Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-12-2024 17:03
Static task
static1
Behavioral task
behavioral1
Sample
e764564f35f8233b9a264792674887d2_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e764564f35f8233b9a264792674887d2_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
e764564f35f8233b9a264792674887d2_JaffaCakes118.exe
-
Size
358KB
-
MD5
e764564f35f8233b9a264792674887d2
-
SHA1
33d8520e18644a762f0529c6e00365677d0067d5
-
SHA256
e9acddb4747d00754ab52d6590305ab5c3ba9ba6e849a7415e292a77479afa02
-
SHA512
59c09d88e4cd369472862023a17ca81d7f2f3671dc4a49ba4605346da32b0faf5761290b2cea1f30090a5130c8bf0293d87710375920e067540894e20f5fa435
-
SSDEEP
6144:jyH7xOc6H5c6HcT66vlmrpdF48rAkGR1ObhB7BL6SoOQ48AtBloP+aP1OeUeRUqO:jaw88ckW1a7BLZ8h+0EeLadeW
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral2/files/0x0007000000023c81-8.dat family_neshta behavioral2/files/0x0007000000023c83-25.dat family_neshta behavioral2/files/0x0007000000023c85-33.dat family_neshta behavioral2/memory/3656-40-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1052-51-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2044-52-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2948-62-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2092-64-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4944-68-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3672-76-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/624-80-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2412-89-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x000100000002022a-107.dat family_neshta behavioral2/files/0x000400000002034d-111.dat family_neshta behavioral2/files/0x000400000002030e-115.dat family_neshta behavioral2/memory/4636-123-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x00010000000202ac-110.dat family_neshta behavioral2/files/0x000400000002033b-109.dat family_neshta behavioral2/files/0x0001000000020299-108.dat family_neshta behavioral2/memory/4220-126-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x000600000002021b-95.dat family_neshta behavioral2/files/0x0007000000020283-94.dat family_neshta behavioral2/files/0x0004000000020348-90.dat family_neshta behavioral2/memory/2972-130-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x0002000000020312-141.dat family_neshta behavioral2/files/0x00010000000214e1-150.dat family_neshta behavioral2/files/0x00010000000214e0-148.dat family_neshta behavioral2/files/0x00010000000225de-146.dat family_neshta behavioral2/files/0x0001000000022f41-155.dat family_neshta behavioral2/files/0x0001000000022f42-160.dat family_neshta behavioral2/files/0x00010000000214df-147.dat family_neshta behavioral2/files/0x0001000000022f3f-161.dat family_neshta behavioral2/files/0x0001000000022f80-164.dat family_neshta behavioral2/memory/888-169-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x00010000000167fd-171.dat family_neshta behavioral2/files/0x000100000001dbca-184.dat family_neshta behavioral2/memory/3100-196-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/files/0x000100000001690e-195.dat family_neshta behavioral2/files/0x0001000000016912-194.dat family_neshta behavioral2/files/0x000100000001690f-206.dat family_neshta behavioral2/memory/4924-212-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3092-220-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4652-227-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3336-236-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3692-250-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4920-252-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1512-262-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3252-269-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4580-270-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4544-272-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2964-278-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3060-285-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3636-286-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3652-293-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3528-294-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/116-301-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2540-302-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3052-304-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1452-310-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/3040-312-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/2800-318-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/4116-325-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/1528-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral2/memory/5084-328-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation e764564f35f8233b9a264792674887d2_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation e764564f35f8233b9a264792674887d2_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation E76456~1.EXE -
Executes dropped EXE 64 IoCs
