Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2024 16:30
Behavioral task
behavioral1
Sample
6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe
-
Size
808KB
-
MD5
6fdf0c867e45e6f84ec3ff4a0337f5f2
-
SHA1
3d5b5a1096159c7c41b3351e308d9aec527f63ec
-
SHA256
e568b486aaaee0e9f66897391b491bd148c5bb3b993d37b0d62c2ebca6b7ea2a
-
SHA512
0755aca22b42acb836639b789578ff8922d5302b4ac95c50025b3710df569327e9316d3a7ebe1a736f99a1a1ed546ee9448abf0c049eade4cc1d0df854e4e3d0
-
SSDEEP
12288:ESJ3NTpRIJojxTZ9WjKVBdtrWBk454hSJ3NTpRIJojxTZ9WjKVBdtrWBk4549:ES3NqJojxt9TquS3NqJojxt9Tqe
Malware Config
Signatures
-
Drops file in Drivers directory 3 IoCs
Processes:
csrss.exe6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exedescription ioc process File opened for modification C:\WINDOWS\SysWOW64\drivers\csrss.exe csrss.exe File opened for modification C:\WINDOWS\SysWOW64\drivers\csrss.exe 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\drivers\csrss.exe 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.execsrss.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation csrss.exe -
Executes dropped EXE 47 IoCs
Processes:
6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.execsrss.execsrss.exelsass.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exepid process 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe 4860 csrss.exe 1652 csrss.exe 2912 lsass.exe 1820 csrss.exe 2056 lsass.exe 2812 csrss.exe 2656 csrss.exe 4824 lsass.exe 1704 csrss.exe 4508 csrss.exe 1560 lsass.exe 64 csrss.exe 4820 csrss.exe 2248 lsass.exe 1268 csrss.exe 2316 csrss.exe 3768 lsass.exe 4948 csrss.exe 2516 csrss.exe 2816 lsass.exe 1268 csrss.exe 3696 csrss.exe 3828 lsass.exe 4144 csrss.exe 2696 csrss.exe 4416 lsass.exe 3280 csrss.exe 4172 csrss.exe 3696 lsass.exe 1288 csrss.exe 1172 csrss.exe 4416 lsass.exe 4568 csrss.exe 1504 csrss.exe 3160 lsass.exe 4460 csrss.exe 404 csrss.exe 1908 lsass.exe 4520 csrss.exe 2448 csrss.exe 4140 lsass.exe 3092 csrss.exe 5036 csrss.exe 536 lsass.exe 2024 csrss.exe 3348 csrss.exe -
Loads dropped DLL 64 IoCs
Processes:
Regsvr32.exeRegsvr32.exeRegsvr32.exeRegsvr32.exeRegsvr32.exeRegsvr32.execsrss.execsrss.exelsass.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.exepid process 760 Regsvr32.exe 3988 Regsvr32.exe 4172 Regsvr32.exe 4524 Regsvr32.exe 1620 Regsvr32.exe 932 Regsvr32.exe 1652 csrss.exe 1652 csrss.exe 4860 csrss.exe 4860 csrss.exe 2912 lsass.exe 2912 lsass.exe 1820 csrss.exe 1820 csrss.exe 2056 lsass.exe 2056 lsass.exe 2812 csrss.exe 2812 csrss.exe 2656 csrss.exe 2656 csrss.exe 4824 lsass.exe 4824 lsass.exe 1704 csrss.exe 1704 csrss.exe 4508 csrss.exe 4508 csrss.exe 1560 lsass.exe 1560 lsass.exe 64 csrss.exe 64 csrss.exe 4820 csrss.exe 4820 csrss.exe 2248 lsass.exe 2248 lsass.exe 1268 csrss.exe 1268 csrss.exe 2316 csrss.exe 2316 csrss.exe 3768 lsass.exe 3768 lsass.exe 4948 csrss.exe 4948 csrss.exe 2516 csrss.exe 2516 csrss.exe 2816 lsass.exe 2816 lsass.exe 1268 csrss.exe 1268 csrss.exe 3696 csrss.exe 3696 csrss.exe 3828 lsass.exe 3828 lsass.exe 4144 csrss.exe 4144 csrss.exe 2696 csrss.exe 2696 csrss.exe 4416 lsass.exe 4416 lsass.exe 3280 csrss.exe 3280 csrss.exe 4172 csrss.exe 4172 csrss.exe 3696 lsass.exe 3696 lsass.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exelsass.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{sys_service}47441785527574886178711733577697979791696863593629768454944741350524534502598310175314898147133442513566406887179367313824288233724607279263295883427960332854919352825 = "system key" 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\WINDOWS\\System32\\drivers\\csrss.exe" 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\WINDOWS\\System32\\drivers\\csrss.exe" 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\WINDOWS\\System32\\drivers\\csrss.exe" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{sys_service}47441785527574886178711733577697979791696863593629768454944741350524534502598310175314898147133442513566406887179367313824288233724607279263295883427960332854919352825 = "system key" 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 14 IoCs
Processes:
6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exedescription ioc process File opened for modification C:\WINDOWS\SysWOW64\MCI32.OCX 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\MSINET.OCX 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\MSINET.OCX 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\pdh.dll 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\MSWINSCK.OCX 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\MCI32.OCX 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\config\lsass.exe 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\config\lsass.exe 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\pskill.exe 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\pdh.dll 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\MSWINSCK.OCX 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe File opened for modification C:\WINDOWS\SysWOW64\pskill.exe 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral2/memory/2700-0-0x0000000000400000-0x0000000000523000-memory.dmp upx C:\Windows\SysWOW64\6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe upx behavioral2/memory/64-14-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/memory/2700-71-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/memory/64-78-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/memory/64-91-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
