Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2025, 09:50
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe
Resource
win10v2004-20250502-en
General
-
Target
JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe
-
Size
492KB
-
MD5
0486b28f85e1557d6a69822e24c10660
-
SHA1
2e22a426fb4efe8ba4f1c24e2b5c668bc584f4ff
-
SHA256
6b5a1e427536690c978c3b6a543f0b73fbcc03e3112c18a0bb01402d12bda757
-
SHA512
993cbe232b64b90f7ac30c23cd3ab922aadbfb82c63aabfb799316431015c9834e1798d2b769a20b0c1428984fadb75c931833285367f0ea086a70b41a1b23bb
-
SSDEEP
6144:pTo/0pj0lpP1B3OmwcjrHiAnZ9Kz5Iz9EQOwL7Gic6KzO7V6u7ywhkWAxEH+6G70:NKtO949Bz1ZO6Kz4V7ygX+HL523Eq
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\VEkUwsYY\\XQkYsEgA.exe," JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\VEkUwsYY\\XQkYsEgA.exe," JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
UAC bypass 3 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (56) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\Control Panel\International\Geo\Nation aCQckEcA.exe -
Executes dropped EXE 5 IoCs
pid Process 64 aCQckEcA.exe 6072 XQkYsEgA.exe 3196 OowUEMoQ.exe 3168 aCQckEcA.exe 3236 XQkYsEgA.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XQkYsEgA.exe = "C:\\ProgramData\\VEkUwsYY\\XQkYsEgA.exe" XQkYsEgA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XQkYsEgA.exe = "C:\\ProgramData\\VEkUwsYY\\XQkYsEgA.exe" XQkYsEgA.exe Set value (str) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aCQckEcA.exe = "C:\\Users\\Admin\\iiEQckAU\\aCQckEcA.exe" aCQckEcA.exe Set value (str) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aCQckEcA.exe = "C:\\Users\\Admin\\iiEQckAU\\aCQckEcA.exe" JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XQkYsEgA.exe = "C:\\ProgramData\\VEkUwsYY\\XQkYsEgA.exe" JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe Set value (str) \REGISTRY\USER\S-1-5-21-3342576763-1998465526-3870295501-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aCQckEcA.exe = "C:\\Users\\Admin\\iiEQckAU\\aCQckEcA.exe" aCQckEcA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XQkYsEgA.exe = "C:\\ProgramData\\VEkUwsYY\\XQkYsEgA.exe" OowUEMoQ.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\EcMm.exe aCQckEcA.exe File created C:\Windows\SysWOW64\ocYi.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\GyEw.ico aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\Wiwo.ico aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\KcUg.exe aCQckEcA.exe File created C:\Windows\SysWOW64\OEkK.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\sUAC.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\kIAs.ico aCQckEcA.exe File created C:\Windows\SysWOW64\yUoG.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\YcYa.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\eAwE.exe aCQckEcA.exe File created C:\Windows\SysWOW64\QMws.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\UYUw.ico aCQckEcA.exe File created C:\Windows\SysWOW64\mwUa.exe aCQckEcA.exe File created C:\Windows\SysWOW64\EoMi.exe aCQckEcA.exe File created C:\Windows\SysWOW64\GMIE.exe aCQckEcA.exe File created C:\Windows\SysWOW64\CwwE.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\sheSearchUninstall.xlsx aCQckEcA.exe File created C:\Windows\SysWOW64\YcYa.exe aCQckEcA.exe File created C:\Windows\SysWOW64\sIsS.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\gWAA.ico aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\wQwA.ico aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\EcMm.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\ocYi.exe aCQckEcA.exe File created C:\Windows\SysWOW64\soAU.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\QoMc.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\EWII.ico aCQckEcA.exe File created C:\Windows\SysWOW64\qEII.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\MIIY.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\aMsg.ico aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\CwwE.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\eIgQ.exe aCQckEcA.exe File created C:\Windows\SysWOW64\IAcW.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\KMkC.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\mYQE.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\uUoy.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\Mosm.exe aCQckEcA.exe File created C:\Windows\SysWOW64\oQwI.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\gCkE.ico aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\gYMo.ico aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\EoQc.ico aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\aEsk.ico aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\AKEs.ico aCQckEcA.exe File created C:\Windows\SysWOW64\UsUU.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\CAgy.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\mkkm.exe aCQckEcA.exe File created C:\Windows\SysWOW64\kMQC.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\Ygkc.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\MEgA.ico aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\EEYY.ico aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\yUoG.exe aCQckEcA.exe File created C:\Windows\SysWOW64\cIwK.exe aCQckEcA.exe File created C:\Windows\SysWOW64\MgYs.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\IAcW.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\Moci.exe aCQckEcA.exe File created C:\Windows\SysWOW64\QQou.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\OEks.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\MgYs.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\UuMQ.ico aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\WQUU.ico aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\KSMA.ico aCQckEcA.exe File created C:\Windows\SysWOW64\KgEG.exe aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\uWUA.ico aCQckEcA.exe File opened for modification C:\Windows\SysWOW64\qoQc.exe aCQckEcA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 5456 reg.exe 3684 reg.exe 1636 reg.exe 1268 reg.exe 4908 reg.exe 4592 reg.exe 748 reg.exe 632 reg.exe 5336 reg.exe 2712 reg.exe 212 reg.exe 3632 reg.exe 1096 reg.exe 4436 reg.exe 1076 reg.exe 960 reg.exe 1380 reg.exe 1644 reg.exe 5672 reg.exe 4824 reg.exe 5316 reg.exe 1288 reg.exe 676 reg.exe 5140 reg.exe 3576 reg.exe 632 reg.exe 6016 reg.exe 1284 reg.exe 1060 reg.exe 5900 reg.exe 3744 reg.exe 1308 reg.exe 5260 reg.exe 4832 reg.exe 5968 reg.exe 3428 reg.exe 3124 reg.exe 5012 reg.exe 4408 reg.exe 1104 reg.exe 1684 reg.exe 3260 reg.exe 528 reg.exe 4468 reg.exe 4844 reg.exe 1504 reg.exe 6000 reg.exe 5496 reg.exe 4800 reg.exe 2940 reg.exe 4700 reg.exe 4816 reg.exe 5624 reg.exe 2704 reg.exe 1664 reg.exe 3596 reg.exe 6088 reg.exe 1708 reg.exe 4740 reg.exe 3064 reg.exe 6020 reg.exe 5392 reg.exe 5088 reg.exe 5160 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 4892 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 4892 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 4892 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 4892 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5412 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5412 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5412 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5412 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 4924 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 4924 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 4924 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 4924 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2616 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2616 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2616 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2616 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2652 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2652 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2652 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2652 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5196 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5196 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5196 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5196 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2500 