4d9b34476244b0eeb8c1813b374453c33ef0944c6061aac3503c3d61808ff27ba0

memory/1100-331-0x0000000000400000-0x0000000000451000-memory.dmp

memory/904-335-0x0000000000400000-0x0000000000451000-memory.dmp

C:\Windows\SysWOW64\GoldenGhost.exe

MD5 b82cb98704330c166336b94e7ceaa228
SHA1 942277f3512a2662627867872e272cda2513d372
SHA256 328dd01b14ae5a0c6ad1182e033071e50d595376f5a6aa649bcb6fb9f8d990a8
SHA512 da5ae0edd91c8204c314ee8f43be4fe4f5ca7def139ad685e532d0f8b3320b86dfe2f63b9ee74d75897863617584f206a7a73bd5f0e8eafc7e9d2801e0032481

memory/1964-341-0x0000000000400000-0x0000000000451000-memory.dmp