Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/01/2025, 07:33
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe
-
Size
205KB
-
MD5
9339503bfbb68f6435a37e36057c137b
-
SHA1
fb8714dea5b2cb8884b079b2a32e4246630efa40
-
SHA256
ed27064284abd999686d18a64681781876fbb716587f2e8ce70f862565dc4599
-
SHA512
1d85151ad89ab85e20682ee7940f20d1ef6f63cc2dd53f744ddcaa603750e822722926b03834dc0bec24834b992bfd379122ff80b1f89826acbca719f7104aa5
-
SSDEEP
6144:0V5X9iNrRFBVxk7M2+4D3Iyv1ChpFR0FVvrp9N:08rZVxk7J+1MgwVrx
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (53) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\International\Geo\Nation decAAIck.exe -
Executes dropped EXE 2 IoCs
pid Process 1732 decAAIck.exe 2520 hiUYAsQk.exe -
Loads dropped DLL 20 IoCs
pid Process 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\decAAIck.exe = "C:\\Users\\Admin\\qkUckksw\\decAAIck.exe" JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\hiUYAsQk.exe = "C:\\ProgramData\\niEwgwAQ\\hiUYAsQk.exe" JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\decAAIck.exe = "C:\\Users\\Admin\\qkUckksw\\decAAIck.exe" decAAIck.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\hiUYAsQk.exe = "C:\\ProgramData\\niEwgwAQ\\hiUYAsQk.exe" hiUYAsQk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\LCYUgQgM.exe = "C:\\Users\\Admin\\vUIosYgU\\LCYUgQgM.exe" JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\rCwoQUsI.exe = "C:\\ProgramData\\jSUEcgEk\\rCwoQUsI.exe" JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico decAAIck.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 1828 1924 WerFault.exe 957 2904 2968 WerFault.exe 959 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 2008 reg.exe 3024 reg.exe 2728 reg.exe 2916 reg.exe 2720 reg.exe 1812 reg.exe 1564 reg.exe 2784 reg.exe 732 reg.exe 1060 reg.exe 1808 reg.exe 1976 reg.exe 2724 reg.exe 1716 reg.exe 1816 reg.exe 1488 reg.exe 2420 reg.exe 2968 reg.exe 2872 reg.exe 648 reg.exe 324 reg.exe 880 reg.exe 520 reg.exe 2856 reg.exe 1360 reg.exe 2200 reg.exe 1976 reg.exe 1080 reg.exe 272 reg.exe 2116 reg.exe 2556 reg.exe 2496 reg.exe 1796 reg.exe 1920 reg.exe 1340 reg.exe 2724 reg.exe 2496 reg.exe 1504 reg.exe 2400 reg.exe 1740 reg.exe 2980 reg.exe 3008 reg.exe 536 reg.exe 1920 reg.exe 2644 reg.exe 2620 reg.exe 2620 reg.exe 1716 reg.exe 1552 reg.exe 2400 reg.exe 2720 reg.exe 2876 reg.exe 2880 reg.exe 2968 reg.exe 2584 reg.exe 2036 reg.exe 2100 reg.exe 328 reg.exe 2664 reg.exe 1308 reg.exe 540 reg.exe 1416 reg.exe 2368 reg.exe 1324 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2436 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2436 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1776 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1776 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1500 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1500 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1684 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1684 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2820 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2820 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 844 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 844 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2904 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2904 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1044 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1044 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1780 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1780 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2720 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2720 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1788 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1788 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2500 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2500 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2580 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2580 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1536 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1536 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1488 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1488 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2196 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2196 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2604 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2604 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1676 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1676 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1664 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1664 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2216 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2216 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2452 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2452 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1920 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1920 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2884 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2884 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1508 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1508 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1796 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1796 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1248 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1248 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1288 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 1288 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 3012 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 3012 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2604 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 2604 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1732 decAAIck.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe 1732 decAAIck.