andromeda | be090c085eab0d51085dbb9f2db28a5f117351ebb980b372efc2ce2cf419b120

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2024, 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Size

252KB
MD5

a02b961480e8b7fc9313c6e2ae480442
SHA1

fa6243f289015a1a78a5fd28f3eba56d07c33f6b
SHA256

be090c085eab0d51085dbb9f2db28a5f117351ebb980b372efc2ce2cf419b120
SHA512

c721a7eb719be9b57716f9ab739a65cf89bf88db2681964017a41c84fc734954b1d87b30881631f355f82c2dab1dff3d209d078e490960dc0e1691c6d1505792
SSDEEP

6144:b1Wj/JCXHjMc5qKeMuFFKN0jb2ZlhdBJVjY/eRUExoJyOYHB7qY8zIK0GznuAXyk:pWj

Score

10^/10

andromeda backdoor botnet discovery persistence

Malware Config

Signatures

Andromeda family
andromeda
Andromeda, Gamarue
Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.
botnet backdoor andromeda

Detects Andromeda payload. 4 IoCs

resource	yara_rule
behavioral2/memory/4088-18-0x0000000000BD0000-0x0000000000BD5000-memory.dmp	family_andromeda
behavioral2/memory/4088-22-0x0000000000BD0000-0x0000000000BD5000-memory.dmp	family_andromeda
behavioral2/memory/2692-39-0x0000000001080000-0x0000000001085000-memory.dmp	family_andromeda
behavioral2/memory/2692-46-0x0000000001080000-0x0000000001085000-memory.dmp	family_andromeda

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\22156 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\mseelq.exe"	svchost.exe

Executes dropped EXE 29 IoCs

pid	Process
4340	49662594.exe
3280	49662594.exe
2904	49662594.exe
4924	49662594.exe
4200	49662594.exe
1992	49662594.exe
2084	49662594.exe
1844	49662594.exe
1616	49662594.exe
2868	49662594.exe
3764	49662594.exe
3316	49662594.exe
1356	49662594.exe
3172	49662594.exe
1764	49662594.exe
3016	49662594.exe
4480	49662594.exe
448	49662594.exe
2672	49662594.exe
2708	49662594.exe
3460	49662594.exe
2120	49662594.exe
852	49662594.exe
1572	49662594.exe
808	49662594.exe
4216	49662594.exe
4280	49662594.exe
4920	49662594.exe
384	49662594.exe

Maps connected drives based on registry 3 TTPs 58 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	49662594.exe

Suspicious use of SetThreadContext 58 IoCs

description	pid	Process	procid_target
PID 2408 set thread context of 4340	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	82
PID 2408 set thread context of 5004	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	83
PID 2408 set thread context of 3280	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	89
PID 2408 set thread context of 4968	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	90
PID 2408 set thread context of 2904	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	95
PID 2408 set thread context of 3088	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	96
PID 2408 set thread context of 4924	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	98
PID 2408 set thread context of 972	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	99
PID 2408 set thread context of 4200	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	101
PID 2408 set thread context of 3132	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	102
PID 2408 set thread context of 1992	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	104
PID 2408 set thread context of 3788	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	105
PID 2408 set thread context of 2084	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	108
PID 2408 set thread context of 4152	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	109
PID 2408 set thread context of 1844	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	112
PID 2408 set thread context of 4104	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	113
PID 2408 set thread context of 1616	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	115
PID 2408 set thread context of 8	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	116
PID 2408 set thread context of 2868	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	118
PID 2408 set thread context of 716	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	119
PID 2408 set thread context of 3764	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	121
PID 2408 set thread context of 4452	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	122
PID 2408 set thread context of 3316	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	124
PID 2408 set thread context of 2076	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	125
PID 2408 set thread context of 1356	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	127
PID 2408 set thread context of 3808	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	128
PID 2408 set thread context of 3172	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	130
PID 2408 set thread context of 4808	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	131
PID 2408 set thread context of 1764	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	133
PID 2408 set thread context of 3608	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	134
PID 2408 set thread context of 3016	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	136
PID 2408 set thread context of 2580	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	137
PID 2408 set thread context of 4480	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	139
PID 2408 set thread context of 3204	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	140
PID 2408 set thread context of 448	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	142
PID 2408 set thread context of 224	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	143
PID 2408 set thread context of 2672	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	145
PID 2408 set thread context of 112	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	146
PID 2408 set thread context of 2708	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	148
PID 2408 set thread context of 5100	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	149
PID 2408 set thread context of 3460	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	151
PID 2408 set thread context of 3832	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	152
PID 2408 set thread context of 2120	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	154
PID 2408 set thread context of 4348	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	155
PID 2408 set thread context of 852	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	157
PID 2408 set thread context of 4592	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	158
PID 2408 set thread context of 1572	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	160
PID 2408 set thread context of 5032	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	161
PID 2408 set thread context of 808	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	163
PID 2408 set thread context of 2336	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	164
PID 2408 set thread context of 4216	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	166
PID 2408 set thread context of 5048	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	167
PID 2408 set thread context of 4280	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	169
PID 2408 set thread context of 3508	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	170
PID 2408 set thread context of 4920	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	172
PID 2408 set thread context of 1700	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	173
PID 2408 set thread context of 384	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	175
PID 2408 set thread context of 3492	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	176

