Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-12-2024 19:43
Behavioral task
behavioral1
Sample
ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe
-
Size
222KB
-
MD5
ceb1db5017ee32cf49c8a33923a384c4
-
SHA1
c6fe5b4cc1b63c5e9d8d9b612a30022e1f045bf9
-
SHA256
91bdecb602c13e9dd190d3df09d2bd856829b30b70acd9c8e925b6cd33bcb629
-
SHA512
3b743d03b91938f3d5f574f3f39dba259c0bb52abd91997cd53f18a4576149cf69162f8fc7ef3bee66748bd3b1542dbc224477e28fed20b7d461789fa422c736
-
SSDEEP
3072:sr85CZYsbTJx5+AyfCQPikxkyyxO1AIOz1F8StsgdFoaApEzul4jmpjC1Hxr85C:k9asHJx523i3O1AI4zts4CB4aVCj9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x0008000000016c62-9.dat family_neshta behavioral1/files/0x0007000000016c7b-15.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x00010000000107e5-17.dat family_neshta behavioral1/files/0x000100000001070c-18.dat family_neshta behavioral1/memory/3020-29-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2848-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1124-53-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2832-52-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1800-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2840-57-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2624-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2896-71-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f7e6-107.dat family_neshta behavioral1/files/0x000100000000f7ca-104.dat family_neshta behavioral1/files/0x000100000000f776-101.dat family_neshta behavioral1/files/0x000100000000f7d8-99.dat family_neshta behavioral1/files/0x000100000000f7d3-98.dat family_neshta behavioral1/memory/1328-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1824-85-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1372-116-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1880-115-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f82d-129.dat family_neshta behavioral1/files/0x000100000000f82e-131.dat family_neshta behavioral1/files/0x000100000000f703-128.dat family_neshta behavioral1/memory/1892-136-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2940-135-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f872-137.dat family_neshta behavioral1/memory/1312-149-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1816-148-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/440-168-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2112-167-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2232-180-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1076-179-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2516-201-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1772-202-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1724-207-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2084-206-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2320-218-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2492-224-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1920-235-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/888-234-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1588-250-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2796-249-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2580-262-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2680-261-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2608-278-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2832-277-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2328-286-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2044-285-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2280-294-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2736-297-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1352-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2196-310-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1700-320-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1820-319-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1832-328-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1164-327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2756-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2072-336-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2256-349-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1612-348-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2940-352-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2816 ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe 2848 svchost.com 3020 CEB1DB~1.EXE 2832 svchost.com 1124 CEB1DB~1.EXE 2840 svchost.com 1800 CEB1DB~1.EXE 2624 svchost.com 2896 CEB1DB~1.EXE 1328 svchost.com 1824 CEB1DB~1.EXE 1372 svchost.com 1880 CEB1DB~1.EXE 1892 svchost.com 2940 CEB1DB~1.EXE 1312 svchost.com 1816 CEB1DB~1.EXE 440 svchost.com 2112 CEB1DB~1.EXE 1076 svchost.com 2232 CEB1DB~1.EXE 2516 svchost.com 1772 CEB1DB~1.EXE 1724 svchost.com 2084 CEB1DB~1.EXE 2320 svchost.com 2492 CEB1DB~1.EXE 1920 svchost.com 888 CEB1DB~1.EXE 2796 svchost.com 1588 CEB1DB~1.EXE 2680 svchost.com 2580 CEB1DB~1.EXE 2608 svchost.com 2832 CEB1DB~1.EXE 2328 svchost.com 2044 CEB1DB~1.EXE 2280 svchost.com 2736 CEB1DB~1.EXE 2196 svchost.com 1352 CEB1DB~1.EXE 1700 svchost.com 1820 CEB1DB~1.EXE 1832 svchost.com 1164 CEB1DB~1.EXE 2072 svchost.com 2756 CEB1DB~1.EXE 1612 svchost.com 2256 CEB1DB~1.EXE 2400 svchost.com 2940 CEB1DB~1.EXE 1468 svchost.com 1212 CEB1DB~1.EXE 404 svchost.com 2076 CEB1DB~1.EXE 2532 svchost.com 1504 CEB1DB~1.EXE 1748 svchost.com 2952 CEB1DB~1.EXE 1472 svchost.com 1532 CEB1DB~1.EXE 880 svchost.com 1376 CEB1DB~1.EXE 2056 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2664 ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe 2664 ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe 2848 svchost.com 2848 svchost.com 2832 svchost.com 2832 svchost.com 2840 svchost.com 2840 svchost.com 2624 svchost.com 2624 svchost.com 1328 svchost.com 1328 svchost.com 1372 svchost.com 1372 svchost.com 2664 ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe 2816 ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe 1892 svchost.com 1892 svchost.com 1312 svchost.com 1312 svchost.com 440 svchost.com 440 svchost.com 1076 svchost.com 1076 