Processes:
6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exedescription ioc process File created C:\Program Files (x86)\Unlocker\Unlocker.exe 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe File created C:\Program Files (x86)\Unlocker\Unlocker.exe 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe -
Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 3828 sc.exe 1852 sc.exe 3532 sc.exe 4524 sc.exe 3920 sc.exe 1852 sc.exe 3656 sc.exe 1168 sc.exe 976 sc.exe 2688 sc.exe 4240 sc.exe 3952 sc.exe 3548 sc.exe 664 sc.exe 2536 sc.exe 2136 sc.exe 3368 sc.exe 3336 sc.exe 2892 sc.exe 4752 sc.exe 1504 sc.exe 3964 sc.exe 1332 sc.exe 2892 sc.exe 3532 sc.exe 4584 sc.exe 3640 sc.exe 1972 sc.exe 1876 sc.exe 4528 sc.exe 2036 sc.exe 3952 sc.exe 1376 sc.exe 4404 sc.exe 4312 sc.exe 2452 sc.exe 2772 sc.exe 2968 sc.exe 4092 sc.exe 3540 sc.exe 1500 sc.exe 1140 sc.exe 4744 sc.exe 3492 sc.exe 4144 sc.exe 1020 sc.exe 1964 sc.exe 1412 sc.exe 2220 sc.exe 1376 sc.exe 2248 sc.exe 3928 sc.exe 4416 sc.exe 4844 sc.exe 1948 sc.exe 1628 sc.exe 896 sc.exe 4060 sc.exe 1040 sc.exe 4488 sc.exe 4524 sc.exe 4528 sc.exe 4748 sc.exe 2948 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
sc.exesc.execsrss.exesc.exeRegsvr32.exesc.exesc.execsrss.execsrss.exesc.execsrss.execsrss.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exelsass.exesc.exesc.exesc.execsrss.exesc.exesc.execsrss.exesc.exesc.exesc.exesc.exesc.exesc.exesc.execsrss.exesc.exesc.execmd.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.execsrss.exesc.exesc.exeRegsvr32.exesc.exesc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe -
Modifies registry class 64 IoCs
Processes:
Regsvr32.exeRegsvr32.exeRegsvr32.exeRegsvr32.exeRegsvr32.exe6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exeRegsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0 Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}\TypeLib\ = "{C1A8AF28-1257-101B-8FB0-0020AF039CA3}" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MCI.MMControl\CurVer\ = "MCI.MMControl.1" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}\Control Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}\MiscStatus Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\WINDOWS\\SysWow64\\MSINET.OCX" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0\win32 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "1.1" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3775D2E0-7C5D-11CF-899E-00AA00688B10}\ = "MCI Controls Property Page Object" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905} Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFD6A40-3999-11CF-9150-00AA0059F70D}\ = "MCI General Property Page Object" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\WINDOWS\\SysWow64\\MSWINSCK.OCX" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}\ProgID\ = "MCI.MMControl.1" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}\VersionIndependentProgID\ = "MCI.MMControl" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MCI.MMControl\ = "Microsoft Multimedia Control, version 6.0" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7ABC220-DF71-11CF-8E74-00A0C90F26F8}\ = "Imci" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" Regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C1A8AF27-1257-101B-8FB0-0020AF039CA3}\ = "DmciEvents" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}\ = "Microsoft Multimedia Control, version 6.0" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3775D2E0-7C5D-11CF-899E-00AA00688B10}\InprocServer32 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B7ABC220-DF71-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{C1A8AF28-1257-101B-8FB0-0020AF039CA3}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "1.1" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CLSID Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Version Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Version Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFD6A40-3999-11CF-9150-00AA0059F70D}\InprocServer32\ = "C:\\WINDOWS\\SysWow64\\MCI32.OCX" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3775D2E0-7C5D-11CF-899E-00AA00688B10} Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MCI.MMControl.1\ = "Microsoft Multimedia Control, version 6.0" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}\Version\ = "1.1" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7ABC220-DF71-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 Regsvr32.exe -
Suspicious use of SetWindowsHookEx 48 IoCs
Processes:
6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.execsrss.execsrss.exelsass.