Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-01-2025 15:45
Behavioral task
behavioral1
Sample
JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe
-
Size
482KB
-
MD5
6db4afd761d2c05d5abeb5d79e3b6f8c
-
SHA1
fc283e78522d258c08c3c484fc0514d03e65b807
-
SHA256
67410b40bf8f724013d08783ce17b67bfc86be707d222b6b7202baf1abc38281
-
SHA512
ed40f8e1e92305224e0fa79cf32fd412da696a49e08d7fa287865017e4a2b4ccf80e77c3ea600d09809d90656cf5abbda262adb928e71b94017f1d27248d46b4
-
SSDEEP
6144:k91brtZc/zrcbVa8MxBjkzIl+GTgn6n1FK9b9b9:encvcBafxMV
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x000700000001878c-2.dat family_neshta behavioral1/files/0x0008000000018bf3-15.dat family_neshta behavioral1/files/0x0001000000010312-18.dat family_neshta behavioral1/files/0x0001000000010314-19.dat family_neshta behavioral1/files/0x0009000000010663-17.dat family_neshta behavioral1/files/0x0029000000010667-16.dat family_neshta behavioral1/memory/2056-30-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2496-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2092-44-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2800-43-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2688-58-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2652-57-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2560-73-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2704-72-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2528-86-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3020-85-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3040-100-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2324-99-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/860-114-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1964-113-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f775-129.dat family_neshta behavioral1/files/0x000100000000f7c9-132.dat family_neshta behavioral1/files/0x000100000000f7e5-136.dat family_neshta behavioral1/memory/2336-143-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2316-142-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/files/0x000100000000f82c-145.dat family_neshta behavioral1/memory/1580-166-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2744-165-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2636-180-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2740-181-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1728-197-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1152-198-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1408-209-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1180-208-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2096-223-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1020-224-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2460-250-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/900-249-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1532-265-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1856-264-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1984-272-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/604-273-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2752-286-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2816-285-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2688-300-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2220-301-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2648-308-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2700-309-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2580-317-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2552-316-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2456-325-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3016-324-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1624-332-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/400-333-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1324-340-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3040-341-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1936-349-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1040-348-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1732-356-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1892-357-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1620-365-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1736-364-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2872-372-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2716-373-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2420 JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe 2496 svchost.com 2056 JAFFAC~1.EXE 2092 svchost.com 2800 JAFFAC~1.EXE 2688 svchost.com 2652 JAFFAC~1.EXE 2560 svchost.com 2704 JAFFAC~1.EXE 2528 svchost.com 3020 JAFFAC~1.EXE 3040 svchost.com 2324 JAFFAC~1.EXE 860 svchost.com 1964 JAFFAC~1.EXE 2336 svchost.com 2316 JAFFAC~1.EXE 1580 svchost.com 2744 JAFFAC~1.EXE 2740 svchost.com 2636 JAFFAC~1.EXE 1152 svchost.com 1728 JAFFAC~1.EXE 1180 svchost.com 1408 JAFFAC~1.EXE 1020 svchost.com 2096 JAFFAC~1.EXE 2460 svchost.com 900 JAFFAC~1.EXE 1532 svchost.com 1856 JAFFAC~1.EXE 1984 svchost.com 604 JAFFAC~1.EXE 2752 svchost.com 2816 JAFFAC~1.EXE 2220 svchost.com 2688 JAFFAC~1.EXE 2700 svchost.com 2648 JAFFAC~1.EXE 2580 svchost.com 2552 JAFFAC~1.EXE 2456 svchost.com 3016 JAFFAC~1.EXE 1624 svchost.com 400 JAFFAC~1.EXE 3040 svchost.com 1324 JAFFAC~1.EXE 1936 svchost.com 1040 JAFFAC~1.EXE 1892 svchost.com 1732 JAFFAC~1.EXE 1736 svchost.com 1620 JAFFAC~1.EXE 2716 svchost.com 2872 JAFFAC~1.EXE 2736 svchost.com 1580 JAFFAC~1.EXE 1012 svchost.com 624 JAFFAC~1.EXE 1264 svchost.com 568 JAFFAC~1.EXE 3028 svchost.com 1556 JAFFAC~1.EXE 996 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 3060 JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe 3060 JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe 2496 svchost.com 2496 svchost.com 2092 svchost.com 2092 svchost.com 2688 svchost.com 2688 