Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-11-2024 03:16
Behavioral task
behavioral1
Sample
aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
General
-
Target
aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe
-
Size
364KB
-
MD5
aac6660541b72842f5e7902b3bd5de3f
-
SHA1
04c86541e7569a6889311691ed852bfa1933e379
-
SHA256
56d93b29c4db52fe2e336ebeb5377e2c8f72523ea9b527beaef8821c306796d8
-
SHA512
16c6b3433ef398a7fa3e93a5165ff6f9f9b9bffdb238d61c3617303dc25e2376f5eddc37e1c475a0d5740c4e9e3373f85534e03e97957cb22e7d2bb1e20d6e88
-
SSDEEP
6144:k9PjDmRAs7pM3t6nHaCLrob5P9+UeRUq6tyH7xOc6H5c6HcT66vlmr:Of8zbobNeWa
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x00060000000186f2-20.dat family_neshta behavioral1/files/0x00060000000186f8-33.dat family_neshta behavioral1/files/0x0001000000010314-38.dat family_neshta behavioral1/files/0x0001000000010312-37.dat family_neshta behavioral1/files/0x0009000000010663-36.dat family_neshta behavioral1/files/0x0029000000010667-35.dat family_neshta behavioral1/memory/2844-52-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2828-51-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2796-67-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2624-66-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2588-81-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2284-80-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/548-95-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1996-94-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1984-109-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2660-108-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2000-123-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2316-122-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7e5-138.dat family_neshta behavioral1/files/0x000100000000f82c-145.dat family_neshta behavioral1/memory/1296-152-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2924-151-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2536-174-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1080-173-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/316-195-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/308-194-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1536-203-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1664-204-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1784-218-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1040-217-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3000-230-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/884-229-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1804-255-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1696-254-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2712-268-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2720-269-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1808-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2724-276-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2736-290-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2708-291-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2604-298-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2796-299-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/640-306-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2164-307-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1996-315-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1032-314-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2804-323-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2820-322-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1984-331-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2008-330-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1720-339-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1988-338-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2928-346-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2612-352-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2936-355-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2144-354-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2924-363-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/700-362-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2940-373-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/812-372-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/692-381-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1860-380-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1732-389-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1600-388-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2652 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 1808 svchost.exe 2328 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 2828 svchost.com 2844 AAC666~1.EXE 2884 svchost.exe 2796 svchost.com 2624 AAC666~1.EXE 2588 svchost.com 2284 AAC666~1.EXE 1996 svchost.com 548 AAC666~1.EXE 1984 svchost.com 2660 AAC666~1.EXE 2316 svchost.com 2000 AAC666~1.EXE 1296 svchost.com 2924 AAC666~1.EXE 2536 svchost.com 1080 AAC666~1.EXE 316 svchost.com 308 AAC666~1.EXE 1664 svchost.com 1536 AAC666~1.EXE 1784 svchost.com 1040 AAC666~1.EXE 3000 svchost.com 884 AAC666~1.EXE 1804 svchost.com 1696 AAC666~1.EXE 2712 svchost.com 2720 AAC666~1.EXE 1808 svchost.com 2724 AAC666~1.EXE 2736 svchost.com 2708 AAC666~1.EXE 2796 svchost.com 2604 AAC666~1.EXE 2164 svchost.com 640 AAC666~1.EXE 1032 svchost.com 1996 AAC666~1.EXE 2804 svchost.com 2820 AAC666~1.EXE 1984 svchost.com 2008 AAC666~1.EXE 1720 svchost.com 1988 AAC666~1.EXE 2612 svchost.com 2928 AAC666~1.EXE 2936 svchost.com 2144 AAC666~1.EXE 2924 svchost.com 700 AAC666~1.EXE 812 svchost.com 2940 AAC666~1.EXE 692 svchost.com 1860 AAC666~1.EXE 1600 svchost.com 1732 AAC666~1.EXE 2136 svchost.com 1752 AAC666~1.EXE 2516 svchost.com 1536 AAC666~1.EXE -
Loads dropped DLL 64 IoCs
