Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
04/04/2024, 09:21
General
- Target b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe
- Size 248KB
- Sample240404-lbm4babc5z
- SHA256 699a36e72cbb6f0824aa9629a59b737fb93f7ea7eb411ef8e8396a01100417d1
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 32 IoCs
- UAC bypass 3 TTPs 32 IoCs
- Renames multiple (77) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 4 IoCs
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry key 1 TTPs 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\ZwQIAwAQ\MSUUkMQk.exe"C:\Users\Admin\ZwQIAwAQ\MSUUkMQk.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\ProgramData\MMMUQkkg\OSYwAsME.exe"C:\ProgramData\MMMUQkkg\OSYwAsME.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes1183⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes1185⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes1187⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"8⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes1189⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"10⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11811⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"12⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11813⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"14⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11815⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"16⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11817⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"18⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11819⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"20⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11821⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"22⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11823⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"24⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11825⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"26⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11827⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"28⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11829⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"30⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11831⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"32⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11833⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"34⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11835⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"36⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11837⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"38⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11839⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"40⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11841⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"42⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11843⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"44⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11845⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"46⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11847⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"48⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11849⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"50⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11851⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"52⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11853⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"54⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11855⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"56⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11857⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"58⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11859⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"60⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11861⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"62⤵
-
C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes11863⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118"64⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 164⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 264⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f64⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QekAsIUs.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""64⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs65⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 162⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 262⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f62⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cUIAEcUw.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""62⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs63⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 160⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 260⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f60⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uSQskkEM.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""60⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs61⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 158⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 258⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f58⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xsMUwkMo.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""58⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs59⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 156⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 256⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f56⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pSskIkwQ.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""56⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs57⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 154⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 254⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f54⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bwAkMYUY.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""54⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs55⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 152⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 252⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f52⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xiQQogYY.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""52⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs53⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 150⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 250⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f50⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AOsIIYMs.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""50⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs51⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 148⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 248⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f48⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IGYUEkQM.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""48⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs49⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 146⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 246⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f46⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aUEcIwsY.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""46⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs47⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 144⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 244⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f44⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gOEMgAUA.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""44⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs45⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 142⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 242⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f42⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nYcoIEAc.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""42⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs43⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 140⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 240⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f40⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LeUgowwI.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""40⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs41⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 138⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 238⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f38⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lMMAYogw.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""38⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs39⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 136⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 236⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f36⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oWYcwUQA.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""36⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs37⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 134⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 234⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f34⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KmkIEUQU.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""34⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs35⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 132⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 232⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f32⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iigkEkws.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""32⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs33⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 130⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 230⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f30⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aWosUoIQ.