svchost.com 2516 svchost.com 2516 svchost.com 1724 svchost.com 1724 svchost.com 2816 ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe 2320 svchost.com 2320 svchost.com 1920 svchost.com 1920 svchost.com 2816 ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe 2796 svchost.com 2796 svchost.com 2680 svchost.com 2680 svchost.com 2816 ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe 2608 svchost.com 2608 svchost.com 2816 ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe 2328 svchost.com 2328 svchost.com 2280 svchost.com 2280 svchost.com 2196 svchost.com 2196 svchost.com 1700 svchost.com 1700 svchost.com 1832 svchost.com 1832 svchost.com 2072 svchost.com 2072 svchost.com 1612 svchost.com 1612 svchost.com 2400 svchost.com 2400 svchost.com 1468 svchost.com 1468 svchost.com 404 svchost.com 404 svchost.com 2532 svchost.com 2532 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com CEB1DB~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CEB1DB~1.EXE File opened for modification C:\Windows\directx.sys CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CEB1DB~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CEB1DB~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys CEB1DB~1.EXE File opened for modification C:\Windows\directx.sys CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CEB1DB~1.EXE File opened for modification C:\Windows\directx.sys CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CEB1DB~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com CEB1DB~1.EXE File opened for modification C:\Windows\directx.sys CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com CEB1DB~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com CEB1DB~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com CEB1DB~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB1DB~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2816 2664 ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe 31 PID 2664 wrote to memory of 2816 2664 ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe 31 PID 2664 wrote to memory of 2816 2664 ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe 31 PID 2664 wrote to memory of 2816 2664 ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe 31 PID 2816 wrote to memory of 2848 2816 ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe 32 PID 2816 wrote to memory of 2848 2816 ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe 32 PID 2816 wrote to memory of 2848 2816 ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe 32 PID 2816 wrote to memory of 2848 2816 ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe 32 PID 2848 wrote to memory of 3020 2848 svchost.com 33 PID 2848 wrote to memory of 3020 2848 svchost.com 33 PID 2848 wrote to memory of 3020 2848 svchost.com 33 PID 2848 wrote to memory of 3020 2848 svchost.com 33 PID 3020 wrote to memory of 2832 3020 CEB1DB~1.EXE 65 PID 3020 wrote to memory of 2832 3020 CEB1DB~1.EXE 65 PID 3020 wrote to memory of 2832 3020 CEB1DB~1.EXE 65 PID 3020 wrote to memory of 2832 3020 CEB1DB~1.EXE 65 PID 2832 wrote to memory of 1124 2832 svchost.com 35 PID 2832 wrote to memory of 1124 2832 svchost.com 35 PID 2832 wrote to memory of 1124 2832 svchost.com 35 PID 2832 wrote to memory of 1124 2832 svchost.com 35 PID 1124 wrote to memory of 2840 1124 CEB1DB~1.EXE 36 PID 1124 wrote to memory of 2840 1124 CEB1DB~1.EXE 36 PID 1124 wrote to memory of 2840 1124 CEB1DB~1.EXE 36 PID 1124 wrote to memory of 2840 1124 CEB1DB~1.EXE 36 PID 2840 wrote to memory of 1800 2840 svchost.com 37 PID 2840 wrote to memory of 1800 2840 svchost.com 37 PID 2840 wrote to memory of 1800 2840 svchost.com 37 PID 2840 wrote to memory of 1800 2840 svchost.com 37 PID 1800 wrote to memory of 2624 1800 CEB1DB~1.EXE 38 PID 1800 wrote to memory of 2624 1800 CEB1DB~1.EXE 38 PID 1800 wrote to memory of 2624 1800 CEB1DB~1.EXE 38 PID 1800 wrote to memory of 2624 1800 CEB1DB~1.EXE 38 PID 2624 wrote to memory of 2896 2624 svchost.com 39 PID 2624 wrote to memory of 2896 2624 svchost.com 39 PID 2624 wrote to memory of 2896 2624 svchost.com 39 PID 2624 wrote to memory of 2896 2624 svchost.com 39 PID 2896 wrote to memory of 1328 2896 CEB1DB~1.EXE 40 PID 2896 wrote to memory of 1328 2896 CEB1DB~1.EXE 40 PID 2896 wrote to memory of 1328 2896 CEB1DB~1.EXE 40 PID 2896 wrote to memory of 1328 2896 CEB1DB~1.EXE 40 PID 1328 wrote to memory of 1824 1328 svchost.com 41 PID 1328 wrote to memory of 1824 1328 svchost.com 41 PID 1328 wrote to memory of 1824 1328 svchost.com 41 PID 1328 wrote to memory of 1824 1328 svchost.com 41 PID 1824 wrote to memory of 1372 1824 CEB1DB~1.EXE 42 PID 1824 wrote to memory of 1372 1824 CEB1DB~1.EXE 42 PID 1824 wrote to memory of 1372 1824 CEB1DB~1.EXE 42 PID 1824 wrote to memory of 1372 1824 CEB1DB~1.EXE 42 PID 1372 wrote to memory of 1880 1372 svchost.com 43 PID 1372 wrote to memory of 1880 1372 svchost.com 43 PID 1372 wrote to memory of 1880 1372 svchost.com 43 PID 1372 wrote to memory of 1880 1372 svchost.com 43 PID 1880 wrote to memory of 1892 1880 CEB1DB~1.EXE 44 PID 1880 wrote to memory of 1892 1880 CEB1DB~1.EXE 44 PID 1880 wrote to memory of 1892 1880 CEB1DB~1.EXE 44 PID 1880 wrote to memory of 1892 1880 CEB1DB~1.EXE 44 PID 1892 wrote to memory of 2940 1892 svchost.com 81 PID 1892 wrote to memory of 2940 1892 svchost.com 81 PID 1892 wrote to memory of 2940 1892 svchost.com 81 PID 1892 wrote to memory of 2940 1892 svchost.com 81 PID 2940 wrote to memory of 1312 2940 CEB1DB~1.EXE 127 PID 2940 wrote to memory of 1312 2940 CEB1DB~1.EXE 127 PID 2940 wrote to memory of 1312 2940 CEB1DB~1.EXE 127 PID 2940 wrote to memory of 1312 2940 CEB1DB~1.EXE 127
Processes
-
C:\Users\Admin\AppData\Local\Temp\ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\3582-490\ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\ceb1db5017ee32cf49c8a33923a384c4_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:440 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE20⤵
- Executes dropped EXE
PID:2112 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE22⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2232 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE24⤵