pid Process 2364 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 2364 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 1808 svchost.exe 1808 svchost.exe 2828 svchost.com 2828 svchost.com 2796 svchost.com 2796 svchost.com 2588 svchost.com 2588 svchost.com 1996 svchost.com 1996 svchost.com 1984 svchost.com 1984 svchost.com 2316 svchost.com 2316 svchost.com 1296 svchost.com 1296 svchost.com 2328 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 2364 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 2536 svchost.com 2536 svchost.com 316 svchost.com 316 svchost.com 2364 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 2364 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 2364 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 1664 svchost.com 1664 svchost.com 1784 svchost.com 1784 svchost.com 3000 svchost.com 3000 svchost.com 1804 svchost.com 1804 svchost.com 2712 svchost.com 2712 svchost.com 1808 svchost.com 1808 svchost.com 2736 svchost.com 2736 svchost.com 2796 svchost.com 2796 svchost.com 2164 svchost.com 2164 svchost.com 1032 svchost.com 1032 svchost.com 2804 svchost.com 2804 svchost.com 1984 svchost.com 1984 svchost.com 1720 svchost.com 1720 svchost.com 2612 svchost.com 2612 svchost.com 2936 svchost.com 2936 svchost.com 2924 svchost.com 2924 svchost.com 812 svchost.com 812 svchost.com 692 svchost.com 692 svchost.com 1600 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x00060000000186f2-1498.dat upx behavioral1/memory/2744-1502-0x0000000000400000-0x0000000000499000-memory.dmp upx behavioral1/memory/2744-1505-0x0000000000400000-0x0000000000499000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe svchost.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe svchost.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe svchost.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe svchost.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe svchost.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com AAC666~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com AAC666~1.EXE File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\svchost.com AAC666~1.EXE File opened for modification C:\Windows\svchost.com AAC666~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\svchost.com AAC666~1.EXE File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com AAC666~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\svchost.com AAC666~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com AAC666~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com AAC666~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com AAC666~1.EXE File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\svchost.com AAC666~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com AAC666~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com AAC666~1.EXE File opened for modification C:\Windows\svchost.com AAC666~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\svchost.com AAC666~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com AAC666~1.EXE File opened for modification C:\Windows\svchost.com AAC666~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys AAC666~1.EXE File opened for modification C:\Windows\directx.sys AAC666~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2988 2744 WerFault.exe 364 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC666~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2652 2364 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 31 PID 2364 wrote to memory of 2652 2364 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 31 PID 2364 wrote to memory of 2652 2364 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 31 PID 2364 wrote to memory of 2652 2364 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 31 PID 2652 wrote to memory of 1808 2652 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 32 PID 2652 wrote to memory of 1808 2652 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 32 PID 2652 wrote to memory of 1808 2652 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 32 PID 2652 wrote to memory of 1808 2652 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 32 PID 1808 wrote to memory of 2328 1808 svchost.exe 33 PID 1808 wrote to memory of 2328 1808 svchost.exe 33 PID 1808 wrote to memory of 2328 1808 svchost.exe 33 PID 1808 wrote to memory of 2328 1808 svchost.exe 33 PID 2328 wrote to memory of 2828 2328 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 34 PID 2328 wrote to memory of 2828 2328 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 34 PID 2328 wrote to memory of 2828 2328 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 34 PID 2328 wrote to memory of 2828 2328 aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe 34 PID 2828 wrote to memory of 2844 2828 svchost.com 35 PID 2828 wrote to memory of 2844 2828 svchost.com 35 PID 2828 wrote to memory of 2844 2828 svchost.com 35 PID 2828 wrote to memory of 2844 2828 svchost.com 35 PID 2844 wrote to memory of 2796 2844 AAC666~1.EXE 67 PID 2844 wrote to memory of 2796 2844 AAC666~1.EXE 67 PID 2844 wrote to memory of 2796 2844 AAC666~1.EXE 67 PID 2844 wrote to memory of 2796 2844 AAC666~1.EXE 67 PID 2796 wrote to memory of 2624 2796 svchost.com 38 PID 2796 wrote to memory of 2624 2796 svchost.com 38 PID 2796 wrote to memory of 2624 2796 svchost.com 38 PID 2796 wrote to memory of 2624 2796 svchost.com 38 PID 2624 wrote to memory of 2588 2624 AAC666~1.EXE 39 PID 2624 wrote to memory of 2588 2624 AAC666~1.EXE 39 PID 2624 wrote to memory of 2588 2624 AAC666~1.EXE 39 PID 2624 wrote to memory of 2588 2624 AAC666~1.EXE 39 PID 2588 wrote to memory of 2284 2588 svchost.com 40 PID 2588 wrote to memory of 2284 2588 svchost.com 40 PID 2588 wrote to memory of 2284 2588 svchost.com 40 PID 2588 wrote to memory of 2284 2588 svchost.com 40 PID 2284 wrote to memory of 1996 2284 AAC666~1.EXE 72 PID 2284 wrote to memory of 1996 2284 AAC666~1.EXE 72 PID 2284 wrote to memory of 1996 2284 AAC666~1.EXE 72 PID 2284 wrote to memory of 1996 2284 AAC666~1.EXE 72 PID 1996 wrote to memory of 548 1996 svchost.com 42 PID 1996 wrote to memory of 548 1996 svchost.com 42 PID 1996 wrote to memory of 548 1996 svchost.com 42 PID 1996 wrote to memory of 548 1996 svchost.com 42 PID 548 wrote to memory of 1984 548 AAC666~1.EXE 75 PID 548 wrote to memory of 1984 548 AAC666~1.EXE 75 PID 548 wrote to memory of 1984 548 AAC666~1.EXE 75 PID 548 wrote to memory of 1984 548 AAC666~1.EXE 75 PID 1984 wrote to memory of 2660 1984 svchost.com 44 PID 1984 wrote to memory of 2660 1984 svchost.com 44 PID 1984 wrote to memory of 2660 1984 svchost.com 44 PID 1984 wrote to memory of 2660 1984 svchost.com 44 PID 2660 wrote to memory of 2316 2660 AAC666~1.EXE 45 PID 2660 wrote to memory of 2316 2660 AAC666~1.EXE 45 PID 2660 wrote to memory of 2316 2660 AAC666~1.EXE 45 PID 2660 wrote to memory of 2316 2660 AAC666~1.EXE 45 PID 2316 wrote to memory of 2000 2316 svchost.com 46 PID 2316 wrote to memory of 2000 2316 svchost.com 46 PID 2316 wrote to memory of 2000 2316 svchost.com 46 PID 2316 wrote to memory of 2000 2316 svchost.com 46 PID 2000 wrote to memory of 1296 2000 AAC666~1.EXE 47 PID 2000 wrote to memory of 1296 2000 AAC666~1.EXE 47 PID 2000 wrote to memory of 1296 2000 AAC666~1.EXE 47 PID 2000 wrote to memory of 1296 2000 AAC666~1.EXE 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\3582-490\aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\aac6660541b72842f5e7902b3bd5de3f_JaffaCakes118.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE16⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE18⤵
