Analysis
-
max time kernel
36s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
03-01-2025 02:20
Behavioral task
behavioral1
Sample
JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe
-
Size
1.3MB
-
MD5
69a1c83477d7a4d082b56821bf73a9d0
-
SHA1
c5cad52dc89b3d31d5ee059532ab14a98a029f55
-
SHA256
5c26806a4c0fc085a788dda9b80a8d940a5d68170658054ca84e40a91e306174
-
SHA512
913c418ac8d4fc949715895c0cfa821fbf2c5469de8ba541d0598f539ed674b0c6bb6d4d5f680af2704ac404ac02e3bdc6606351ac2d72696f88ea65ceebfd0f
-
SSDEEP
24576:sweDhRtLLZOIHaI0EK7x/QX2QW/GmGuKHjOOC42nMvTmwMzgZD9aRzA:t49LN6/w2QoG+KDAMvTjMqD8
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x001c000000016cab-2.dat family_neshta behavioral1/files/0x0008000000016ce9-15.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x0005000000010351-18.dat family_neshta behavioral1/files/0x0002000000010484-17.dat family_neshta behavioral1/memory/3012-32-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2148-33-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2784-45-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2988-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2900-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2760-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2968-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/736-87-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1832-115-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/336-114-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/812-101-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1484-99-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2792-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2140-129-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1976-142-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1748-143-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2220-164-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1672-163-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/660-128-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1048-172-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/532-171-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1460-186-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2144-187-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1688-194-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1124-195-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1828-213-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2332-214-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1904-235-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1100-236-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2276-244-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1648-245-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2716-263-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3000-262-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2816-59-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2656-293-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1384-292-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2168-304-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2856-305-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2172-314-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2200-313-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2412-326-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1232-327-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1744-335-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1484-334-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2248-343-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2876-342-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2316-351-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1208-350-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1436-359-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/660-358-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2480-367-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1640-366-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2580-375-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2424-374-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2732-383-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1128-382-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1588-391-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2984-390-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 3068 JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe 2148 svchost.com 3012 JAFFAC~1.EXE 2784 svchost.com 2988 JAFFAC~1.EXE 2816 svchost.com 2792 JAFFAC~1.EXE 2900 svchost.com 2760 JAFFAC~1.EXE 736 svchost.com 2968 JAFFAC~1.EXE 812 svchost.com 1484 JAFFAC~1.EXE 336 svchost.com 1832 JAFFAC~1.EXE 2140 svchost.com 660 JAFFAC~1.EXE 1748 svchost.com 1976 JAFFAC~1.EXE 2220 svchost.com 1672 JAFFAC~1.EXE 532 svchost.com 1048 JAFFAC~1.EXE 2144 svchost.com 1460 JAFFAC~1.EXE 1124 svchost.com 1688 JAFFAC~1.EXE 2332 svchost.com 1828 JAFFAC~1.EXE 1100 svchost.com 1904 JAFFAC~1.EXE 2276 svchost.com 1648 JAFFAC~1.EXE 2716 svchost.com 3000 JAFFAC~1.EXE 2656 svchost.com 1384 JAFFAC~1.EXE 2856 svchost.com 2168 JAFFAC~1.EXE 2172 svchost.com 2200 JAFFAC~1.EXE 2412 svchost.com 1232 JAFFAC~1.EXE 1744 svchost.com 1484 JAFFAC~1.EXE 2876 svchost.com 2248 JAFFAC~1.EXE 2316 svchost.com 1208 JAFFAC~1.EXE 1436 svchost.com 660 JAFFAC~1.EXE 2480 svchost.com 1640 JAFFAC~1.EXE 2580 svchost.com 2424 JAFFAC~1.EXE 2732 svchost.com 1128 JAFFAC~1.EXE 1588 svchost.com 2984 JAFFAC~1.EXE 1920 svchost.com 1496 JAFFAC~1.EXE 1500 svchost.com 756 JAFFAC~1.EXE 2568 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2256 JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe 2256 JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe 2148 svchost.com 