- Executes dropped EXE
PID:1772 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE26⤵
- Executes dropped EXE
PID:2084 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE28⤵
- Executes dropped EXE
PID:2492 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE30⤵
- Executes dropped EXE
PID:888 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE32⤵
- Executes dropped EXE
PID:1588 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE36⤵
- Executes dropped EXE
PID:2832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE38⤵
- Executes dropped EXE
PID:2044 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE40⤵
- Executes dropped EXE
PID:2736 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE42⤵
- Executes dropped EXE
PID:1352 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1820 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1164 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE48⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2256 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE52⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2940 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE54⤵
- Executes dropped EXE
PID:1212 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:404 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE56⤵
- Executes dropped EXE
PID:2076 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE58⤵
- Executes dropped EXE
PID:1504 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"59⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE60⤵
- Executes dropped EXE
PID:2952 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"61⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE62⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"63⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE64⤵
- Executes dropped EXE
PID:1376 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE66⤵PID:2084
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"67⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE68⤵
- System Location Discovery: System Language Discovery
PID:2148 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"69⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE70⤵PID:1952
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"71⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE72⤵
- Drops file in Windows directory
PID:2808 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"73⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE74⤵PID:2584
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"75⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE76⤵PID:2592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"77⤵
- Drops file in Windows directory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE78⤵PID:2996
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"79⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE80⤵
- Drops file in Windows directory
PID:2620 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"81⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE82⤵
- Drops file in Windows directory
PID:1940 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"83⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE84⤵PID:2900
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"85⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE86⤵
- System Location Discovery: System Language Discovery
PID:2736 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"87⤵
- System Location Discovery: System Language Discovery
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE88⤵PID:296
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"89⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE90⤵
- System Location Discovery: System Language Discovery
PID:1048 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"91⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE92⤵PID:1204
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"93⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE94⤵
- System Location Discovery: System Language Discovery
PID:1228 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"95⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE96⤵
- Drops file in Windows directory
PID:2256 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"97⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE98⤵PID:1312
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"99⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE100⤵PID:2052
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"101⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE102⤵PID:2524
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"103⤵
- System Location Discovery: System Language Discovery
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE104⤵PID:2112
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"105⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE106⤵PID:1708
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"107⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE108⤵
- System Location Discovery: System Language Discovery
PID:2444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"109⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:612 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE110⤵PID:1232
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"111⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE112⤵PID:1040
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"113⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE114⤵PID:2096
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"115⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE116⤵
- Drops file in Windows directory
PID:2120 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"117⤵
- System Location Discovery: System Language Discovery
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE118⤵PID:3068
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"119⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE120⤵PID:3020
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\CEB1DB~1.EXE"121⤵
- System Location Discovery: System Language Discovery
PID:2592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-