- Executes dropped EXE
PID:2924 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE20⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1080 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE22⤵
- Executes dropped EXE
PID:308 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE24⤵
- Executes dropped EXE
PID:1536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE26⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE28⤵
- Executes dropped EXE
PID:884 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE30⤵
- Executes dropped EXE
PID:1696 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE32⤵
- Executes dropped EXE
PID:2720 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE34⤵
- Executes dropped EXE
PID:2724 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE36⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2708 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE38⤵
- Executes dropped EXE
PID:2604 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:640 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE42⤵
- Executes dropped EXE
PID:1996 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE44⤵
- Executes dropped EXE
PID:2820 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE46⤵
- Executes dropped EXE
PID:2008 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE48⤵
- Executes dropped EXE
PID:1988 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE50⤵
- Executes dropped EXE
PID:2928 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE52⤵
- Executes dropped EXE
PID:2144 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:700 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE56⤵
- Executes dropped EXE
PID:2940 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1860 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE60⤵
- Executes dropped EXE
PID:1732 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"61⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE62⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1752 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"63⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"65⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE66⤵PID:2116
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"67⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE68⤵
- Drops file in Windows directory
PID:3044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"69⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE70⤵
- System Location Discovery: System Language Discovery
PID:2488 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"71⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE72⤵PID:2680
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"73⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE74⤵PID:2676
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"75⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE76⤵PID:2720
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"77⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE78⤵
- System Location Discovery: System Language Discovery
PID:2688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"79⤵
- Drops file in Windows directory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE80⤵PID:2736
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"81⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE82⤵PID:2408
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"83⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE84⤵PID:2632
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"85⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE86⤵
- Drops file in Windows directory
PID:2540 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"87⤵
- System Location Discovery: System Language Discovery
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE88⤵PID:536
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"89⤵
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE90⤵PID:1748
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"91⤵
- System Location Discovery: System Language Discovery
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE92⤵PID:1988
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"93⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE94⤵PID:2944
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"95⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE96⤵PID:2028
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"97⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE98⤵PID:2420
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"99⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE100⤵
- System Location Discovery: System Language Discovery
PID:1596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"101⤵
- Drops file in Windows directory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE102⤵PID:1576
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"103⤵
- Drops file in Windows directory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE104⤵PID:908
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"105⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE106⤵
- Drops file in Windows directory
PID:988 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"107⤵
- Drops file in Windows directory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE108⤵PID:1784
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"109⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE110⤵PID:1484
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"111⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE112⤵PID:2324
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"113⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE114⤵PID:2416
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"115⤵
- System Location Discovery: System Language Discovery
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE116⤵
- Drops file in Windows directory
PID:2280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"117⤵
- System Location Discovery: System Language Discovery
PID:764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE118⤵
- Drops file in Windows directory
PID:2676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"119⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE120⤵
- Drops file in Windows directory
PID:2728 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\AAC666~1.EXE"121⤵
- Drops file in Windows directory
PID:2596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-