2148 svchost.com 2784 svchost.com 2784 svchost.com 2816 svchost.com 2816 svchost.com 2900 svchost.com 2900 svchost.com 736 svchost.com 736 svchost.com 812 svchost.com 812 svchost.com 336 svchost.com 336 svchost.com 2140 svchost.com 2140 svchost.com 1748 svchost.com 1748 svchost.com 2220 svchost.com 2220 svchost.com 3068 JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe 532 svchost.com 532 svchost.com 2144 svchost.com 2144 svchost.com 1124 svchost.com 1124 svchost.com 2332 svchost.com 2332 svchost.com 3068 JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe 1100 svchost.com 1100 svchost.com 2276 svchost.com 2276 svchost.com 2716 svchost.com 2716 svchost.com 2656 svchost.com 2656 svchost.com 3068 JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe 2856 svchost.com 2856 svchost.com 2172 svchost.com 2172 svchost.com 2412 svchost.com 2412 svchost.com 1744 svchost.com 1744 svchost.com 2876 svchost.com 2876 svchost.com 2316 svchost.com 2316 svchost.com 1436 svchost.com 1436 svchost.com 2480 svchost.com 2480 svchost.com 2580 svchost.com 2580 svchost.com 2732 svchost.com 2732 svchost.com 1588 svchost.com 1588 svchost.com 1920 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2256 wrote to memory of 3068 2256 JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe 30 PID 2256 wrote to memory of 3068 2256 JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe 30 PID 2256 wrote to memory of 3068 2256 JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe 30 PID 2256 wrote to memory of 3068 2256 JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe 30 PID 3068 wrote to memory of 2148 3068 JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe 31 PID 3068 wrote to memory of 2148 3068 JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe 31 PID 3068 wrote to memory of 2148 3068 JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe 31 PID 3068 wrote to memory of 2148 3068 JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe 31 PID 2148 wrote to memory of 3012 2148 svchost.com 32 PID 2148 wrote to memory of 3012 2148 svchost.com 32 PID 2148 wrote to memory of 3012 2148 svchost.com 32 PID 2148 wrote to memory of 3012 2148 svchost.com 32 PID 3012 wrote to memory of 2784 3012 JAFFAC~1.EXE 33 PID 3012 wrote to memory of 2784 3012 JAFFAC~1.EXE 33 PID 3012 wrote to memory of 2784 3012 JAFFAC~1.EXE 33 PID 3012 wrote to memory of 2784 3012 JAFFAC~1.EXE 33 PID 2784 wrote to memory of 2988 2784 svchost.com 34 PID 2784 wrote to memory of 2988 2784 svchost.com 34 PID 2784 wrote to memory of 2988 2784 svchost.com 34 PID 2784 wrote to memory of 2988 2784 svchost.com 34 PID 2988 wrote to memory of 2816 2988 JAFFAC~1.EXE 35 PID 2988 wrote to memory of 2816 2988 JAFFAC~1.EXE 35 PID 2988 wrote to memory of 2816 2988 JAFFAC~1.EXE 35 PID 2988 wrote to memory of 2816 2988 JAFFAC~1.EXE 35 PID 2816 wrote to memory of 2792 2816 svchost.com 36 PID 2816 wrote to memory of 2792 2816 svchost.com 36 PID 2816 wrote to memory of 2792 2816 svchost.com 36 PID 2816 wrote to memory of 2792 2816 svchost.com 36 PID 2792 wrote to memory of 2900 2792 JAFFAC~1.EXE 37 PID 2792 wrote to memory of 2900 2792 JAFFAC~1.EXE 37 PID 2792 wrote to memory of 2900 2792 JAFFAC~1.EXE 37 PID 2792 wrote to memory of 2900 2792 JAFFAC~1.EXE 37 PID 2900 wrote to memory of 2760 2900 svchost.com 38 PID 2900 wrote to memory of 2760 2900 svchost.com 38 PID 2900 wrote to memory of 2760 2900 svchost.com 38 PID 2900 wrote to memory of 2760 2900 svchost.com 38 PID 2760 wrote to memory of 736 2760 JAFFAC~1.EXE 39 PID 2760 wrote to memory of 736 2760 JAFFAC~1.EXE 39 PID 2760 wrote to memory of 736 2760 JAFFAC~1.EXE 39 PID 2760 wrote to memory of 736 2760 JAFFAC~1.EXE 39 PID 736 wrote to memory of 2968 736 svchost.com 117 PID 736 wrote to memory of 2968 736 svchost.com 117 PID 736 wrote to memory of 2968 736 svchost.com 117 PID 736 wrote to memory of 2968 736 svchost.com 117 PID 2968 wrote to memory of 812 2968 JAFFAC~1.EXE 41 PID 2968 wrote to memory of 812 2968 JAFFAC~1.EXE 41 PID 2968 wrote to memory of 812 2968 JAFFAC~1.EXE 41 PID 2968 wrote to memory of 812 2968 JAFFAC~1.EXE 41 PID 812 wrote to memory of 1484 812 svchost.com 74 PID 812 wrote to memory of 1484 812 svchost.com 74 PID 812 wrote to memory of 1484 812 svchost.com 74 PID 812 wrote to memory of 1484 812 svchost.com 74 PID 1484 wrote to memory of 336 1484 JAFFAC~1.EXE 43 PID 1484 wrote to memory of 336 1484 JAFFAC~1.EXE 43 PID 1484 wrote to memory of 336 1484 JAFFAC~1.EXE 43 PID 1484 wrote to memory of 336 1484 JAFFAC~1.EXE 43 PID 336 wrote to memory of 1832 336 svchost.com 170 PID 336 wrote to memory of 1832 336 svchost.com 170 PID 336 wrote to memory of 1832 336 svchost.com 170 PID 336 wrote to memory of 1832 336 svchost.com 170 PID 1832 wrote to memory of 2140 1832 JAFFAC~1.EXE 45 PID 1832 wrote to memory of 2140 1832 JAFFAC~1.EXE 45 PID 1832 wrote to memory of 2140 1832 JAFFAC~1.EXE 45 PID 1832 wrote to memory of 2140 1832 JAFFAC~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_69a1c83477d7a4d082b56821bf73a9d0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE8⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE12⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE14⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE18⤵
- Executes dropped EXE
PID:660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE20⤵
- Executes dropped EXE
PID:1976 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE22⤵
- Executes dropped EXE
PID:1672 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE24⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1048 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE26⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1460 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE28⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE30⤵