svchost.com 2560 svchost.com 2560 svchost.com 2528 svchost.com 2528 svchost.com 3040 svchost.com 3040 svchost.com 860 svchost.com 860 svchost.com 2336 svchost.com 2336 svchost.com 2420 JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe 3060 JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe 3060 JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe 1580 svchost.com 3060 JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe 1580 svchost.com 2740 svchost.com 2740 svchost.com 1152 svchost.com 1152 svchost.com 1180 svchost.com 1180 svchost.com 1020 svchost.com 1020 svchost.com 2460 svchost.com 2460 svchost.com 1532 svchost.com 1532 svchost.com 1984 svchost.com 1984 svchost.com 2752 svchost.com 2752 svchost.com 3060 JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe 2220 svchost.com 2220 svchost.com 2700 svchost.com 2700 svchost.com 2580 svchost.com 2580 svchost.com 2456 svchost.com 2456 svchost.com 1624 svchost.com 1624 svchost.com 3040 svchost.com 3040 svchost.com 1936 svchost.com 1936 svchost.com 1892 svchost.com 1892 svchost.com 1736 svchost.com 1736 svchost.com 2716 svchost.com 2716 svchost.com 2736 svchost.com 2736 svchost.com 1012 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1716 JAFFAC~1.EXE 1716 JAFFAC~1.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2420 3060 JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe 30 PID 3060 wrote to memory of 2420 3060 JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe 30 PID 3060 wrote to memory of 2420 3060 JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe 30 PID 3060 wrote to memory of 2420 3060 JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe 30 PID 2420 wrote to memory of 2496 2420 JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe 31 PID 2420 wrote to memory of 2496 2420 JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe 31 PID 2420 wrote to memory of 2496 2420 JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe 31 PID 2420 wrote to memory of 2496 2420 JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe 31 PID 2496 wrote to memory of 2056 2496 svchost.com 32 PID 2496 wrote to memory of 2056 2496 svchost.com 32 PID 2496 wrote to memory of 2056 2496 svchost.com 32 PID 2496 wrote to memory of 2056 2496 svchost.com 32 PID 2056 wrote to memory of 2092 2056 JAFFAC~1.EXE 33 PID 2056 wrote to memory of 2092 2056 JAFFAC~1.EXE 33 PID 2056 wrote to memory of 2092 2056 JAFFAC~1.EXE 33 PID 2056 wrote to memory of 2092 2056 JAFFAC~1.EXE 33 PID 2092 wrote to memory of 2800 2092 svchost.com 34 PID 2092 wrote to memory of 2800 2092 svchost.com 34 PID 2092 wrote to memory of 2800 2092 svchost.com 34 PID 2092 wrote to memory of 2800 2092 svchost.com 34 PID 2800 wrote to memory of 2688 2800 JAFFAC~1.EXE 66 PID 2800 wrote to memory of 2688 2800 JAFFAC~1.EXE 66 PID 2800 wrote to memory of 2688 2800 JAFFAC~1.EXE 66 PID 2800 wrote to memory of 2688 2800 JAFFAC~1.EXE 66 PID 2688 wrote to memory of 2652 2688 svchost.com 36 PID 2688 wrote to memory of 2652 2688 svchost.com 36 PID 2688 wrote to memory of 2652 2688 svchost.com 36 PID 2688 wrote to memory of 2652 2688 svchost.com 36 PID 2652 wrote to memory of 2560 2652 JAFFAC~1.EXE 37 PID 2652 wrote to memory of 2560 2652 JAFFAC~1.EXE 37 PID 2652 wrote to memory of 2560 2652 JAFFAC~1.EXE 37 PID 2652 wrote to memory of 2560 2652 JAFFAC~1.EXE 37 PID 2560 wrote to memory of 2704 2560 svchost.com 38 PID 2560 wrote to memory of 2704 2560 svchost.com 38 PID 2560 wrote to memory of 2704 2560 svchost.com 38 PID 2560 wrote to memory of 2704 2560 svchost.com 38 PID 2704 wrote to memory of 2528 2704 JAFFAC~1.EXE 39 PID 2704 wrote to memory of 2528 2704 JAFFAC~1.EXE 39 PID 2704 wrote to memory of 2528 2704 JAFFAC~1.EXE 39 PID 2704 wrote to memory of 2528 2704 JAFFAC~1.EXE 39 PID 2528 wrote to memory of 3020 2528 svchost.com 40 PID 2528 wrote to memory of 3020 2528 svchost.com 40 PID 2528 wrote to memory of 3020 2528 svchost.com 40 PID 2528 wrote to memory of 3020 2528 svchost.com 40 PID 3020 wrote to memory of 3040 3020 JAFFAC~1.EXE 75 PID 3020 wrote to memory of 3040 3020 JAFFAC~1.EXE 75 PID 3020 wrote to memory of 3040 3020 JAFFAC~1.EXE 75 PID 3020 wrote to memory of 3040 3020 JAFFAC~1.EXE 75 PID 3040 wrote to memory of 2324 3040 svchost.com 42 PID 3040 wrote to memory of 2324 3040 svchost.com 42 PID 3040 wrote to memory of 2324 3040 svchost.com 42 PID 3040 wrote to memory of 2324 3040 svchost.com 42 PID 2324 wrote to memory of 860 2324 JAFFAC~1.EXE 43 PID 2324 wrote to memory of 860 2324 JAFFAC~1.EXE 43 PID 2324 wrote to memory of 860 2324 JAFFAC~1.EXE 43 PID 2324 wrote to memory of 860 2324 JAFFAC~1.EXE 43 PID 860 wrote to memory of 1964 860 svchost.com 44 PID 860 wrote to memory of 1964 860 svchost.com 44 PID 860 wrote to memory of 1964 860 svchost.com 44 PID 860 wrote to memory of 1964 860 svchost.com 44 PID 1964 wrote to memory of 2336 1964 JAFFAC~1.EXE 45 PID 1964 wrote to memory of 2336 1964 JAFFAC~1.EXE 45 PID 1964 wrote to memory of 2336 1964 JAFFAC~1.EXE 45 PID 1964 wrote to memory of 2336 1964 JAFFAC~1.EXE 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_6db4afd761d2c05d5abeb5d79e3b6f8c.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE14⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE18⤵
- Executes dropped EXE
PID:2316 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE20⤵
- Executes dropped EXE
PID:2744 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2636 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE24⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1728 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE26⤵
- Executes dropped EXE
PID:1408 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE28⤵
- Executes dropped EXE
PID:2096 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:900 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE32⤵
- Executes dropped EXE
PID:1856 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE34⤵
