Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-01-2025 17:49
Behavioral task
behavioral1
Sample
JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe
-
Size
146KB
-
MD5
7b00d50371da8e55ece86488551a91b0
-
SHA1
34533e643599c537fd171cf86f3b5dfe898f6852
-
SHA256
7916a4ba22620e7e366cf68884560b13c250ca889e76b4ead88d3ce110130845
-
SHA512
9f3553db7dafd5435ae0110eb9e9be26909f92e058415a882c5d69e643e78acf04455394c34db7acc609efa578263e665a01ad8acf9cc167e821643ef46a4da7
-
SSDEEP
3072:sr85CeDi3B+x7tICbsxPoiAz+a1m3SWr85C:k9eDi3glsxPoiAbm3SW9
Score
10/10
Malware Config
Signatures
-
Detect Neshta payload 64 IoCs
resource yara_rule behavioral1/files/0x001600000001866f-2.dat family_neshta behavioral1/files/0x000700000001868b-16.dat family_neshta behavioral1/files/0x0001000000010312-19.dat family_neshta behavioral1/files/0x0001000000010314-20.dat family_neshta behavioral1/files/0x0009000000010663-18.dat family_neshta behavioral1/files/0x0029000000010667-17.dat family_neshta behavioral1/memory/2284-31-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2444-32-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2784-47-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2676-46-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2192-62-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2960-61-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2736-77-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2620-76-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3012-92-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1936-91-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1792-108-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1712-107-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1640-121-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1664-122-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1320-135-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1408-136-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1764-153-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/532-152-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2656-174-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2964-172-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/968-185-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1624-186-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1976-205-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1648-206-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2184-214-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2072-215-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2100-224-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2276-223-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1592-238-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1960-237-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/572-260-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1588-261-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2444-281-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2284-280-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2828-288-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2784-289-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2564-297-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2592-296-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2600-305-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2736-304-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1776-319-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/3052-320-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1688-329-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2472-328-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/796-336-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1660-337-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2404-344-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1708-345-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2408-353-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/868-352-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1556-361-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2032-360-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1764-368-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2316-369-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2992-376-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2088-377-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2052-384-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1516-385-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Executes dropped EXE 64 IoCs
pid Process 2016 JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe 2444 svchost.com 2284 JAFFAC~1.EXE 2784 svchost.com 2676 JAFFAC~1.EXE 2192 svchost.com 2960 JAFFAC~1.EXE 2736 svchost.com 2620 JAFFAC~1.EXE 3012 svchost.com 1936 JAFFAC~1.EXE 1792 svchost.com 1712 JAFFAC~1.EXE 1664 svchost.com 1640 JAFFAC~1.EXE 1408 svchost.com 1320 JAFFAC~1.EXE 1764 svchost.com 532 JAFFAC~1.EXE 2656 svchost.com 2964 JAFFAC~1.EXE 1624 svchost.com 968 JAFFAC~1.EXE 1976 svchost.com 1648 JAFFAC~1.EXE 2072 svchost.com 2184 JAFFAC~1.EXE 2276 svchost.com 2100 JAFFAC~1.EXE 1592 svchost.com 1960 JAFFAC~1.EXE 1588 svchost.com 572 JAFFAC~1.EXE 2444 svchost.com 2284 JAFFAC~1.EXE 2784 svchost.com 2828 JAFFAC~1.EXE 2592 svchost.com 2564 JAFFAC~1.EXE 2600 svchost.com 2736 JAFFAC~1.EXE 1776 svchost.com 3052 JAFFAC~1.EXE 1688 svchost.com 2472 JAFFAC~1.EXE 796 svchost.com 1660 JAFFAC~1.EXE 1708 svchost.com 2404 JAFFAC~1.EXE 2408 svchost.com 868 JAFFAC~1.EXE 1556 svchost.com 2032 JAFFAC~1.EXE 2316 svchost.com 1764 JAFFAC~1.EXE 2088 svchost.com 2992 JAFFAC~1.EXE 2052 svchost.com 1516 JAFFAC~1.EXE 708 svchost.com 1868 JAFFAC~1.EXE 1864 svchost.com 1532 JAFFAC~1.EXE 788 svchost.com -
