Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-11-2024 10:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b0c5094c2c677da2735dd39b7752e600_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
b0c5094c2c677da2735dd39b7752e600_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
b0c5094c2c677da2735dd39b7752e600_JaffaCakes118.exe
-
Size
17KB
-
MD5
b0c5094c2c677da2735dd39b7752e600
-
SHA1
fc2accd937bbb23e1117b3ca0d0ebd9a075fa37d
-
SHA256
c97e3b54f054fe14af64f9912fde6aaa69e9863e2bc0f7aff7df8cd47e11722d
-
SHA512
e2dfb1179e53b03309fa9a9fbfefb3cca7b0779ebe816cd5d57059cdea9b5248e8fa200d4cabc9752e4fcf9efc1c826969e3e73c8648331db28bc28ca56e3b87
-
SSDEEP
384:u/aI71le/ABYoKNMjbruXtXTwDGaHoPEMa7De:fI71leYBY7N6KXtXKGWoPEb
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
Processes:
wininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad wininet.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad wininet.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" wininet.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" wininet.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" wininet.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad wininet.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad wininet.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" wininet.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" wininet.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad wininet.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad wininet.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" wininet.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysRun = "{D7FFD784-5276-42D1-887B-00267870A4C7}" Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Executes dropped EXE 64 IoCs
Processes:
wininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exepid Process 796 wininet.exe 2252 wininet.exe 2424 wininet.exe 2692 wininet.exe 2860 wininet.exe 2712 wininet.exe 2824 wininet.exe 2788 wininet.exe 2724 wininet.exe 2852 wininet.exe 2604 wininet.exe 2360 wininet.exe 824 wininet.exe 1740 wininet.exe 1892 wininet.exe 848 wininet.exe 2408 wininet.exe 2392 wininet.exe 2472 wininet.exe 2000 wininet.exe 1704 wininet.exe 1160 wininet.exe 852 wininet.exe 1996 wininet.exe 1724 wininet.exe 2804 wininet.exe 2960 wininet.exe 2212 wininet.exe 3068 wininet.exe 2092 wininet.exe 2168 wininet.exe 2952 wininet.exe 1920 wininet.exe 1696 wininet.exe 908 wininet.exe 1308 wininet.exe 2072 wininet.exe 2796 wininet.exe 1960 wininet.exe 956 wininet.exe 1760 wininet.exe 2540 wininet.exe 3008 wininet.exe 1348 wininet.exe 1316 wininet.exe 344 wininet.exe 556 wininet.exe 1380 wininet.exe 2220 wininet.exe 2184 wininet.exe 2276 wininet.exe 1540 wininet.exe 2496 wininet.exe 2088 wininet.exe 700 wininet.exe 1488 wininet.exe 2288 wininet.exe 1700 wininet.exe 2308 wininet.exe 1924 wininet.exe 1652 wininet.exe 2180 wininet.exe 2128 wininet.exe 2896 wininet.exe -
Loads dropped DLL 64 IoCs
Processes:
b0c5094c2c677da2735dd39b7752e600_JaffaCakes118.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exepid Process 2316 b0c5094c2c677da2735dd39b7752e600_JaffaCakes118.exe 2316 b0c5094c2c677da2735dd39b7752e600_JaffaCakes118.exe 796 wininet.exe 796 wininet.exe 2252 wininet.exe 2252 wininet.exe 2424 wininet.exe 2424 wininet.exe 2692 wininet.exe 2692 wininet.exe 2860 wininet.exe 2860 wininet.exe 2712 wininet.exe 2712 wininet.exe 2824 wininet.exe 2824 wininet.exe 2788 wininet.exe 2788 wininet.exe 2724 wininet.exe 2724 wininet.exe 2852 wininet.exe 2852 wininet.exe 2604 wininet.exe 2604 wininet.exe 2360 wininet.exe 2360 wininet.exe 824 wininet.exe 824 wininet.exe 1740 wininet.exe 1740 wininet.exe 1892 wininet.exe 1892 wininet.exe 848 wininet.exe 848 wininet.exe 2408 wininet.exe 2408 wininet.exe 2392 wininet.exe 2392 wininet.exe 2472 wininet.exe 2472 wininet.exe 2000 wininet.exe 2000 wininet.exe 1704 wininet.exe 1704 wininet.exe 1160 wininet.exe 1160 wininet.exe 852 wininet.exe 852 wininet.exe 1996 wininet.exe 1996 wininet.exe 1724 wininet.exe 1724 wininet.exe 2804 wininet.exe 2804 wininet.exe 2960 wininet.exe 2960 wininet.exe 2212 wininet.exe 2212 wininet.exe 3068 wininet.exe 3068 wininet.exe 2092 wininet.exe 2092 wininet.exe 2168 wininet.exe 2168 wininet.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
Processes:
wininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exedescription ioc Process File created C:\Windows\SysWOW64\wininet.exe wininet.exe File created C:\Windows\SysWOW64\wininet.exe File created C:\Windows\SysWOW64\wininet.exe wininet.exe File created C:\Windows\SysWOW64\wininet.exe wininet.exe File created C:\Windows\SysWOW64\wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll File created C:\Windows\SysWOW64\wininet.exe File created C:\Windows\SysWOW64\wininet.exe wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll wininet.exe File created C:\Windows\SysWOW64\wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll File created C:\Windows\SysWOW64\wininet.exe wininet.exe File created C:\Windows\SysWOW64\wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll File created C:\Windows\SysWOW64\wininet.exe File created C:\Windows\SysWOW64\wininet.exe wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll File opened for modification C:\Windows\SysWOW64\svshost.dll File opened for modification C:\Windows\SysWOW64\svshost.dll wininet.exe File created C:\Windows\SysWOW64\wininet.exe wininet.exe File created C:\Windows\SysWOW64\wininet.exe wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll File opened for modification C:\Windows\SysWOW64\svshost.dll File opened for modification C:\Windows\SysWOW64\svshost.dll wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll wininet.exe File created C:\Windows\SysWOW64\wininet.exe wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll File created C:\Windows\SysWOW64\wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll File created C:\Windows\SysWOW64\wininet.exe File created C:\Windows\SysWOW64\wininet.exe File created C:\Windows\SysWOW64\wininet.exe File created C:\Windows\SysWOW64\wininet.exe wininet.exe File created C:\Windows\SysWOW64\wininet.exe wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll File created C:\Windows\SysWOW64\wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll File created C:\Windows\SysWOW64\wininet.exe wininet.exe File created C:\Windows\SysWOW64\wininet.exe wininet.exe File created C:\Windows\SysWOW64\wininet.exe File created C:\Windows\SysWOW64\wininet.exe wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll File created C:\Windows\SysWOW64\wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll File opened for modification C:\Windows\SysWOW64\svshost.dll wininet.exe File created C:\Windows\SysWOW64\wininet.exe wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll File opened for modification C:\Windows\SysWOW64\svshost.dll wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll File opened for modification C:\Windows\SysWOW64\svshost.dll File created C:\Windows\SysWOW64\wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll File created C:\Windows\SysWOW64\wininet.exe File created C:\Windows\SysWOW64\wininet.exe File opened for modification C:\Windows\SysWOW64\svshost.dll File opened for modification C:\Windows\SysWOW64\svshost.dll File created C:\Windows\SysWOW64\wininet.exe File created C:\Windows\SysWOW64\wininet.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
wininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Modifies registry class 64 IoCs
Processes:
wininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 wininet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" wininet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" wininet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" wininet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" wininet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 wininet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 wininet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 wininet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 wininet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" wininet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 wininet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" wininet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 wininet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" wininet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32\ = "C:\\Windows\\SysWow64\\svshost.dll" wininet.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7FFD784-5276-42D1-887B-00267870A4C7}\InProcServer32 wininet.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b0c5094c2c677da2735dd39b7752e600_JaffaCakes118.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exewininet.exedescription pid Process procid_target PID 2316 wrote to memory of 796 2316 b0c5094c2c677da2735dd39b7752e600_JaffaCakes118.exe 31 PID 2316 wrote to memory of 796 2316 b0c5094c2c677da2735dd39b7752e600_JaffaCakes118.exe 31 PID 2316 wrote to memory of 796 2316 b0c5094c2c677da2735dd39b7752e600_JaffaCakes118.exe 31 PID 2316 wrote to memory of 796 2316 b0c5094c2c677da2735dd39b7752e600_JaffaCakes118.exe 31 PID 796 wrote to memory of 2252 796 wininet.exe 32 PID 796 wrote to memory of 2252 796 wininet.exe 32 PID 796 wrote to memory of 2252 796 wininet.exe 32 PID 796 wrote to memory of 2252 796 wininet.exe 32 PID 2252 wrote to memory of 2424 2252 wininet.exe 33 PID 2252 wrote to memory of 2424 2252 wininet.exe 33 PID 2252 wrote to memory of 2424 2252 wininet.exe 33 PID 2252 wrote to memory of 2424 2252 wininet.exe 33 PID 2424 wrote to memory of 2692 2424 wininet.exe 34 PID 2424 wrote to memory of 2692 2424 