pid Process 1832 svchost.exe 1940 e764564f35f8233b9a264792674887d2_JaffaCakes118.exe 3292 svchost.exe 4412 e764564f35f8233b9a264792674887d2_JaffaCakes118.exe 4500 svchost.exe 1124 e764564f35f8233b9a264792674887d2_JaffaCakes118.exe 3656 svchost.com 1052 E76456~1.EXE 2044 svchost.com 2948 E76456~1.EXE 2092 svchost.com 4944 E76456~1.EXE 3672 svchost.com 624 E76456~1.EXE 2412 svchost.com 4636 E76456~1.EXE 4220 svchost.com 2972 E76456~1.EXE 888 svchost.com 3100 E76456~1.EXE 4924 svchost.com 3092 E76456~1.EXE 4652 svchost.com 3336 E76456~1.EXE 3692 svchost.com 4920 E76456~1.EXE 1512 svchost.com 3252 E76456~1.EXE 4580 svchost.com 4544 E76456~1.EXE 2964 svchost.com 3060 E76456~1.EXE 3636 svchost.com 3652 E76456~1.EXE 3528 svchost.com 116 E76456~1.EXE 2540 svchost.com 3052 E76456~1.EXE 1452 svchost.com 3040 E76456~1.EXE 2800 svchost.com 4116 E76456~1.EXE 1528 svchost.com 5084 E76456~1.EXE 1920 svchost.com 4480 E76456~1.EXE 4220 svchost.com 4284 E76456~1.EXE 1064 svchost.com 1056 E76456~1.EXE 1960 svchost.com 4280 E76456~1.EXE 2944 svchost.com 2108 E76456~1.EXE 4816 svchost.com 4316 E76456~1.EXE 1520 svchost.com 2868 E76456~1.EXE 4760 svchost.com 3596 E76456~1.EXE 3944 svchost.com 2852 E76456~1.EXE 3852 svchost.com 4536 E76456~1.EXE -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" e764564f35f8233b9a264792674887d2_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe svchost.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE svchost.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe svchost.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE e764564f35f8233b9a264792674887d2_JaffaCakes118.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe e764564f35f8233b9a264792674887d2_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys E76456~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys E76456~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys E76456~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys E76456~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\directx.sys E76456~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys E76456~1.EXE File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\directx.sys E76456~1.EXE File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys E76456~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys E76456~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys E76456~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys E76456~1.EXE File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys E76456~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\directx.sys E76456~1.EXE File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\directx.sys E76456~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\svchost.com E76456~1.EXE File opened for modification C:\Windows\directx.sys E76456~1.EXE File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e764564f35f8233b9a264792674887d2_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76456~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings e764564f35f8233b9a264792674887d2_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings E76456~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 1832 2216 e764564f35f8233b9a264792674887d2_JaffaCakes118.exe 82 PID 2216 wrote to memory of 1832 2216 e764564f35f8233b9a264792674887d2_JaffaCakes118.exe 82 PID 2216 wrote to memory of 1832 2216 e764564f35f8233b9a264792674887d2_JaffaCakes118.exe 82 PID 1832 wrote to memory of 1940 1832 svchost.exe 83 PID 1832 wrote to memory of 1940 1832 svchost.exe 83 PID 1832 wrote to memory of 1940 1832 svchost.exe 83 PID 1940 wrote to memory of 4412 1940 e764564f35f8233b9a264792674887d2_JaffaCakes118.exe 85 PID 1940 wrote to memory of 4412 1940 e764564f35f8233b9a264792674887d2_JaffaCakes118.exe 85 PID 1940 wrote to memory of 4412 1940 e764564f35f8233b9a264792674887d2_JaffaCakes118.exe 85 PID 4412 wrote to memory of 4500 4412 e764564f35f8233b9a264792674887d2_JaffaCakes118.exe 86 PID 4412 wrote to memory of 4500 4412 e764564f35f8233b9a264792674887d2_JaffaCakes118.exe 86 PID 4412 wrote to memory of 4500 4412 e764564f35f8233b9a264792674887d2_JaffaCakes118.exe 86 PID 4500 wrote to memory of 1124 4500 svchost.exe 87 PID 4500 wrote to memory of 1124 4500 svchost.exe 87 PID 4500 wrote to memory of 1124 4500 svchost.exe 87 PID 1124 wrote to memory of 3656 1124 e764564f35f8233b9a264792674887d2_JaffaCakes118.exe 88 PID 1124 wrote to memory of 3656 1124 e764564f35f8233b9a264792674887d2_JaffaCakes118.exe 88 PID 1124 wrote to memory of 3656 1124 e764564f35f8233b9a264792674887d2_JaffaCakes118.exe 88 PID 3656 wrote to memory of 1052 3656 svchost.com 89 PID 3656 wrote to memory of 1052 3656 svchost.com 89 PID 3656 wrote to memory of 1052 3656 svchost.com 89 PID 1052 wrote to memory of 2044 1052 E76456~1.EXE 90 PID 1052 wrote to memory of 2044 1052 E76456~1.EXE 90 PID 1052 wrote to memory of 2044 1052 E76456~1.EXE 90 PID 2044 wrote to memory of 2948 2044 svchost.com 91 PID 2044 wrote to memory of 2948 2044 svchost.com 91 PID 2044 wrote to memory of 2948 2044 svchost.com 91 PID 2948 wrote to memory of 2092 2948 E76456~1.EXE 92 PID 2948 wrote to memory of 2092 2948 E76456~1.EXE 92 PID 2948 wrote to memory of 2092 2948 E76456~1.EXE 92 PID 2092 wrote to memory of 4944 2092 svchost.com 93 PID 2092 wrote to memory of 4944 2092 svchost.com 93 PID 2092 wrote to memory of 4944 2092 svchost.com 93 PID 4944 wrote to memory of 3672 4944 E76456~1.EXE 94 PID 4944 wrote to memory of 3672 4944 E76456~1.EXE 94 PID 4944 wrote to memory of 3672 4944 E76456~1.EXE 94 PID 3672 wrote to memory of 624 3672 svchost.com 95 