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2500 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2500 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2500 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 1960 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 1960 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 1960 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 1960 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 1004 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 1004 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 1004 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 1004 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 4544 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 4544 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 4544 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 4544 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5440 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5440 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5440 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5440 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5908 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5908 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5908 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5908 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5536 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5536 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5536 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 5536 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2772 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2772 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2772 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 2772 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe -
Suspicious use of FindShellTrayWindow 23 IoCs
pid Process 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe 3168 aCQckEcA.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5460 wrote to memory of 64 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 86 PID 5460 wrote to memory of 64 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 86 PID 5460 wrote to memory of 64 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 86 PID 5460 wrote to memory of 6072 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 89 PID 5460 wrote to memory of 6072 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 89 PID 5460 wrote to memory of 6072 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 89 PID 5460 wrote to memory of 1820 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 93 PID 5460 wrote to memory of 1820 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 93 PID 5460 wrote to memory of 1820 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 93 PID 4956 wrote to memory of 3168 4956 cmd.exe 95 PID 4956 wrote to memory of 3168 4956 cmd.exe 95 PID 4956 wrote to memory of 3168 4956 cmd.exe 95 PID 5828 wrote to memory of 3236 5828 cmd.exe 96 PID 5828 wrote to memory of 3236 5828 cmd.exe 96 PID 5828 wrote to memory of 3236 5828 cmd.exe 96 PID 5460 wrote to memory of 1628 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 97 PID 5460 wrote to memory of 1628 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 97 PID 5460 wrote to memory of 1628 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 97 PID 5460 wrote to memory of 3036 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 98 PID 5460 wrote to memory of 3036 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 98 PID 5460 wrote to memory of 3036 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 98 PID 5460 wrote to memory of 2404 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 99 PID 5460 wrote to memory of 2404 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 99 PID 5460 wrote to memory of 2404 5460 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 99 PID 1820 wrote to memory of 2724 1820 cmd.exe 103 PID 1820 wrote to memory of 2724 1820 cmd.exe 103 PID 1820 wrote to memory of 2724 1820 cmd.exe 103 PID 2724 wrote to memory of 4688 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 105 PID 2724 wrote to memory of 4688 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 105 PID 2724 wrote to memory of 4688 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 105 PID 2724 wrote to memory of 1848 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 107 PID 2724 wrote to memory of 1848 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 107 PID 2724 wrote to memory of 1848 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 107 PID 2724 wrote to memory of 1300 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 108 PID 2724 wrote to memory of 1300 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 108 PID 2724 wrote to memory of 1300 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 108 PID 2724 wrote to memory of 1752 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 109 PID 2724 wrote to memory of 1752 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 109 PID 2724 wrote to memory of 1752 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 109 PID 2724 wrote to memory of 1500 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 110 PID 2724 wrote to memory of 1500 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 110 PID 2724 wrote to memory of 1500 2724 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 110 PID 4688 wrote to memory of 4892 4688 cmd.exe 115 PID 4688 wrote to memory of 4892 4688 cmd.exe 115 PID 4688 wrote to memory of 4892 4688 cmd.exe 115 PID 1500 wrote to memory of 6116 1500 cmd.exe 116 PID 1500 wrote to memory of 6116 1500 cmd.exe 116 PID 1500 wrote to memory of 6116 1500 cmd.exe 116 PID 4892 wrote to memory of 1952 4892 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 117 PID 4892 wrote to memory of 1952 4892 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 117 PID 4892 wrote to memory of 1952 4892 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 117 PID 1952 wrote to memory of 5412 1952 cmd.exe 119 PID 1952 wrote to memory of 5412 1952 cmd.exe 119 PID 1952 wrote to memory of 5412 1952 cmd.exe 119 PID 4892 wrote to memory of 6064 4892 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 120 PID 4892 wrote to memory of 6064 4892 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 120 PID 4892 wrote to memory of 6064 4892 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 120 PID 4892 wrote to memory of 5944 4892 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 121 PID 4892 wrote to memory of 5944 4892 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 121 PID 4892 wrote to memory of 5944 4892 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 121 PID 4892 wrote to memory of 4408 4892 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 122 PID 4892 wrote to memory of 4408 4892 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 122 PID 4892 wrote to memory of 4408 4892 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 122 PID 4892 wrote to memory of 6048 4892 JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\iiEQckAU\aCQckEcA.exe"C:\Users\Admin\iiEQckAU\aCQckEcA.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:64
-
-
C:\ProgramData\VEkUwsYY\XQkYsEgA.exe"C:\ProgramData\VEkUwsYY\XQkYsEgA.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:6072
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c106603⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c106605⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"6⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c106607⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"8⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c106609⤵
- Suspicious behavior: EnumeratesProcesses
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"10⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066011⤵
- Suspicious behavior: EnumeratesProcesses
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"12⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066013⤵
- Suspicious behavior: EnumeratesProcesses
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"14⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066015⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"16⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066017⤵