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exelsass.execsrss.execsrss.exepid process 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe 4860 csrss.exe 1652 csrss.exe 2912 lsass.exe 1820 csrss.exe 2056 lsass.exe 2812 csrss.exe 2656 csrss.exe 4824 lsass.exe 1704 csrss.exe 4508 csrss.exe 1560 lsass.exe 64 csrss.exe 4820 csrss.exe 2248 lsass.exe 1268 csrss.exe 2316 csrss.exe 3768 lsass.exe 4948 csrss.exe 2516 csrss.exe 2816 lsass.exe 1268 csrss.exe 3696 csrss.exe 3828 lsass.exe 4144 csrss.exe 2696 csrss.exe 4416 lsass.exe 3280 csrss.exe 4172 csrss.exe 3696 lsass.exe 1288 csrss.exe 1172 csrss.exe 4416 lsass.exe 4568 csrss.exe 1504 csrss.exe 3160 lsass.exe 4460 csrss.exe 404 csrss.exe 1908 lsass.exe 4520 csrss.exe 2448 csrss.exe 4140 lsass.exe 3092 csrss.exe 5036 csrss.exe 536 lsass.exe 2024 csrss.exe 3348 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.execsrss.execsrss.exedescription pid process target process PID 2700 wrote to memory of 64 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe PID 2700 wrote to memory of 64 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe PID 2700 wrote to memory of 64 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe PID 2700 wrote to memory of 3988 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 2700 wrote to memory of 3988 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 2700 wrote to memory of 3988 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 64 wrote to memory of 760 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 64 wrote to memory of 760 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 64 wrote to memory of 760 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 2700 wrote to memory of 4524 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 2700 wrote to memory of 4524 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 2700 wrote to memory of 4524 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 64 wrote to memory of 4172 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 64 wrote to memory of 4172 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 64 wrote to memory of 4172 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 2700 wrote to memory of 1620 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 2700 wrote to memory of 1620 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 2700 wrote to memory of 1620 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 64 wrote to memory of 932 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 64 wrote to memory of 932 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 64 wrote to memory of 932 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 64 wrote to memory of 860 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 64 wrote to memory of 860 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 64 wrote to memory of 860 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 2700 wrote to memory of 4420 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 2700 wrote to memory of 4420 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 2700 wrote to memory of 4420 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe Regsvr32.exe PID 64 wrote to memory of 2040 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe cmd.exe PID 64 wrote to memory of 2040 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe cmd.exe PID 64 wrote to memory of 2040 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe cmd.exe PID 2700 wrote to memory of 4460 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe cmd.exe PID 2700 wrote to memory of 4460 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe cmd.exe PID 2700 wrote to memory of 4460 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe cmd.exe PID 2700 wrote to memory of 4860 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe csrss.exe PID 2700 wrote to memory of 4860 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe csrss.exe PID 2700 wrote to memory of 4860 2700 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe csrss.exe PID 64 wrote to memory of 1652 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe csrss.exe PID 64 wrote to memory of 1652 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe csrss.exe PID 64 wrote to memory of 1652 64 6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe csrss.exe PID 4860 wrote to memory of 1376 4860 csrss.exe sc.exe PID 4860 wrote to memory of 1376 4860 csrss.exe sc.exe PID 4860 wrote to memory of 1376 4860 csrss.exe sc.exe PID 1652 wrote to memory of 2568 1652 csrss.exe sc.exe PID 1652 wrote to memory of 2568 1652 csrss.exe sc.exe PID 1652 wrote to memory of 2568 1652 csrss.exe sc.exe PID 4860 wrote to memory of 2556 4860 csrss.exe sc.exe PID 4860 wrote to memory of 2556 4860 csrss.exe sc.exe PID 4860 wrote to memory of 2556 4860 csrss.exe sc.exe PID 1652 wrote to memory of 2784 1652 csrss.exe sc.exe PID 1652 wrote to memory of 2784 1652 csrss.exe sc.exe PID 1652 wrote to memory of 2784 1652 csrss.exe sc.exe PID 4860 wrote to memory of 1164 4860 csrss.exe sc.exe PID 4860 wrote to memory of 1164 4860 csrss.exe sc.exe PID 4860 wrote to memory of 1164 4860 csrss.exe sc.exe PID 1652 wrote to memory of 4092 1652 csrss.exe sc.exe PID 1652 wrote to memory of 4092 1652 csrss.exe sc.exe PID 1652 wrote to memory of 4092 1652 csrss.exe sc.exe PID 4860 wrote to memory of 4432 4860 csrss.exe sc.exe PID 4860 wrote to memory of 4432 4860 csrss.exe sc.exe PID 4860 wrote to memory of 4432 4860 csrss.exe sc.exe PID 1652 wrote to memory of 4112 1652 csrss.exe sc.exe PID 1652 wrote to memory of 4112 1652 csrss.exe sc.exe PID 1652 wrote to memory of 4112 1652 csrss.exe sc.exe PID 4860 wrote to memory of 1852 4860 csrss.exe sc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\WINDOWS\SysWOW64\6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe"C:\WINDOWS\System32\6fdf0c867e45e6f84ec3ff4a0337f5f2_JaffaCakes118.exe"2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:64 -
C:\WINDOWS\SysWOW64\Regsvr32.exeRegsvr32 C:\WINDOWS\System32\MSWINSCK.OCX /s3⤵
- Loads dropped DLL
- Modifies registry class
PID:760 -
C:\WINDOWS\SysWOW64\Regsvr32.exeRegsvr32 C:\WINDOWS\System32\MCI32.OCX /s3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4172 -