PID 3672 wrote to memory of 624 3672 svchost.com 95 PID 3672 wrote to memory of 624 3672 svchost.com 95 PID 624 wrote to memory of 2412 624 E76456~1.EXE 96 PID 624 wrote to memory of 2412 624 E76456~1.EXE 96 PID 624 wrote to memory of 2412 624 E76456~1.EXE 96 PID 2412 wrote to memory of 4636 2412 svchost.com 97 PID 2412 wrote to memory of 4636 2412 svchost.com 97 PID 2412 wrote to memory of 4636 2412 svchost.com 97 PID 4636 wrote to memory of 4220 4636 E76456~1.EXE 128 PID 4636 wrote to memory of 4220 4636 E76456~1.EXE 128 PID 4636 wrote to memory of 4220 4636 E76456~1.EXE 128 PID 4220 wrote to memory of 2972 4220 svchost.com 99 PID 4220 wrote to memory of 2972 4220 svchost.com 99 PID 4220 wrote to memory of 2972 4220 svchost.com 99 PID 2972 wrote to memory of 888 2972 E76456~1.EXE 100 PID 2972 wrote to memory of 888 2972 E76456~1.EXE 100 PID 2972 wrote to memory of 888 2972 E76456~1.EXE 100 PID 888 wrote to memory of 3100 888 svchost.com 101 PID 888 wrote to memory of 3100 888 svchost.com 101 PID 888 wrote to memory of 3100 888 svchost.com 101 PID 3100 wrote to memory of 4924 3100 E76456~1.EXE 179 PID 3100 wrote to memory of 4924 3100 E76456~1.EXE 179 PID 3100 wrote to memory of 4924 3100 E76456~1.EXE 179 PID 4924 wrote to memory of 3092 4924 svchost.com 103 PID 4924 wrote to memory of 3092 4924 svchost.com 103 PID 4924 wrote to memory of 3092 4924 svchost.com 103 PID 3092 wrote to memory of 4652 3092 E76456~1.EXE 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\e764564f35f8233b9a264792674887d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e764564f35f8233b9a264792674887d2_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\e764564f35f8233b9a264792674887d2_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\e764564f35f8233b9a264792674887d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e764564f35f8233b9a264792674887d2_JaffaCakes118.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\3582-490\e764564f35f8233b9a264792674887d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\e764564f35f8233b9a264792674887d2_JaffaCakes118.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\e764564f35f8233b9a264792674887d2_JaffaCakes118.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\3582-490\e764564f35f8233b9a264792674887d2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\e764564f35f8233b9a264792674887d2_JaffaCakes118.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE10⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE16⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE20⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"23⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3336 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"25⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
PID:4920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"27⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE28⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3252 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"29⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE30⤵
- Executes dropped EXE
- Modifies registry class
PID:4544 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"31⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE32⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3060 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"33⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE34⤵
- Executes dropped EXE
- Modifies registry class
PID:3652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"35⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE36⤵
- Executes dropped EXE
PID:116 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"37⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE38⤵
- Executes dropped EXE
PID:3052 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"39⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE40⤵
- Checks computer location settings
- Executes dropped EXE
PID:3040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"41⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE42⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4116 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5084 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"45⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE46⤵
- Executes dropped EXE
- Modifies registry class
PID:4480 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"47⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE48⤵
- Executes dropped EXE
PID:4284 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"49⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE50⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:1056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"51⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE52⤵
- Executes dropped EXE
- Modifies registry class
PID:4280 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"53⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE54⤵
- Executes dropped EXE
- Modifies registry class
PID:2108 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE56⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"57⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE58⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:2868 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"59⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE60⤵