- Executes dropped EXE
PID:1828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE32⤵
- Executes dropped EXE
PID:1904 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE34⤵
- Executes dropped EXE
PID:1648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3000 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE38⤵
- Executes dropped EXE
PID:1384 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2168 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE42⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2200 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1232 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE46⤵
- Executes dropped EXE
PID:1484 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE48⤵
- Executes dropped EXE
PID:2248 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE50⤵
- Executes dropped EXE
PID:1208 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE54⤵
- Executes dropped EXE
PID:1640 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2424 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE58⤵
- Executes dropped EXE
PID:1128 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE60⤵
- Executes dropped EXE
PID:2984 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"61⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE62⤵
- Executes dropped EXE
PID:1496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"63⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE64⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:756 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE66⤵PID:3040
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"67⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE68⤵
- Drops file in Windows directory
PID:1580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"69⤵
- System Location Discovery: System Language Discovery
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE70⤵
- Drops file in Windows directory
PID:2072 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"71⤵
- Drops file in Windows directory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE72⤵PID:868
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"73⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE74⤵PID:2384
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"75⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE76⤵
- Drops file in Windows directory
PID:2700 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"77⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE78⤵PID:3000
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"79⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE80⤵PID:2164
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"81⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE82⤵PID:3028
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"83⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE84⤵
- Drops file in Windows directory
PID:2612 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"85⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE86⤵
- Drops file in Windows directory
PID:2856 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"87⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE88⤵PID:2188
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"89⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE90⤵PID:1988
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"91⤵
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE92⤵
- System Location Discovery: System Language Discovery
PID:1744 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"93⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE94⤵PID:1180
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"95⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE96⤵PID:1832
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"97⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE98⤵
- Drops file in Windows directory
PID:1436 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"99⤵
- Drops file in Windows directory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE100⤵PID:456
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"101⤵
- Drops file in Windows directory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE102⤵PID:2640
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"103⤵
- System Location Discovery: System Language Discovery
PID:376 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE104⤵PID:924
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"105⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE106⤵PID:532
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"107⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE108⤵PID:2496
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"109⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE110⤵PID:1664
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"111⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE112⤵
- System Location Discovery: System Language Discovery
PID:1016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"113⤵
- System Location Discovery: System Language Discovery
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE114⤵PID:436
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"115⤵
- System Location Discovery: System Language Discovery
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE116⤵
- Drops file in Windows directory
PID:2392 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"117⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE118⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"119⤵
- System Location Discovery: System Language Discovery
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE120⤵PID:1936
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"121⤵
- Drops file in Windows directory
PID:2116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-