Analysis
-
max time kernel
132s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
30-12-2024 04:10
Behavioral task
behavioral1
Sample
JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe
-
Size
166KB
-
MD5
43f0afbb1eddf8e688a67c6cf65a7689
-
SHA1
29ae9717192462c31100f5d7d8db93f5b85382df
-
SHA256
ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b
-
SHA512
e088452475330832b49fd66e88904deb9e36aa09041608831eff410f9e31f4bc3ba4749d49f492124480e10f79d85c20acce2d20a4831ae4a676985bf3bb83a0
-
SSDEEP
3072:IXFdMW/N1r5sFU8z2WePmVZ+6cfLbTg0Z4REC+RBs9CbVtg02:uFdirz2Wl+pLSyX7ssbA
Score
7/10
Malware Config
Signatures
-
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe -
System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Kills process with taskkill 6 IoCs
pid Process 2396 TASKKILL.exe 548 TASKKILL.exe 2904 TASKKILL.exe 324 TASKKILL.exe 2012 TASKKILL.exe 2016 TASKKILL.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2692 schtasks.exe 2932 schtasks.exe 2280 schtasks.exe 2068 schtasks.exe 2348 schtasks.exe 1936 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe Token: SeDebugPrivilege 2012 TASKKILL.exe Token: SeDebugPrivilege 2016 TASKKILL.exe Token: SeDebugPrivilege 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe Token: SeDebugPrivilege 2396 TASKKILL.exe Token: SeDebugPrivilege 548 TASKKILL.exe Token: SeDebugPrivilege 2708 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe Token: SeDebugPrivilege 2904 TASKKILL.exe Token: SeDebugPrivilege 324 TASKKILL.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2440 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 30 PID 3036 wrote to memory of 2440 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 30 PID 3036 wrote to memory of 2440 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 30 PID 3036 wrote to memory of 2440 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 30 PID 3036 wrote to memory of 1936 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 32 PID 3036 wrote to memory of 1936 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 32 PID 3036 wrote to memory of 1936 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 32 PID 3036 wrote to memory of 1936 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 32 PID 3036 wrote to memory of 2012 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 34 PID 3036 wrote to memory of 2012 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 34 PID 3036 wrote to memory of 2012 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 34 PID 3036 wrote to memory of 2012 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 34 PID 3036 wrote to memory of 2016 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 35 PID 3036 wrote to memory of 2016 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 35 PID 3036 wrote to memory of 2016 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 35 PID 3036 wrote to memory of 2016 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 35 PID 3036 wrote to memory of 1944 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 39 PID 3036 wrote to memory of 1944 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 39 PID 3036 wrote to memory of 1944 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 39 PID 3036 wrote to memory of 1944 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 39 PID 3036 wrote to memory of 2692 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 41 PID 3036 wrote to memory of 2692 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 41 PID 3036 wrote to memory of 2692 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 41 PID 3036 wrote to memory of 2692 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 41 PID 3036 wrote to memory of 788 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 44 PID 3036 wrote to memory of 788 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 44 PID 3036 wrote to memory of 788 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 44 PID 3036 wrote to memory of 788 3036 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 44 PID 1304 wrote to memory of 1768 1304 taskeng.exe 46 PID 1304 wrote to memory of 1768 1304 taskeng.exe 46 PID 1304 wrote to memory of 1768 1304 taskeng.exe 46 PID 1304 wrote to memory of 1768 1304 taskeng.exe 46 PID 1768 wrote to memory of 3040 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 47 PID 1768 wrote to memory of 3040 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 47 PID 1768 wrote to memory of 3040 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 47 PID 1768 wrote to memory of 3040 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 47 PID 1768 wrote to memory of 2932 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 49 PID 1768 wrote to memory of 2932 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 49 PID 1768 wrote to memory of 2932 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 49 PID 1768 wrote to memory of 2932 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 49 PID 1768 wrote to memory of 2396 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 51 PID 1768 wrote to memory of 2396 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 51 PID 1768 wrote to memory of 2396 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 51 PID 1768 wrote to memory of 2396 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 51 PID 1768 wrote to memory of 548 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 52 PID 1768 wrote to memory of 548 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 52 PID 1768 wrote to memory of 548 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 52 PID 1768 wrote to memory of 548 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 52 PID 1768 wrote to memory of 648 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 55 PID 1768 wrote to memory of 648 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 55 PID 1768 wrote to memory of 648 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 55 PID 1768 wrote to memory of 648 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 55 PID 1768 wrote to memory of 2280 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 57 PID 1768 wrote to memory of 2280 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 57 PID 1768 wrote to memory of 2280 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 57 PID 1768 wrote to memory of 2280 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 57 PID 1768 wrote to memory of 1868 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 59 PID 1768 wrote to memory of 1868 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 59 PID 1768 wrote to memory of 1868 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 59 PID 1768 wrote to memory of 1868 1768 JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe 59 PID 1304 wrote to memory of 2708 1304 taskeng.exe 60 PID 1304 wrote to memory of 2708 1304 taskeng.exe 60 PID 1304 wrote to memory of 2708 1304 taskeng.exe 60 PID 1304 wrote to memory of 2708 1304 taskeng.exe 60
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:2440
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1936
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:1944
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2692
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 12282⤵
- System Location Discovery: System Language Discovery
PID:788
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {80CEDCA1-7DF0-4060-9D27-3407E22F8C57} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F3⤵
- System Location Discovery: System Language Discovery
PID:3040
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe" /sc minute /mo 53⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2932
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2396
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:548
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
- System Location Discovery: System Language Discovery
PID:648
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe" /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2280
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 6083⤵
- System Location Discovery: System Language Discovery
PID:1868
-
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2708 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F3⤵
- System Location Discovery: System Language Discovery
PID:2020
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe" /sc minute /mo 53⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2068
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:324
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
- System Location Discovery: System Language Discovery
PID:2172
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ae3ef2854150dc9e97f7d56b6933491f9cca296b8a8248b2e638d5362f1fc28b.exe" /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2348
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 6203⤵
- System Location Discovery: System Language Discovery
PID:2480
-
-