Loads dropped DLL 64 IoCs
pid Process 2432 JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe 2432 JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe 2016 JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe 2444 svchost.com 2444 svchost.com 2284 JAFFAC~1.EXE 2784 svchost.com 2784 svchost.com 2676 JAFFAC~1.EXE 2192 svchost.com 2192 svchost.com 2960 JAFFAC~1.EXE 2736 svchost.com 2736 svchost.com 2620 JAFFAC~1.EXE 3012 svchost.com 3012 svchost.com 1936 JAFFAC~1.EXE 1792 svchost.com 1792 svchost.com 1712 JAFFAC~1.EXE 1664 svchost.com 1664 svchost.com 1640 JAFFAC~1.EXE 1408 svchost.com 1408 svchost.com 1320 JAFFAC~1.EXE 1764 svchost.com 1764 svchost.com 2432 JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe 532 JAFFAC~1.EXE 2016 JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe 2656 svchost.com 2656 svchost.com 2964 JAFFAC~1.EXE 1624 svchost.com 1624 svchost.com 968 JAFFAC~1.EXE 1976 svchost.com 1976 svchost.com 1648 JAFFAC~1.EXE 2072 svchost.com 2072 svchost.com 2184 JAFFAC~1.EXE 2276 svchost.com 2276 svchost.com 2100 JAFFAC~1.EXE 1592 svchost.com 1592 svchost.com 1960 JAFFAC~1.EXE 1588 svchost.com 1588 svchost.com 572 JAFFAC~1.EXE 2444 svchost.com 2444 svchost.com 2284 JAFFAC~1.EXE 2784 svchost.com 2784 svchost.com 2828 JAFFAC~1.EXE 2592 svchost.com 2592 svchost.com 2564 JAFFAC~1.EXE 2600 svchost.com 2600 svchost.com -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\directx.sys JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com JAFFAC~1.EXE File opened for modification C:\Windows\svchost.com svchost.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAFFAC~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.com -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2432 wrote to memory of 2016 2432 JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe 31 PID 2432 wrote to memory of 2016 2432 JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe 31 PID 2432 wrote to memory of 2016 2432 JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe 31 PID 2432 wrote to memory of 2016 2432 JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe 31 PID 2016 wrote to memory of 2444 2016 JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe 32 PID 2016 wrote to memory of 2444 2016 JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe 32 PID 2016 wrote to memory of 2444 2016 JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe 32 PID 2016 wrote to memory of 2444 2016 JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe 32 PID 2444 wrote to memory of 2284 2444 svchost.com 33 PID 2444 wrote to memory of 2284 2444 svchost.com 33 PID 2444 wrote to memory of 2284 2444 svchost.com 33 PID 2444 wrote to memory of 2284 2444 svchost.com 33 PID 2284 wrote to memory of 2784 2284 JAFFAC~1.EXE 34 PID 2284 wrote to memory of 2784 2284 JAFFAC~1.EXE 34 PID 2284 wrote to memory of 2784 2284 JAFFAC~1.EXE 34 PID 2284 wrote to memory of 2784 2284 JAFFAC~1.EXE 34 PID 2784 wrote to memory of 2676 2784 svchost.com 35 PID 2784 wrote to memory of 2676 2784 svchost.com 35 PID 2784 wrote to memory of 2676 2784 svchost.com 35 PID 2784 wrote to memory of 2676 2784 svchost.com 35 PID 2676 wrote to memory of 2192 2676 JAFFAC~1.EXE 36 PID 2676 wrote to memory of 2192 2676 JAFFAC~1.EXE 36 PID 2676 wrote to memory of 2192 2676 JAFFAC~1.EXE 36 PID 2676 wrote to memory of 2192 2676 JAFFAC~1.EXE 36 PID 2192 wrote to memory of 2960 2192 svchost.com 37 PID 2192 wrote to memory of 2960 2192 svchost.com 37 PID 2192 wrote to memory of 2960 2192 svchost.com 37 PID 2192 wrote to memory of 2960 2192 svchost.com 37 PID 2960 wrote to memory of 2736 2960 JAFFAC~1.EXE 71 PID 2960 wrote to memory of 2736 2960 JAFFAC~1.EXE 71 PID 2960 wrote to memory of 2736 2960 JAFFAC~1.EXE 71 PID 2960 wrote to memory of 2736 2960 JAFFAC~1.EXE 71 PID 2736 wrote to memory of 2620 2736 svchost.com 39 PID 2736 wrote to memory of 2620 2736 svchost.com 39 PID 2736 wrote to memory of 2620 2736 svchost.com 39 PID 2736 wrote to memory of 2620 2736 svchost.com 39 PID 2620 wrote to memory of 3012 2620 JAFFAC~1.EXE 40 PID 2620 wrote to memory of 3012 2620 JAFFAC~1.EXE 40 PID 2620 wrote to memory of 3012 2620 JAFFAC~1.EXE 40 PID 2620 wrote to memory of 3012 2620 JAFFAC~1.EXE 40 PID 3012 wrote to memory of 1936 3012 svchost.com 41 PID 3012 wrote to memory of 1936 3012 svchost.com 41 PID 3012 wrote to memory of 1936 3012 svchost.com 41 PID 3012 wrote to memory of 1936 3012 svchost.com 41 PID 1936 wrote to memory of 1792 1936 JAFFAC~1.EXE 42 PID 1936 wrote to memory of 1792 1936 JAFFAC~1.EXE 42 PID 1936 wrote to memory of 1792 1936 JAFFAC~1.EXE 42 PID 1936 wrote to memory of 1792 1936 JAFFAC~1.EXE 42 PID 1792 wrote to memory of 1712 1792 svchost.com 43 PID 1792 wrote to memory of 1712 1792 svchost.com 43 PID 1792 wrote to memory of 1712 1792 svchost.com 43 PID 1792 wrote to memory of 1712 1792 svchost.com 43 PID 1712 wrote to memory of 1664 1712 JAFFAC~1.EXE 44 PID 1712 wrote to memory of 1664 1712 JAFFAC~1.EXE 44 PID 1712 wrote to memory of 1664 1712 JAFFAC~1.EXE 44 PID 1712 wrote to memory of 1664 1712 JAFFAC~1.EXE 44 PID 1664 wrote to memory of 1640 1664 svchost.com 45 PID 1664 wrote to memory of 1640 1664 svchost.com 45 PID 1664 wrote to memory of 1640 1664 svchost.com 45 PID 1664 wrote to memory of 1640 1664 svchost.com 45 PID 1640 wrote to memory of 1408 1640 JAFFAC~1.EXE 46 PID 1640 wrote to memory of 1408 1640 JAFFAC~1.EXE 46 PID 1640 wrote to memory of 1408 1640 JAFFAC~1.EXE 46 PID 1640 wrote to memory of 1408 1640 JAFFAC~1.EXE 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_7b00d50371da8e55ece86488551a91b0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:968 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"37⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2736 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"43⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE44⤵
