Analysis
-
max time kernel
148s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2025, 10:10
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe
Resource
win10v2004-20250502-en
General
-
Target
JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe
-
Size
489KB
-
MD5
06a77e396c6b61b851e152328bb34960
-
SHA1
b677c770c4b2b954d8cb646c4cd8ee1f582b72cf
-
SHA256
40c503b54870d9e9036be1ddf841b7583fc0c0f35c3cd6855b29ccda113427b3
-
SHA512
7632ccfc81c7530a8391c40a9d598a9b044a1a733dc737b9b367c9c15973a447c32b500465e6044ebfbbb7bb756f3f63818c4684efd0be68beddbccfe7a61b19
-
SSDEEP
12288:mM8oCHlhlaN9GKIKIe+WjzyYzdcyt4fDx28Ixwek+:P8NFSGoR+Wny0r4fDbIxb
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\ieYIgAok\\aGgkwwEk.exe," JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\ieYIgAok\\aGgkwwEk.exe," JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" reg.exe -
UAC bypass 3 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Renames multiple (56) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\Control Panel\International\Geo\Nation aGgkwwEk.exe -
Executes dropped EXE 5 IoCs
pid Process 4976 eYIAYAUk.exe 688 aGgkwwEk.exe 5028 uOwYwYwg.exe 3948 eYIAYAUk.exe 1408 aGgkwwEk.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eYIAYAUk.exe = "C:\\Users\\Admin\\uoYcscMQ\\eYIAYAUk.exe" eYIAYAUk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aGgkwwEk.exe = "C:\\ProgramData\\ieYIgAok\\aGgkwwEk.exe" aGgkwwEk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eYIAYAUk.exe = "C:\\Users\\Admin\\uoYcscMQ\\eYIAYAUk.exe" JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aGgkwwEk.exe = "C:\\ProgramData\\ieYIgAok\\aGgkwwEk.exe" JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aGgkwwEk.exe = "C:\\ProgramData\\ieYIgAok\\aGgkwwEk.exe" aGgkwwEk.exe Set value (str) \REGISTRY\USER\S-1-5-21-3690492401-2005096563-3427069815-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eYIAYAUk.exe = "C:\\Users\\Admin\\uoYcscMQ\\eYIAYAUk.exe" eYIAYAUk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aGgkwwEk.exe = "C:\\ProgramData\\ieYIgAok\\aGgkwwEk.exe" uOwYwYwg.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\sheWatchSkip.png aGgkwwEk.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\uoYcscMQ\eYIAYAUk uOwYwYwg.exe File created C:\Windows\SysWOW64\shell32.dll.exe aGgkwwEk.exe File opened for modification C:\Windows\SysWOW64\sheRestoreConvertTo.docx aGgkwwEk.exe File opened for modification C:\Windows\SysWOW64\sheUpdateImport.docx aGgkwwEk.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\uoYcscMQ uOwYwYwg.exe File opened for modification C:\Windows\SysWOW64\sheLimitConvertTo.jpeg aGgkwwEk.exe File opened for modification C:\Windows\SysWOW64\shePushEnable.xlsx aGgkwwEk.exe File opened for modification C:\Windows\SysWOW64\sheUninstallRead.wma aGgkwwEk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 64 IoCs
pid Process 3152 reg.exe 2376 reg.exe 3152 reg.exe 3952 reg.exe 3488 reg.exe 3260 reg.exe 5104 reg.exe 4168 reg.exe 3080 reg.exe 2844 reg.exe 4824 reg.exe 3264 reg.exe 4472 reg.exe 1832 reg.exe 2252 reg.exe 4828 reg.exe 5024 reg.exe 3228 reg.exe 644 reg.exe 3676 reg.exe 4464 reg.exe 1992 reg.exe 1828 reg.exe 4500 reg.exe 4276 reg.exe 2752 reg.exe 4620 reg.exe 1312 reg.exe 1708 reg.exe 724 reg.exe 4832 reg.exe 2736 reg.exe 2892 reg.exe 1436 reg.exe 2560 reg.exe 3464 reg.exe 4108 reg.exe 3152 reg.exe 964 reg.exe 4440 reg.exe 224 reg.exe 1820 reg.exe 1064 reg.exe 4960 reg.exe 724 reg.exe 4188 reg.exe 1236 reg.exe 4868 reg.exe 3264 reg.exe 1388 reg.exe 4496 reg.exe 1208 reg.exe 2360 reg.exe 4336 reg.exe 2712 reg.exe 4804 reg.exe 3500 reg.exe 2888 reg.exe 2076 reg.exe 1928 reg.exe 4308 reg.exe 4648 reg.exe 2916 reg.exe 564 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 4080 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 4080 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 4080 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 4080 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 5044 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 5044 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 5044 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 5044 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 1992 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 1992 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 1992 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 1992 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 2120 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 2120 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 2120 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 2120 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 1288 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 1288 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 1288 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 1288 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 3488 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 3488 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 3488 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 3488 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 3480 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 3480 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 3480 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 3480 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 1056 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 1056 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 1056 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 1056 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 624 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 624 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 624 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 624 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 3264 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 3264 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 3264 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 3264 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 1456 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 1456 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 1456 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 1456 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 2724 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 2724 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 2724 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 2724 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 2736 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 2736 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 2736 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 2736 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe -
Suspicious use of FindShellTrayWindow 24 IoCs