wininet.exe 34 PID 2424 wrote to memory of 2692 2424 wininet.exe 34 PID 2424 wrote to memory of 2692 2424 wininet.exe 34 PID 2692 wrote to memory of 2860 2692 wininet.exe 35 PID 2692 wrote to memory of 2860 2692 wininet.exe 35 PID 2692 wrote to memory of 2860 2692 wininet.exe 35 PID 2692 wrote to memory of 2860 2692 wininet.exe 35 PID 2860 wrote to memory of 2712 2860 wininet.exe 36 PID 2860 wrote to memory of 2712 2860 wininet.exe 36 PID 2860 wrote to memory of 2712 2860 wininet.exe 36 PID 2860 wrote to memory of 2712 2860 wininet.exe 36 PID 2712 wrote to memory of 2824 2712 wininet.exe 37 PID 2712 wrote to memory of 2824 2712 wininet.exe 37 PID 2712 wrote to memory of 2824 2712 wininet.exe 37 PID 2712 wrote to memory of 2824 2712 wininet.exe 37 PID 2824 wrote to memory of 2788 2824 wininet.exe 38 PID 2824 wrote to memory of 2788 2824 wininet.exe 38 PID 2824 wrote to memory of 2788 2824 wininet.exe 38 PID 2824 wrote to memory of 2788 2824 wininet.exe 38 PID 2788 wrote to memory of 2724 2788 wininet.exe 39 PID 2788 wrote to memory of 2724 2788 wininet.exe 39 PID 2788 wrote to memory of 2724 2788 wininet.exe 39 PID 2788 wrote to memory of 2724 2788 wininet.exe 39 PID 2724 wrote to memory of 2852 2724 wininet.exe 40 PID 2724 wrote to memory of 2852 2724 wininet.exe 40 PID 2724 wrote to memory of 2852 2724 wininet.exe 40 PID 2724 wrote to memory of 2852 2724 wininet.exe 40 PID 2852 wrote to memory of 2604 2852 wininet.exe 41 PID 2852 wrote to memory of 2604 2852 wininet.exe 41 PID 2852 wrote to memory of 2604 2852 wininet.exe 41 PID 2852 wrote to memory of 2604 2852 wininet.exe 41 PID 2604 wrote to memory of 2360 2604 wininet.exe 42 PID 2604 wrote to memory of 2360 2604 wininet.exe 42 PID 2604 wrote to memory of 2360 2604 wininet.exe 42 PID 2604 wrote to memory of 2360 2604 wininet.exe 42 PID 2360 wrote to memory of 824 2360 wininet.exe 43 PID 2360 wrote to memory of 824 2360 wininet.exe 43 PID 2360 wrote to memory of 824 2360 wininet.exe 43 PID 2360 wrote to memory of 824 2360 wininet.exe 43 PID 824 wrote to memory of 1740 824 wininet.exe 44 PID 824 wrote to memory of 1740 824 wininet.exe 44 PID 824 wrote to memory of 1740 824 wininet.exe 44 PID 824 wrote to memory of 1740 824 wininet.exe 44 PID 1740 wrote to memory of 1892 1740 wininet.exe 45 PID 1740 wrote to memory of 1892 1740 wininet.exe 45 PID 1740 wrote to memory of 1892 1740 wininet.exe 45 PID 1740 wrote to memory of 1892 1740 wininet.exe 45 PID 1892 wrote to memory of 848 1892 wininet.exe 46 PID 1892 wrote to memory of 848 1892 wininet.exe 46 PID 1892 wrote to memory of 848 1892 wininet.exe 46 PID 1892 wrote to memory of 848 1892 wininet.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0c5094c2c677da2735dd39b7752e600_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b0c5094c2c677da2735dd39b7752e600_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe22⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2168 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe33⤵
- Executes dropped EXE
PID:2952 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe34⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe35⤵
- Executes dropped EXE
PID:1696 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe36⤵
- Executes dropped EXE
PID:908 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe37⤵
- Executes dropped EXE
PID:1308 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe38⤵
- Executes dropped EXE
PID:2072 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe39⤵
- Executes dropped EXE
PID:2796 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe40⤵
- Executes dropped EXE
PID:1960 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe41⤵
- Executes dropped EXE
PID:956 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe42⤵
- Executes dropped EXE
PID:1760 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe43⤵
- Executes dropped EXE
PID:2540 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe44⤵
- Executes dropped EXE
PID:3008 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe45⤵
- Executes dropped EXE
PID:1348 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe46⤵
- Executes dropped EXE
PID:1316 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe47⤵
- Executes dropped EXE
PID:344 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe48⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:556 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe49⤵
- Executes dropped EXE
PID:1380 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe50⤵
- Executes dropped EXE
PID:2220 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe51⤵
- Executes dropped EXE
- Modifies registry class
PID:2184 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe52⤵
- Executes dropped EXE
PID:2276 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe53⤵
- Executes dropped EXE