- Executes dropped EXE
PID:3052 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"45⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE46⤵
- Executes dropped EXE
PID:2472 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"47⤵
- Executes dropped EXE
PID:796 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE48⤵
- Executes dropped EXE
PID:1660 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"49⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2404 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE52⤵
- Executes dropped EXE
PID:868 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"53⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE54⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"55⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE56⤵
- Executes dropped EXE
PID:1764 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"57⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE58⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2992 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"59⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE60⤵
- Executes dropped EXE
PID:1516 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"61⤵
- Executes dropped EXE
PID:708 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1868 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"63⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE64⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1532 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"65⤵
- Executes dropped EXE
PID:788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE66⤵PID:2076
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"67⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE68⤵PID:1928
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"69⤵
- System Location Discovery: System Language Discovery
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE70⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2152 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"71⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE72⤵PID:2252
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"73⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE74⤵PID:1592
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"75⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE76⤵PID:1256
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"77⤵
- Drops file in Windows directory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE78⤵PID:1580
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"79⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE80⤵PID:2772
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"81⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE82⤵PID:2780
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"83⤵
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE84⤵PID:2828
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"85⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE86⤵PID:2488
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"87⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE88⤵PID:2624
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"89⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE90⤵
- Drops file in Windows directory
PID:1700 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"91⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE92⤵PID:1704
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"93⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE94⤵PID:1716
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"95⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE96⤵
- System Location Discovery: System Language Discovery
PID:2496 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"97⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE98⤵PID:772
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"99⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE100⤵PID:2012
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"101⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE102⤵
- Drops file in Windows directory
PID:2248 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"103⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE104⤵
- Drops file in Windows directory
PID:2856 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"105⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE106⤵PID:2868
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"107⤵
- System Location Discovery: System Language Discovery
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE108⤵PID:836
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"109⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE110⤵
- Drops file in Windows directory
PID:1032 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"111⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE112⤵
- System Location Discovery: System Language Discovery
PID:1760 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"113⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE114⤵PID:2076
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"115⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE116⤵PID:1812
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"117⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE118⤵PID:1916
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"119⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE120⤵PID:2368
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE"121⤵PID:1616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-