pid Process 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe 688 aGgkwwEk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 760 wrote to memory of 4976 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 86 PID 760 wrote to memory of 4976 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 86 PID 760 wrote to memory of 4976 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 86 PID 760 wrote to memory of 688 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 89 PID 760 wrote to memory of 688 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 89 PID 760 wrote to memory of 688 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 89 PID 4576 wrote to memory of 3948 4576 cmd.exe 93 PID 4576 wrote to memory of 3948 4576 cmd.exe 93 PID 4576 wrote to memory of 3948 4576 cmd.exe 93 PID 2272 wrote to memory of 1408 2272 cmd.exe 94 PID 2272 wrote to memory of 1408 2272 cmd.exe 94 PID 2272 wrote to memory of 1408 2272 cmd.exe 94 PID 760 wrote to memory of 1948 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 96 PID 760 wrote to memory of 1948 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 96 PID 760 wrote to memory of 1948 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 96 PID 1948 wrote to memory of 448 1948 cmd.exe 98 PID 1948 wrote to memory of 448 1948 cmd.exe 98 PID 1948 wrote to memory of 448 1948 cmd.exe 98 PID 760 wrote to memory of 4200 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 99 PID 760 wrote to memory of 4200 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 99 PID 760 wrote to memory of 4200 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 99 PID 760 wrote to memory of 1708 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 100 PID 760 wrote to memory of 1708 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 100 PID 760 wrote to memory of 1708 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 100 PID 760 wrote to memory of 1992 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 101 PID 760 wrote to memory of 1992 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 101 PID 760 wrote to memory of 1992 760 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 101 PID 448 wrote to memory of 2868 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 106 PID 448 wrote to memory of 2868 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 106 PID 448 wrote to memory of 2868 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 106 PID 448 wrote to memory of 3172 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 108 PID 448 wrote to memory of 3172 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 108 PID 448 wrote to memory of 3172 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 108 PID 448 wrote to memory of 1828 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 109 PID 448 wrote to memory of 1828 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 109 PID 448 wrote to memory of 1828 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 109 PID 448 wrote to memory of 3304 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 110 PID 448 wrote to memory of 3304 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 110 PID 448 wrote to memory of 3304 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 110 PID 448 wrote to memory of 2956 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 111 PID 448 wrote to memory of 2956 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 111 PID 448 wrote to memory of 2956 448 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 111 PID 2868 wrote to memory of 60 2868 cmd.exe 116 PID 2868 wrote to memory of 60 2868 cmd.exe 116 PID 2868 wrote to memory of 60 2868 cmd.exe 116 PID 2956 wrote to memory of 1344 2956 cmd.exe 117 PID 2956 wrote to memory of 1344 2956 cmd.exe 117 PID 2956 wrote to memory of 1344 2956 cmd.exe 117 PID 60 wrote to memory of 1780 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 118 PID 60 wrote to memory of 1780 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 118 PID 60 wrote to memory of 1780 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 118 PID 60 wrote to memory of 3240 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 120 PID 60 wrote to memory of 3240 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 120 PID 60 wrote to memory of 3240 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 120 PID 60 wrote to memory of 4372 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 121 PID 60 wrote to memory of 4372 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 121 PID 60 wrote to memory of 4372 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 121 PID 60 wrote to memory of 4016 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 122 PID 60 wrote to memory of 4016 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 122 PID 60 wrote to memory of 4016 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 122 PID 60 wrote to memory of 3336 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 123 PID 60 wrote to memory of 3336 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 123 PID 60 wrote to memory of 3336 60 JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe 123 PID 3336 wrote to memory of 4316 3336 cmd.exe 128
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\uoYcscMQ\eYIAYAUk.exe"C:\Users\Admin\uoYcscMQ\eYIAYAUk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4976
-
-
C:\ProgramData\ieYIgAok\aGgkwwEk.exe"C:\ProgramData\ieYIgAok\aGgkwwEk.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
PID:688
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"2⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb349603⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"4⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb349605⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"6⤵
- System Location Discovery: System Language Discovery
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb349607⤵
- Suspicious behavior: EnumeratesProcesses
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"8⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb349609⤵
- Suspicious behavior: EnumeratesProcesses
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"10⤵
- System Location Discovery: System Language Discovery
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496011⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"12⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496013⤵
- Suspicious behavior: EnumeratesProcesses
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"14⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496015⤵
- Suspicious behavior: EnumeratesProcesses
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"16⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496017⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"18⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496019⤵
- Suspicious behavior: EnumeratesProcesses
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"20⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496021⤵
- Suspicious behavior: EnumeratesProcesses
PID:1056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"22⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496023⤵
- Suspicious behavior: EnumeratesProcesses
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"24⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496025⤵
- Suspicious behavior: EnumeratesProcesses
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"26⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496027⤵
- Suspicious behavior: EnumeratesProcesses
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"28⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496029⤵
- Suspicious behavior: EnumeratesProcesses