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""30⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs31⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 128⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 228⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f28⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\heMcAIYE.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""28⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs29⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 126⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 226⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f26⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dckckMMw.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""26⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs27⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 124⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 224⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f24⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rwUwYksk.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""24⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs25⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 122⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 222⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f22⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hSoooYQw.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""22⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs23⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 120⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 220⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f20⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QYQUYQMY.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""20⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs21⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 118⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 218⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f18⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AYQQYQwc.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""18⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs19⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 116⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 216⤵
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f16⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kkwUIMgA.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""16⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs17⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 114⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 214⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f14⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eqUkokgQ.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""14⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs15⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 112⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 212⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f12⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HuAAYwAc.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""12⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs13⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 110⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 210⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f10⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BCsUwYUQ.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""10⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs11⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 18⤵
- Modifies visibility of file extensions in Explorer
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 28⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f8⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DagUAkYw.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""8⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs9⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 16⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 26⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f6⤵
- UAC bypass
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QIoMcEEo.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""6⤵
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs7⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 14⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 24⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f4⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CeMUUsIo.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs5⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies visibility of file extensions in Explorer
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- UAC bypass
- Modifies registry key
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pkksQkYw.bat" "C:\Users\Admin\AppData\Local\Temp\b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118.exe""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp/file.vbs3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
OSYwAsME.exe
background.png.exe
device.png.exe
device.png.exe
overlay.png.exe
superbar.png.exe
background.png.exe
background.png.exe
watermark.png.exe
guest.bmp.exe
user-192.png.exe
user.bmp.exe
user.png.exe
windowsdesktop-runtime-8.0.0-win-x64.exe
vcredist_x86.exe
VC_redist.x86.exe
VC_redist.x64.exe
vcredist_x86.exe
vcredist_x64.exe
windowsdesktop-runtime-6.0.25-win-x64.exe
128.png.exe
flapper.gif.exe
icon_128.png.exe
192.png.exe
256.png.exe
32.png.exe
64.png.exe
96.png.exe
128.png.exe
192.png.exe
256.png.exe
48.png.exe
96.png.exe
128.png.exe
256.png.exe
96.png.exe
192.png.exe
256.png.exe
32.png.exe
48.png.exe
64.png.exe
128.png.exe
256.png.exe
128.png.exe
AppErrorBlue.png.exe
AppErrorWhite.png.exe
AppWhite.png.exe
ElevatedAppBlue.png.exe
ElevatedAppWhite.png.exe
Error.png.exe
KFMHeroToast.png.exe
KFMLockedFileToast.png.exe
KFMScanExclusionToast.png.exe
OneDriveLogo.png.exe
QuotaCritical.png.exe
QuotaNearing.png.exe
ScreenshotOptIn.gif.exe
Warning.png.exe
OneDriveMedTile.contrast-black_scale-400.png.exe
OneDriveMedTile.contrast-white_scale-400.png.exe
OneDriveSmallTile.contrast-black_scale-400.png.exe
OneDriveSmallTile.contrast-white_scale-400.png.exe
OneDriveSmallTile.scale-400.png.exe
squaretile.png.exe
tinytile.png.exe
squaretile.png.exe
tinytile.png.exe
squaretile.png.exe
AgUQ.exe
AoQE.exe
EQgc.exe
EUok.exe
GEgy.exe
GgQm.exe
GkcM.exe
Gkgw.exe
GokK.exe
Icgq.exe
KgIi.ico
Ksow.exe
MMEM.exe
MUko.exe
MgQE.exe
OAQm.ico
QIgo.exe
QMsO.exe
QkMQ.exe
YkUM.exe
b4a63ee044f72a1e9752ee0ec7af787f_JaffaCakes118
csAw.exe
eQwO.ico
eUAe.exe
file.vbs
ggMk.exe
iMQi.exe
mYUM.exe
oAMG.exe
ooMS.exe
pkksQkYw.bat
qEMu.exe
qYoG.exe
sEYo.exe
uUcI.exe
ugAe.exe
ukEm.exe
DismountMount.pdf.exe
ProtectStop.mp3.exe
RestoreWatch.bmp.exe
RestoreMerge.doc.exe
UndoClose.doc.exe
DisconnectConvertFrom.png.exe
MSUUkMQk.exe
MSUUkMQk.inf
memory/748-15-0x0000000000400000-0x0000000000434000-memory.dmp
memory/748-2092-0x0000000000400000-0x0000000000434000-memory.dmp
memory/812-0-0x0000000000400000-0x000000000043F000-memory.dmp
memory/812-19-0x0000000000400000-0x000000000043F000-memory.dmp
memory/880-201-0x0000000000400000-0x000000000043F000-memory.dmp
memory/880-216-0x0000000000400000-0x000000000043F000-memory.dmp
memory/956-349-0x0000000000400000-0x000000000043F000-memory.dmp
memory/956-336-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1268-143-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1268-126-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1424-244-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1424-224-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1476-78-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1476-92-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1504-44-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1572-20-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1572-33-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1604-205-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1604-190-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1792-57-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1808-155-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1844-151-0x0000000000400000-0x000000000043F000-memory.dmp
memory/1844-167-0x0000000000400000-0x000000000043F000-memory.dmp
memory/2384-274-0x0000000000400000-0x000000000043F000-memory.dmp
memory/2384-265-0x0000000000400000-0x000000000043F000-memory.dmp
memory/2676-351-0x0000000000400000-0x000000000043F000-memory.dmp
memory/2676-359-0x0000000000400000-0x000000000043F000-memory.dmp
memory/2996-163-0x0000000000400000-0x000000000043F000-memory.dmp
memory/2996-179-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3016-295-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3016-304-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3120-12-0x0000000000400000-0x0000000000433000-memory.dmp
memory/3120-2082-0x0000000000400000-0x0000000000433000-memory.dmp
memory/3252-228-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3716-282-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3716-294-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3744-68-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3828-69-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3828-81-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3940-314-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3940-256-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3940-300-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3940-266-0x0000000000400000-0x000000000043F000-memory.dmp
memory/3960-130-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4268-193-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4268-176-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4508-286-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4508-275-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4508-330-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4524-339-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4724-240-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4724-255-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4732-322-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4744-118-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4744-103-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4856-367-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4856-358-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4952-93-0x0000000000400000-0x000000000043F000-memory.dmp
memory/4952-107-0x0000000000400000-0x000000000043F000-memory.dmp