- Suspicious behavior: EnumeratesProcesses
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"18⤵
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066019⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"20⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066021⤵
- Suspicious behavior: EnumeratesProcesses
PID:1004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"22⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066023⤵
- Suspicious behavior: EnumeratesProcesses
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"24⤵
- System Location Discovery: System Language Discovery
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066025⤵
- Suspicious behavior: EnumeratesProcesses
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"26⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066027⤵
- Suspicious behavior: EnumeratesProcesses
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"28⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066029⤵
- Suspicious behavior: EnumeratesProcesses
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"30⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066031⤵
- Suspicious behavior: EnumeratesProcesses
PID:2772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"32⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066033⤵PID:1292
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"34⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066035⤵PID:2676
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"36⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066037⤵PID:5412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"38⤵
- System Location Discovery: System Language Discovery
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066039⤵PID:2396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"40⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066041⤵
- System Location Discovery: System Language Discovery
PID:1796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"42⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066043⤵PID:4576
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"44⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066045⤵PID:1180
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"46⤵PID:5480
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵PID:1660
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066047⤵PID:2320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"48⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066049⤵
- System Location Discovery: System Language Discovery
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"50⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066051⤵PID:4404
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"52⤵
- System Location Discovery: System Language Discovery
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066053⤵PID:2888
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"54⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066055⤵PID:6092
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"56⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066057⤵PID:1096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"58⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066059⤵PID:3756
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"60⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066061⤵
- System Location Discovery: System Language Discovery
PID:5200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"62⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066063⤵PID:4436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"64⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066065⤵PID:4288
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"66⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066067⤵PID:3200
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"68⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066069⤵PID:616
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"70⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066071⤵PID:5788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"72⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066073⤵
- System Location Discovery: System Language Discovery
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"74⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066075⤵PID:1000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"76⤵PID:3036
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV177⤵PID:4396
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066077⤵PID:3548
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"78⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066079⤵
- System Location Discovery: System Language Discovery
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"80⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066081⤵PID:5584
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"82⤵PID:5460
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵PID:5908
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066083⤵PID:3712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"84⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066085⤵PID:4024
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"86⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066087⤵
- System Location Discovery: System Language Discovery
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"88⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066089⤵PID:1380
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"90⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066091⤵PID:216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"92⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066093⤵
- System Location Discovery: System Language Discovery
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"94⤵PID:3228
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵PID:2704
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066095⤵PID:5332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"96⤵
- System Location Discovery: System Language Discovery
PID:1088 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV197⤵PID:5488
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066097⤵PID:5000
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"98⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c1066099⤵PID:4524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"100⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660101⤵PID:5180
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"102⤵
- System Location Discovery: System Language Discovery
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660103⤵PID:2644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"104⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660105⤵PID:5672
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"106⤵
- System Location Discovery: System Language Discovery
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660107⤵PID:5208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"108⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660109⤵PID:4760
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"110⤵PID:5712
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵PID:2632
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660111⤵PID:4160
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"112⤵PID:2536
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵PID:6096
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660113⤵PID:5044
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"114⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660115⤵PID:1504
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"116⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660117⤵PID:5504
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"118⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660119⤵PID:2408
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"120⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660121⤵PID:860
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0486b28f85e1557d6a69822e24c10660"122⤵PID:5176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-