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"30⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496031⤵
- Suspicious behavior: EnumeratesProcesses
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"32⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496033⤵PID:4524
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"34⤵PID:3024
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV135⤵PID:1992
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496035⤵PID:2108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"36⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496037⤵PID:1564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"38⤵
- System Location Discovery: System Language Discovery
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496039⤵PID:4172
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"40⤵
- System Location Discovery: System Language Discovery
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496041⤵PID:3696
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"42⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496043⤵
- System Location Discovery: System Language Discovery
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"44⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496045⤵PID:3576
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"46⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496047⤵PID:3040
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"48⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496049⤵PID:4564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"50⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496051⤵
- System Location Discovery: System Language Discovery
PID:2216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"52⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496053⤵PID:900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"54⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496055⤵PID:4732
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"56⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496057⤵PID:1836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"58⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496059⤵PID:4384
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"60⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496061⤵PID:640
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"62⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496063⤵PID:2252
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"64⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496065⤵PID:868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"66⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496067⤵PID:448
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"68⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496069⤵PID:4328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"70⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496071⤵PID:4008
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"72⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496073⤵PID:1608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"74⤵PID:1836
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵PID:1616
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496075⤵PID:1760
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"76⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496077⤵PID:4108
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"78⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496079⤵
- System Location Discovery: System Language Discovery
PID:1064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"80⤵PID:1760
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV181⤵PID:4664
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496081⤵PID:1836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"82⤵PID:4828
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV183⤵PID:2360
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496083⤵PID:3260
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"84⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496085⤵PID:2376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"86⤵PID:1816
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵PID:3676
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496087⤵PID:4328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"88⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496089⤵
- System Location Discovery: System Language Discovery
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"90⤵PID:1708
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵PID:5084
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496091⤵PID:2844
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"92⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496093⤵PID:1820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"94⤵PID:3172
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV195⤵PID:3224
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496095⤵PID:3416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"96⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496097⤵PID:1816
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"98⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb3496099⤵PID:4320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"100⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960101⤵PID:1644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"102⤵
- System Location Discovery: System Language Discovery
PID:2020 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1103⤵PID:4328
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960103⤵PID:3240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"104⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960105⤵PID:4304
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"106⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960107⤵PID:1064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"108⤵PID:3076
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵PID:4008
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960109⤵PID:2480
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"110⤵PID:1468
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1111⤵PID:4880
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960111⤵PID:4564
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"112⤵PID:1996
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵PID:1508
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960113⤵PID:4360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"114⤵
- System Location Discovery: System Language Discovery
PID:1136 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1115⤵PID:556
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960115⤵PID:1472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"116⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960117⤵PID:1208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"118⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960119⤵PID:1820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"120⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960121⤵PID:4080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_06a77e396c6b61b851e152328bb34960"122⤵PID:492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-