C:\WINDOWS\SysWOW64\Regsvr32.exeRegsvr32 C:\WINDOWS\System32\MSINET.OCX /s3⤵
- Loads dropped DLL
- Modifies registry class
PID:932 -
C:\WINDOWS\SysWOW64\Regsvr32.exeRegsvr32 C:\WINDOWS\System32\pdh.dll /s3⤵PID:860
-
C:\WINDOWS\SysWOW64\cmd.execmd /c DEL "C:\Program Files (x86)\Unlocker\Unlocker.exe" /F /Q3⤵PID:2040
-
C:\WINDOWS\SysWOW64\drivers\csrss.exe"C:\WINDOWS\system32\drivers\csrss.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f4⤵
- System Location Discovery: System Language Discovery
PID:2568 -
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f4⤵PID:2784
-
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f4⤵
- Launches sc.exe
PID:4092 -
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f4⤵
- System Location Discovery: System Language Discovery
PID:4112 -
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f4⤵
- System Location Discovery: System Language Discovery
PID:2220 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f4⤵
- Launches sc.exe
PID:2248 -
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32 C:\WINDOWS\System32\MSWINSCK.OCX /s2⤵
- Loads dropped DLL
- Modifies registry class
PID:3988 -
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32 C:\WINDOWS\System32\MCI32.OCX /s2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4524 -
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32 C:\WINDOWS\System32\MSINET.OCX /s2⤵
- Loads dropped DLL
- Modifies registry class
PID:1620 -
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32 C:\WINDOWS\System32\pdh.dll /s2⤵PID:4420
-
C:\Windows\SysWOW64\cmd.execmd /c DEL "C:\Program Files (x86)\Unlocker\Unlocker.exe" /F /Q2⤵
- System Location Discovery: System Language Discovery
PID:4460 -
C:\WINDOWS\SysWOW64\drivers\csrss.exe"C:\WINDOWS\system32\drivers\csrss.exe"2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f3⤵
- Launches sc.exe
PID:1376 -
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f3⤵
- System Location Discovery: System Language Discovery
PID:2556 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f3⤵PID:1164
-
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f3⤵
- System Location Discovery: System Language Discovery
PID:4432 -
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f3⤵
- Launches sc.exe
PID:1852 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f3⤵
- Launches sc.exe
PID:1168 -
C:\WINDOWS\SysWOW64\config\lsass.exe"C:\WINDOWS\system32\config\lsass.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2912 -
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1820 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵
- System Location Discovery: System Language Discovery
PID:4172 -
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- Launches sc.exe
PID:4524 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵
- System Location Discovery: System Language Discovery
PID:896 -
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵PID:4936
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵PID:3392
-
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵
- System Location Discovery: System Language Discovery
PID:1144 -
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2812 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵PID:928
-
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- Launches sc.exe
PID:3928 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵
- System Location Discovery: System Language Discovery
PID:3952 -
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵PID:4568
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3532 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵PID:3032
-
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2656 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵PID:4636
-
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵PID:3768
-
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵PID:1388
-
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵PID:4324
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵
- System Location Discovery: System Language Discovery
PID:4072 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵PID:1800
-
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1704 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵
- Launches sc.exe
PID:2136 -
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- Launches sc.exe
PID:3368 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵
- System Location Discovery: System Language Discovery
PID:1880 -
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵PID:944
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵PID:716
-
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4508 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵PID:1516
-
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵PID:1868
-
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵
- System Location Discovery: System Language Discovery
PID:1172 -
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵PID:1624
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵PID:3344
-
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵
- Launches sc.exe
PID:976 -
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:64 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵PID:4540
-
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵PID:1368
-
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵PID:5064
-
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵PID:4484
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵
- Launches sc.exe
PID:3336 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵PID:2968
-
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4820 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵
- Launches sc.exe
PID:4744 -
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- System Location Discovery: System Language Discovery
PID:2596 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵
- Launches sc.exe
PID:3492 -
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵
- System Location Discovery: System Language Discovery
PID:716 -
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵
- Launches sc.exe
PID:3964 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵PID:1820
-
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1268 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵PID:4364
-
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- Launches sc.exe
PID:1332 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵PID:2220
-
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵
- Launches sc.exe
PID:4240 -
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵
- System Location Discovery: System Language Discovery
PID:4348 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵PID:3428
-
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2316 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵PID:4212
-
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- Launches sc.exe
PID:2892 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵PID:664
-
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵PID:4656
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵PID:2324
-
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵
- Launches sc.exe
PID:4528 -
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4948 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3540 -
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- Launches sc.exe
PID:3532 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵
- Launches sc.exe
PID:3640 -
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵PID:928
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵
- Launches sc.exe
PID:4584 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4144 -
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2516 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵
- System Location Discovery: System Language Discovery
PID:3460 -
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- System Location Discovery: System Language Discovery
PID:944 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵PID:3712
-
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵PID:2696
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵PID:1144
-
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4524 -
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1268 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵PID:4904
-
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- Launches sc.exe
PID:4416 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵PID:2996
-
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵
- Launches sc.exe
PID:3952 -
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵
- Launches sc.exe
PID:1500 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵
- System Location Discovery: System Language Discovery
PID:4432 -
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3696 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵PID:1884
-
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- System Location Discovery: System Language Discovery
PID:804 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵
- Launches sc.exe
PID:3920 -
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵
- System Location Discovery: System Language Discovery
PID:4576 -
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵PID:4072
-
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵
- Launches sc.exe
PID:4404 -
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4144 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵PID:2096
-
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4844 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵
- System Location Discovery: System Language Discovery
PID:4180 -
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵PID:4676
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵PID:3656
-
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2688 -
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2696 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵PID:4700
-
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1964 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵
- Launches sc.exe
PID:1948 -
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵PID:1620
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1020 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4312 -
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3280 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵PID:3144
-
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵PID:2124
-
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵PID:216
-
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵
- Launches sc.exe
PID:4752 -
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵
- System Location Discovery: System Language Discovery
PID:1500 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵PID:1212
-
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4172 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵PID:4620
-
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- Launches sc.exe
PID:1504 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵PID:2968
-
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵
- System Location Discovery: System Language Discovery
PID:212 -
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵
- System Location Discovery: System Language Discovery
PID:3512 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵PID:756
-
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1288 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵
- Launches sc.exe
PID:3548 -
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4748 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵
- Launches sc.exe
PID:1972 -
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵
- System Location Discovery: System Language Discovery
PID:4460 -
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵PID:3612
-
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵
- System Location Discovery: System Language Discovery
PID:436 -
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1172 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵
- Launches sc.exe
PID:1140 -
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- Launches sc.exe
PID:1852 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵PID:4948
-
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3656 -
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵PID:3408
-
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵
- Launches sc.exe
PID:1628 -
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4568 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵
- Launches sc.exe
PID:1876 -
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- Launches sc.exe
PID:2220 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵PID:1324
-
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵PID:60
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵PID:3280
-
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵PID:4472
-
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1504 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵PID:1116
-
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- System Location Discovery: System Language Discovery
PID:2192 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵
- System Location Discovery: System Language Discovery
PID:4252 -
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵PID:1368
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵
- Launches sc.exe
PID:2452 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵PID:392
-
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4460 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵PID:4748
-
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵
- Launches sc.exe
PID:1376 -
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵
- System Location Discovery: System Language Discovery
PID:3180 -
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵PID:2052
-
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵
- Launches sc.exe
PID:1412 -
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:404 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵PID:4396
-
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- System Location Discovery: System Language Discovery
PID:3868 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵PID:3156
-
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵PID:2524
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵
- Launches sc.exe
PID:896 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵PID:4120
-
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4520 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵
- Launches sc.exe
PID:4528 -
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- System Location Discovery: System Language Discovery
PID:1644 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵
- Launches sc.exe
PID:2892 -
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵
- Launches sc.exe
PID:4060 -
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵PID:1088
-
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵
- Launches sc.exe
PID:2772 -
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2448 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵
- System Location Discovery: System Language Discovery
PID:3928 -
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵PID:552
-
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵PID:3912
-
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵PID:2452
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵PID:3532
-
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵
- System Location Discovery: System Language Discovery
PID:4556 -
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3092 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵
- Launches sc.exe
PID:2036 -
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- System Location Discovery: System Language Discovery
PID:920 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵
- System Location Discovery: System Language Discovery
PID:2860 -
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵PID:1348
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵PID:1948
-
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵PID:896
-
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5036 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵
- Launches sc.exe
PID:1040 -