- Executes dropped EXE
PID:3596 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"61⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE62⤵
- Checks computer location settings
- Executes dropped EXE
PID:2852 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"63⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4536 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"65⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE66⤵
- System Location Discovery: System Language Discovery
PID:4376 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"67⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE68⤵PID:4580
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"69⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE70⤵
- Checks computer location settings
PID:4300 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"71⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE72⤵
- Drops file in Windows directory
PID:3636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"73⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE74⤵
- Modifies registry class
PID:2192 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"75⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE76⤵
- Checks computer location settings
PID:116 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"77⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE78⤵
- Modifies registry class
PID:4944 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"79⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE80⤵
- Checks computer location settings
PID:1760 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"81⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE82⤵
- Drops file in Windows directory
PID:4128 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"83⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE84⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:540 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"85⤵
- System Location Discovery: System Language Discovery
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE86⤵PID:1664
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"87⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE88⤵
- Drops file in Windows directory
- Modifies registry class
PID:4440 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"89⤵
- Drops file in Windows directory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE90⤵PID:3196
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"91⤵
- System Location Discovery: System Language Discovery
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE92⤵
- Checks computer location settings
PID:4608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"93⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE94⤵
- Modifies registry class
PID:1848 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"95⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE96⤵PID:4924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"97⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE98⤵PID:1308
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"99⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE100⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
PID:4296 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"101⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE102⤵
- Checks computer location settings
PID:4532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"103⤵
- Drops file in Windows directory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE104⤵
- Checks computer location settings
- Modifies registry class
PID:4444 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"105⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE106⤵PID:5100
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"107⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE108⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3928 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"109⤵
- Drops file in Windows directory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE110⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:3932 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"111⤵
- Drops file in Windows directory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE112⤵
- Modifies registry class
PID:1948 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"113⤵
- System Location Discovery: System Language Discovery
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE114⤵
- Modifies registry class
PID:4360 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"115⤵
- System Location Discovery: System Language Discovery
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE116⤵PID:2304
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"117⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE118⤵
- Checks computer location settings
PID:2228 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"119⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE120⤵PID:1828
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE"121⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\E76456~1.EXE122⤵
- Checks computer location settings
PID:1880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-