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1260 wrote to memory of 1732 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 30 PID 1260 wrote to memory of 1732 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 30 PID 1260 wrote to memory of 1732 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 30 PID 1260 wrote to memory of 1732 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 30 PID 1260 wrote to memory of 2520 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 31 PID 1260 wrote to memory of 2520 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 31 PID 1260 wrote to memory of 2520 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 31 PID 1260 wrote to memory of 2520 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 31 PID 1260 wrote to memory of 2704 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 32 PID 1260 wrote to memory of 2704 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 32 PID 1260 wrote to memory of 2704 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 32 PID 1260 wrote to memory of 2704 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 32 PID 1260 wrote to memory of 2816 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 34 PID 1260 wrote to memory of 2816 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 34 PID 1260 wrote to memory of 2816 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 34 PID 1260 wrote to memory of 2816 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 34 PID 1260 wrote to memory of 2832 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 35 PID 1260 wrote to memory of 2832 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 35 PID 1260 wrote to memory of 2832 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 35 PID 1260 wrote to memory of 2832 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 35 PID 1260 wrote to memory of 2836 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 36 PID 1260 wrote to memory of 2836 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 36 PID 1260 wrote to memory of 2836 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 36 PID 1260 wrote to memory of 2836 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 36 PID 2704 wrote to memory of 2848 2704 cmd.exe 37 PID 2704 wrote to memory of 2848 2704 cmd.exe 37 PID 2704 wrote to memory of 2848 2704 cmd.exe 37 PID 2704 wrote to memory of 2848 2704 cmd.exe 37 PID 1260 wrote to memory of 2876 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 40 PID 1260 wrote to memory of 2876 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 40 PID 1260 wrote to memory of 2876 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 40 PID 1260 wrote to memory of 2876 1260 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 40 PID 2876 wrote to memory of 2636 2876 cmd.exe 43 PID 2876 wrote to memory of 2636 2876 cmd.exe 43 PID 2876 wrote to memory of 2636 2876 cmd.exe 43 PID 2876 wrote to memory of 2636 2876 cmd.exe 43 PID 2848 wrote to memory of 2300 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 44 PID 2848 wrote to memory of 2300 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 44 PID 2848 wrote to memory of 2300 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 44 PID 2848 wrote to memory of 2300 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 44 PID 2300 wrote to memory of 2436 2300 cmd.exe 46 PID 2300 wrote to memory of 2436 2300 cmd.exe 46 PID 2300 wrote to memory of 2436 2300 cmd.exe 46 PID 2300 wrote to memory of 2436 2300 cmd.exe 46 PID 2848 wrote to memory of 1652 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 47 PID 2848 wrote to memory of 1652 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 47 PID 2848 wrote to memory of 1652 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 47 PID 2848 wrote to memory of 1652 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 47 PID 2848 wrote to memory of 1308 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 48 PID 2848 wrote to memory of 1308 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 48 PID 2848 wrote to memory of 1308 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 48 PID 2848 wrote to memory of 1308 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 48 PID 2848 wrote to memory of 1096 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 49 PID 2848 wrote to memory of 1096 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 49 PID 2848 wrote to memory of 1096 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 49 PID 2848 wrote to memory of 1096 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 49 PID 2848 wrote to memory of 2888 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 51 PID 2848 wrote to memory of 2888 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 51 PID 2848 wrote to memory of 2888 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 51 PID 2848 wrote to memory of 2888 2848 JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe 51 PID 2888 wrote to memory of 1472 2888 cmd.exe 55 PID 2888 wrote to memory of 1472 2888 cmd.exe 55 PID 2888 wrote to memory of 1472 2888 cmd.exe 55 PID 2888 wrote to memory of 1472 2888 cmd.exe 55
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\qkUckksw\decAAIck.exe"C:\Users\Admin\qkUckksw\decAAIck.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1732
-
-
C:\ProgramData\niEwgwAQ\hiUYAsQk.exe"C:\ProgramData\niEwgwAQ\hiUYAsQk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2520
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"2⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"4⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2436 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"6⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1776 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"8⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b9⤵
- Suspicious behavior: EnumeratesProcesses
PID:1500 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"10⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b11⤵
- Suspicious behavior: EnumeratesProcesses
PID:1684 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"12⤵
- System Location Discovery: System Language Discovery
PID:352 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b13⤵
- Suspicious behavior: EnumeratesProcesses
PID:1848 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"14⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b15⤵
- Suspicious behavior: EnumeratesProcesses
PID:2820 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"16⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b17⤵
- Suspicious behavior: EnumeratesProcesses
PID:844 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"18⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b19⤵
- Suspicious behavior: EnumeratesProcesses
PID:2904 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"20⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b21⤵
- Suspicious behavior: EnumeratesProcesses
PID:1044 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"22⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1780 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"24⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b25⤵
- Suspicious behavior: EnumeratesProcesses
PID:2720 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"26⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b27⤵
- Suspicious behavior: EnumeratesProcesses
PID:1788 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"28⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b29⤵