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵PID:3700
-
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵PID:4812
-
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵PID:3920
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵
- Launches sc.exe
PID:2968 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵PID:3116
-
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2024 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵PID:1700
-
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵PID:3080
-
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵PID:64
-
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵
- Launches sc.exe
PID:3828 -
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵
- System Location Discovery: System Language Discovery
PID:396 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵PID:3696
-
C:\WINDOWS\SysWOW64\drivers\csrss.exeC:\WINDOWS\system32\drivers\csrss.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3348 -
C:\Windows\SysWOW64\sc.exesc stop wscsvc /f5⤵
- Launches sc.exe
PID:4488 -
C:\Windows\SysWOW64\sc.exesc delete wscsvc /f5⤵
- System Location Discovery: System Language Discovery
PID:1624 -
C:\Windows\SysWOW64\sc.exesc stop SharedAccess /f5⤵
- Launches sc.exe
PID:2536 -
C:\Windows\SysWOW64\sc.exesc delete SharedAccess /f5⤵
- Launches sc.exe
PID:664 -
C:\Windows\SysWOW64\sc.exesc stop wuauserv /f5⤵
- System Location Discovery: System Language Discovery
PID:2028 -
C:\Windows\SysWOW64\sc.exesc delete wuauserv /f5⤵
- Launches sc.exe
PID:3952 -
C:\WINDOWS\SysWOW64\config\lsass.exe"C:\WINDOWS\system32\config\lsass.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2056 -
C:\WINDOWS\SysWOW64\config\lsass.exe"C:\WINDOWS\system32\config\lsass.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4824 -
C:\WINDOWS\SysWOW64\config\lsass.exe"C:\WINDOWS\system32\config\lsass.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1560 -
C:\WINDOWS\SysWOW64\config\lsass.exe"C:\WINDOWS\system32\config\lsass.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2248 -
C:\WINDOWS\SysWOW64\config\lsass.exe"C:\WINDOWS\system32\config\lsass.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3768 -
C:\WINDOWS\SysWOW64\config\lsass.exe"C:\WINDOWS\system32\config\lsass.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2816 -
C:\WINDOWS\SysWOW64\config\lsass.exe"C:\WINDOWS\system32\config\lsass.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3828 -
C:\WINDOWS\SysWOW64\config\lsass.exe"C:\WINDOWS\system32\config\lsass.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4416 -
C:\WINDOWS\SysWOW64\config\lsass.exe"C:\WINDOWS\system32\config\lsass.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3696 -
C:\WINDOWS\SysWOW64\config\lsass.exe"C:\WINDOWS\system32\config\lsass.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4416 -
C:\WINDOWS\SysWOW64\config\lsass.exe"C:\WINDOWS\system32\config\lsass.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3160 -
C:\WINDOWS\SysWOW64\config\lsass.exe"C:\WINDOWS\system32\config\lsass.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1908 -
C:\WINDOWS\SysWOW64\config\lsass.exe"C:\WINDOWS\system32\config\lsass.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4140 -
C:\WINDOWS\SysWOW64\config\lsass.exe"C:\WINDOWS\system32\config\lsass.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:536
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Indicator Removal
1File Deletion
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
193KB
MD562b0194f801f2ae74b8b70900da50901
SHA1a3f5ee54175d3af80c3be7a056986882b090a5e5
SHA25607bf28692ac79fd7e7de7cff2291ea945bb5a60d427ae2fd7a19dde738b67438
SHA51295b8755de564832a42f1ce8c4c1ee576bddcecc13d6d556fbf4911001cee086f749839a76d18b4507c96c79adfccf4cd0c2500cc38b9f24d3fd2f2e8dda0f23e
-
Filesize
112KB
MD57bec181a21753498b6bd001c42a42722
SHA13249f233657dc66632c0539c47895bfcee5770cc
SHA25673da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
SHA512d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc
-
Filesize
105KB
MD59484c04258830aa3c2f2a70eb041414c
SHA1b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA256bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
SHA5129d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
-
Filesize
695KB
MD56ee4131774519322fdf3d830d1d28171
SHA1449be15e92a0005958f8520b5e7a0d9c16ff6fe4
SHA2563c9874bb95e4bebb4ab5f569d68faa858bf08f96c11a617aa0d712f06370b10a
SHA512d491d36b649d405551065185193580591d1bf564fa2afff78c1fb079dc5f845107b0ff55f5c25fbe839315835a8fe6de1d91ae14db2f20c9e095dd4c501edcb7
-
Filesize
72KB
MD594e42995f4e7f2c67ab56cde74957fc1
SHA1528d1c1d2254e1720ffe2fe4cb90f6d2fc0d89e8
SHA256429639db4888bf16a498386aa0bbd9b471997c2d2fc552f1cff686300fe0d553
SHA512fb93de68216a3d01b15e0441bda845f3fc5c6a23c9bfba7a47c0884ceaee64e48d7e2ccfc8f0f4d0b5c53c5738372bfa580b1f2f2bf735bf8bea28c46922c436
-
Filesize
403KB
MD5ec41730492550d2a9e1983cc86491954
SHA165b2baf159143533764e345b37eb8a8ea0a903ac
SHA2565ed199dc0eed6bd706f50b8a9c8f2446d79630da87f1326ee9d319f00d9ffa3c
SHA512167e008ff980a5d30ed88784a6bc0bc0617ae9b6be5d1ed018d805e4ff6a983a0135ce7ccd50e1746c5102fbd2d9dc56d27a9bbe1acefb02084f8703d3c37651
-
Filesize
1.4MB
MD5e2d1f51097755b5dbd27a148c77732f7
SHA13136ec0f34393092b7c7f797737ee4c40816f2ff
SHA2568eab0c77de95bca969e159624de1818bd8a317fbe477242bedd7a035fb49c8a7
SHA512816ee8ba87d6e0b1009deb0a95f130b0a72a872399ac093e6183bcfa6364adbc8aa913a10b1eaa0fafca1b1d6865d99d2002e6f3efffeeb11641b0248f13cd8c