- Executes dropped EXE
PID:604 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE36⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2816 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE38⤵
- Executes dropped EXE
PID:2688 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE40⤵
- Executes dropped EXE
PID:2648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE42⤵
- Executes dropped EXE
PID:2552 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE44⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"45⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE46⤵
- Executes dropped EXE
PID:400 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE48⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1324 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1040 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"51⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE52⤵
- Executes dropped EXE
PID:1732 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE54⤵
- Executes dropped EXE
PID:1620 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"55⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE56⤵
- Executes dropped EXE
PID:2872 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE58⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1580 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE60⤵
- Executes dropped EXE
PID:624 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"61⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE62⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:568 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"63⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE64⤵
- Executes dropped EXE
PID:1556 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"65⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE66⤵
- System Location Discovery: System Language Discovery
PID:664 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"67⤵
- Drops file in Windows directory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE68⤵PID:1804
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"69⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE70⤵PID:2464
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"71⤵
- Drops file in Windows directory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE72⤵PID:1432
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"73⤵
- Drops file in Windows directory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE74⤵PID:3056
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"75⤵
- Drops file in Windows directory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE76⤵PID:1972
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"77⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE78⤵
- System Location Discovery: System Language Discovery
PID:2920 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"79⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE80⤵PID:1860
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"81⤵
- Drops file in Windows directory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE82⤵
- Drops file in Windows directory
PID:2660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"83⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE84⤵
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"85⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE86⤵PID:2708
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"87⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE88⤵
- System Location Discovery: System Language Discovery
PID:2608 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"89⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE90⤵
- System Location Discovery: System Language Discovery
PID:2544 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"91⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE92⤵PID:2504
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"93⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE94⤵PID:2004
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"95⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE96⤵PID:1324
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"97⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE98⤵PID:2344
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"99⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE100⤵PID:1704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"101⤵
- Drops file in Windows directory
PID:344 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE102⤵PID:1620
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"103⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE104⤵PID:1724
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"105⤵
- System Location Discovery: System Language Discovery
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE106⤵PID:1468
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"107⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE108⤵PID:2636
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"109⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE110⤵
- Drops file in Windows directory
PID:1304 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"111⤵
- Drops file in Windows directory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE112⤵PID:1728
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"113⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE114⤵
- Drops file in Windows directory
PID:332 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"115⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE116⤵PID:2876
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"117⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE118⤵PID:1432
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"119⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE120⤵PID:3056
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"121⤵PID:892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-