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\PROGRA~3\LOCALS~1\Temp\mseelq.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49662594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
4340	49662594.exe
4340	49662594.exe
3280	49662594.exe
3280	49662594.exe
2904	49662594.exe
2904	49662594.exe
4924	49662594.exe
4924	49662594.exe
4200	49662594.exe
4200	49662594.exe
1992	49662594.exe
1992	49662594.exe
2084	49662594.exe
2084	49662594.exe
1844	49662594.exe
1844	49662594.exe
1616	49662594.exe
1616	49662594.exe
2868	49662594.exe
2868	49662594.exe
3764	49662594.exe
3764	49662594.exe
3316	49662594.exe
3316	49662594.exe
1356	49662594.exe
1356	49662594.exe
3172	49662594.exe
3172	49662594.exe
1764	49662594.exe
1764	49662594.exe
3016	49662594.exe
3016	49662594.exe
4480	49662594.exe
4480	49662594.exe
448	49662594.exe
448	49662594.exe
2672	49662594.exe
2672	49662594.exe
2708	49662594.exe
2708	49662594.exe
3460	49662594.exe
3460	49662594.exe
2120	49662594.exe
2120	49662594.exe
852	49662594.exe
852	49662594.exe
1572	49662594.exe
1572	49662594.exe
808	49662594.exe
808	49662594.exe
4216	49662594.exe
4216	49662594.exe
4280	49662594.exe
4280	49662594.exe
4920	49662594.exe
4920	49662594.exe
384	49662594.exe
384	49662594.exe

Suspicious behavior: MapViewOfSection 58 IoCs

pid	Process
4340	49662594.exe
4340	49662594.exe
3280	49662594.exe
3280	49662594.exe
2904	49662594.exe
2904	49662594.exe
4924	49662594.exe
4924	49662594.exe
4200	49662594.exe
4200	49662594.exe
1992	49662594.exe
1992	49662594.exe
2084	49662594.exe
2084	49662594.exe
1844	49662594.exe
1844	49662594.exe
1616	49662594.exe
1616	49662594.exe
2868	49662594.exe
2868	49662594.exe
3764	49662594.exe
3764	49662594.exe
3316	49662594.exe
3316	49662594.exe
1356	49662594.exe
1356	49662594.exe
3172	49662594.exe
3172	49662594.exe
1764	49662594.exe
1764	49662594.exe
3016	49662594.exe
3016	49662594.exe
4480	49662594.exe
4480	49662594.exe
448	49662594.exe
448	49662594.exe
2672	49662594.exe
2672	49662594.exe
2708	49662594.exe
2708	49662594.exe
3460	49662594.exe
3460	49662594.exe
2120	49662594.exe
2120	49662594.exe
852	49662594.exe
852	49662594.exe
1572	49662594.exe
1572	49662594.exe
808	49662594.exe
808	49662594.exe
4216	49662594.exe
4216	49662594.exe
4280	49662594.exe
4280	49662594.exe
4920	49662594.exe
4920	49662594.exe
384	49662594.exe
384	49662594.exe