- Suspicious behavior: EnumeratesProcesses
PID:2500 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"30⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2580 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"32⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"34⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b35⤵
- Suspicious behavior: EnumeratesProcesses
PID:1488 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"36⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b37⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2196 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"38⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b39⤵
- Suspicious behavior: EnumeratesProcesses
PID:2604 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"40⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b41⤵
- Suspicious behavior: EnumeratesProcesses
PID:1676 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"42⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b43⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"44⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b45⤵
- Suspicious behavior: EnumeratesProcesses
PID:2216 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"46⤵
- System Location Discovery: System Language Discovery
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b47⤵
- Suspicious behavior: EnumeratesProcesses
PID:2452 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"48⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b49⤵
- Suspicious behavior: EnumeratesProcesses
PID:1920 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"50⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b51⤵
- Suspicious behavior: EnumeratesProcesses
PID:2884 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"52⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b53⤵
- Suspicious behavior: EnumeratesProcesses
PID:1508 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"54⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b55⤵
- Suspicious behavior: EnumeratesProcesses
PID:1796 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"56⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b57⤵
- Suspicious behavior: EnumeratesProcesses
PID:1248 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"58⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b59⤵
- Suspicious behavior: EnumeratesProcesses
PID:1288 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"60⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b61⤵
- Suspicious behavior: EnumeratesProcesses
PID:3012 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"62⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b63⤵
- Suspicious behavior: EnumeratesProcesses
PID:2604 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"64⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b65⤵PID:2372
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"66⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b67⤵PID:1096
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"68⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b69⤵PID:2852
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"70⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b71⤵PID:2536
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"72⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b73⤵PID:1688
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"74⤵
- System Location Discovery: System Language Discovery
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b75⤵PID:1792
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"76⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b77⤵
- System Location Discovery: System Language Discovery
PID:1872 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"78⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b79⤵PID:1684
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"80⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b81⤵PID:1768
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"82⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b83⤵PID:3020
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"84⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b85⤵PID:2496
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"86⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b87⤵PID:2976
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"88⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b89⤵PID:1616
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"90⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b91⤵PID:1564
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"92⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b93⤵PID:1820
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"94⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b95⤵PID:1716
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"96⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b97⤵PID:1996
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"98⤵
- System Location Discovery: System Language Discovery
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b99⤵PID:2952
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"100⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b101⤵PID:1136
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"102⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b103⤵PID:1096
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"104⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b105⤵
- System Location Discovery: System Language Discovery
PID:376 -
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"106⤵
- System Location Discovery: System Language Discovery
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b107⤵PID:3012
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"108⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b109⤵PID:324
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"110⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b111⤵PID:648
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"112⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b113⤵PID:2820
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"114⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b115⤵PID:680
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"116⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b117⤵PID:732
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"118⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b119⤵PID:684
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"120⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b121⤵PID:1416
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9339503bfbb68f6435a37e36057c137b"122⤵PID:2764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-