PID:1540 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe54⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:2088 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe56⤵
- Executes dropped EXE
PID:700 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe57⤵
- Executes dropped EXE
PID:1488 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe58⤵
- Executes dropped EXE
PID:2288 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe59⤵
- Executes dropped EXE
PID:1700 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe60⤵
- Executes dropped EXE
PID:2308 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1924 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe62⤵
- Executes dropped EXE
PID:1652 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe63⤵
- Executes dropped EXE
PID:2180 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2128 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe65⤵
- Executes dropped EXE
PID:2896 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe66⤵PID:2112
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe67⤵PID:2480
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe68⤵
- Modifies registry class
PID:1332 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe69⤵PID:2164
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe70⤵PID:2228
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe71⤵PID:1600
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe72⤵PID:2696
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe73⤵PID:2440
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe74⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2716 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe75⤵PID:2984
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe76⤵PID:2592
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe77⤵PID:2868
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe78⤵PID:2888
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe79⤵PID:2608
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe80⤵PID:2856
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe81⤵PID:2632
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe82⤵PID:2596
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe83⤵PID:2708
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe84⤵PID:3064
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe85⤵PID:2108
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe86⤵PID:1832
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe87⤵PID:1812
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe88⤵PID:1668
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe89⤵PID:2096
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe90⤵PID:776
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe91⤵PID:1800
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe92⤵PID:2776
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe93⤵PID:2192
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe94⤵PID:2156
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe95⤵PID:2944
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe96⤵PID:1480
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe97⤵PID:1664
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe98⤵PID:1132
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe99⤵PID:2564
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe100⤵PID:2036
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe101⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1328 -
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe102⤵PID:1040
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe103⤵PID:2008
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe104⤵PID:2144
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe105⤵PID:568
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe106⤵PID:496
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe107⤵PID:2344
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe108⤵PID:2508
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe109⤵PID:640
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe110⤵PID:2512
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe111⤵PID:2172
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe112⤵PID:888
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe113⤵PID:940
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe114⤵PID:2520
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe115⤵PID:2348
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe116⤵PID:1592
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe117⤵PID:2304
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe118⤵PID:2844
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe119⤵PID:2848
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe120⤵PID:2892
-
C:\Windows\SysWOW64\wininet.exeC:\Windows\system32\wininet.exe121⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-