Suspicious use of SetWindowsHookEx 30 IoCs

pid	Process
2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
5004	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
4968	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
3088	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
972	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
3132	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
3788	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
4152	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
4104	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
8	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
716	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
4452	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
2076	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
3808	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
4808	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
3608	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
2580	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
3204	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
224	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
112	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
5100	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
3832	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
4348	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
4592	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
5032	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
2336	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
5048	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
3508	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
1700	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
3492	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 4340	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	82
PID 2408 wrote to memory of 4340	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	82
PID 2408 wrote to memory of 4340	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	82
PID 2408 wrote to memory of 4340	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	82
PID 2408 wrote to memory of 4340	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	82
PID 2408 wrote to memory of 4340	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	82
PID 4340 wrote to memory of 4088	4340	49662594.exe	84
PID 4340 wrote to memory of 4088	4340	49662594.exe	84
PID 4340 wrote to memory of 4088	4340	49662594.exe	84
PID 2408 wrote to memory of 5004	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	83
PID 2408 wrote to memory of 5004	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	83
PID 2408 wrote to memory of 5004	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	83
PID 2408 wrote to memory of 5004	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	83
PID 2408 wrote to memory of 5004	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	83
PID 2408 wrote to memory of 5004	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	83
PID 2408 wrote to memory of 5004	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	83
PID 2408 wrote to memory of 5004	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	83
PID 2408 wrote to memory of 3280	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	89
PID 2408 wrote to memory of 3280	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	89
PID 2408 wrote to memory of 3280	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	89
PID 2408 wrote to memory of 3280	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	89
PID 2408 wrote to memory of 3280	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	89
PID 2408 wrote to memory of 3280	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	89
PID 2408 wrote to memory of 4968	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	90
PID 2408 wrote to memory of 4968	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	90
PID 2408 wrote to memory of 4968	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	90
PID 2408 wrote to memory of 4968	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	90
PID 2408 wrote to memory of 4968	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	90
PID 2408 wrote to memory of 4968	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	90
PID 2408 wrote to memory of 4968	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	90
PID 2408 wrote to memory of 4968	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	90
PID 3280 wrote to memory of 2692	3280	49662594.exe	91
PID 3280 wrote to memory of 2692	3280	49662594.exe	91
PID 3280 wrote to memory of 2692	3280	49662594.exe	91
PID 2408 wrote to memory of 2904	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	95
PID 2408 wrote to memory of 2904	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	95
PID 2408 wrote to memory of 2904	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	95
PID 2408 wrote to memory of 2904	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	95
PID 2408 wrote to memory of 2904	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	95
PID 2408 wrote to memory of 2904	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	95
PID 2408 wrote to memory of 3088	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	96
PID 2408 wrote to memory of 3088	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	96
PID 2408 wrote to memory of 3088	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	96
PID 2408 wrote to memory of 3088	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	96
PID 2408 wrote to memory of 3088	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	96
PID 2408 wrote to memory of 3088	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	96
PID 2408 wrote to memory of 3088	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	96
PID 2408 wrote to memory of 3088	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	96
PID 2904 wrote to memory of 3876	2904	49662594.exe	97
PID 2904 wrote to memory of 3876	2904	49662594.exe	97
PID 2904 wrote to memory of 3876	2904	49662594.exe	97
PID 2408 wrote to memory of 4924	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	98
PID 2408 wrote to memory of 4924	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	98
PID 2408 wrote to memory of 4924	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	98
PID 2408 wrote to memory of 4924	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	98
PID 2408 wrote to memory of 4924	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	98
PID 2408 wrote to memory of 4924	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	98
PID 2408 wrote to memory of 972	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	99
PID 2408 wrote to memory of 972	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	99
PID 2408 wrote to memory of 972	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	99
PID 2408 wrote to memory of 972	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	99
PID 2408 wrote to memory of 972	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	99
PID 2408 wrote to memory of 972	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	99
PID 2408 wrote to memory of 972	2408	a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe	99

C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - Adds policy Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:4088
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5004
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    PID:2692
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4968
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3876
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3088
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4924
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4168
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:972
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4200
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    PID:4812
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3132
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1992
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3192
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3788
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2084
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    PID:3940
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4152
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1844
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4476
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4104
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1616
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4128
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:8
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2868
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2180
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:716
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3764
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    PID:1348
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4452
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3316
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:232
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2076
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1356
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3684
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3808
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3172
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1636
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4808
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1764
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2176
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3608
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3016
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1732
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2580
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4480
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2372
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3204
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:448
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1244
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:224
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2672
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4240
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:112
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2708
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4936
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5100
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3460
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1864
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3832
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2120
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    PID:4892
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4348
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:852
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1588
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4592
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1572
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4860
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5032
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:808
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    PID:4020
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2336
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4216
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1524
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5048
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4280
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4092
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3508
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4920
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:452
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1700
- C:\Users\Admin\AppData\Roaming\49662594\49662594.exe
  "C:\Users\Admin\AppData\Roaming\49662594\49662594.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:384
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    PID:916
- C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a02b961480e8b7fc9313c6e2ae480442_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\49662594\49662594.exe

Filesize
252KB

MD5
a02b961480e8b7fc9313c6e2ae480442

SHA1
fa6243f289015a1a78a5fd28f3eba56d07c33f6b

SHA256
be090c085eab0d51085dbb9f2db28a5f117351ebb980b372efc2ce2cf419b120

SHA512
c721a7eb719be9b57716f9ab739a65cf89bf88db2681964017a41c84fc734954b1d87b30881631f355f82c2dab1dff3d209d078e490960dc0e1691c6d1505792

Download Submit
memory/972-81-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2692-37-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/2692-39-0x0000000001080000-0x0000000001085000-memory.dmp

Filesize
20KB

Download
memory/2692-35-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/2692-46-0x0000000001080000-0x0000000001085000-memory.dmp

Filesize
20KB

Download
memory/3088-63-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3132-101-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3876-60-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/3876-61-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/4088-13-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/4088-15-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/4088-18-0x0000000000BD0000-0x0000000000BD5000-memory.dmp

Filesize
20KB

Download
memory/4088-22-0x0000000000BD0000-0x0000000000BD5000-memory.dmp

Filesize
20KB

Download
memory/4168-79-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/4168-78-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/4340-4-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4812-99-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/4812-98-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/4968-41-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5004-48-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5004-30-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5004-7-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5004-9-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download