Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 23:13

General

  • Target

    92efebc3959ec91a110f70bec4cac72a_JaffaCakes118.exe

  • Size

    4.5MB

  • MD5

    92efebc3959ec91a110f70bec4cac72a

  • SHA1

    391b3c695954d5d2d6d6a2142f13c87a7500b677

  • SHA256

    89f8884ff40d96b785faa15880857e33f1344f798bae5f883c5d5226dbbbe584

  • SHA512

    e435962731abfead2baf86adacb660b1362d98011cf8cd45b2e63b88e5b1588b8c6ebcce95fa68a8d618d91ceeebbba1b911139b2f81ad6c670d04537977ca93

  • SSDEEP

    49152:bJerQZbd29erQZbd29erQZbd29erQZbd29erQZbd29erQZbd2i:srQZbrQZbrQZbrQZbrQZbrQZB

Malware Config

Signatures

  • Disables service(s) 3 TTPs
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Blocks application from running via registry modification 17 IoCs

    Adds application to list of disallowed applications.

  • Sets file execution options in registry 2 TTPs 20 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 30 IoCs
  • Drops file in Windows directory 9 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Runs net.exe
  • Runs regedit.exe 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\92efebc3959ec91a110f70bec4cac72a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\92efebc3959ec91a110f70bec4cac72a_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\system32\Option.bat
      2⤵
        PID:2476
      • C:\Windows\SysWOW64\net.exe
        net.exe start schedule /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2528
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 start schedule /y
          3⤵
            PID:2608
        • C:\Windows\SysWOW64\At.exe
          At.exe 11:16:22 PM C:\Windows\Help\HelpCat.exe
          2⤵
            PID:2844
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c at 11:15:24 PM C:\Windows\Sysinf.bat
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2672
            • C:\Windows\SysWOW64\at.exe
              at 11:15:24 PM C:\Windows\Sysinf.bat
              3⤵
                PID:2980
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c at 11:18:24 PM C:\Windows\Sysinf.bat
              2⤵
                PID:2660
                • C:\Windows\SysWOW64\at.exe
                  at 11:18:24 PM C:\Windows\Sysinf.bat
                  3⤵
                    PID:2276
                • C:\Windows\SysWOW64\net.exe
                  net.exe stop wscsvc /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2628
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop wscsvc /y
                    3⤵
                      PID:2320
                  • C:\Windows\SysWOW64\net.exe
                    net.exe stop sharedaccess /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2408
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop sharedaccess /y
                      3⤵
                        PID:1772
                    • C:\Windows\SysWOW64\net.exe
                      net.exe stop wuauserv /y
                      2⤵
                        PID:2164
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop wuauserv /y
                          3⤵
                            PID:2568
                        • C:\Windows\SysWOW64\net.exe
                          net.exe stop srservice /y
                          2⤵
                            PID:2556
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop srservice /y
                              3⤵
                                PID:908
                            • C:\Windows\SysWOW64\net.exe
                              net.exe stop 360timeprot /y
                              2⤵
                                PID:2400
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 stop 360timeprot /y
                                  3⤵
                                    PID:1584
                                • C:\Windows\SysWOW64\sc.exe
                                  C:\Windows\system32\sc.exe config srservice start= disabled
                                  2⤵
                                  • Launches sc.exe
                                  PID:2796
                                • C:\Windows\SysWOW64\sc.exe
                                  C:\Windows\system32\sc.exe config SharedAccess start= disabled
                                  2⤵
                                  • Launches sc.exe
                                  PID:876
                                • C:\Windows\SysWOW64\sc.exe
                                  C:\Windows\system32\sc.exe config wscsvc start= disabled
                                  2⤵
                                  • Launches sc.exe
                                  PID:1768
                                • C:\Windows\SysWOW64\sc.exe
                                  C:\Windows\system32\sc.exe config srservice start= disabled
                                  2⤵
                                  • Launches sc.exe
                                  PID:1656
                                • C:\Windows\SysWOW64\regedit.exe
                                  regedit.exe /s C:\Windows\regedt32.sys
                                  2⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Blocks application from running via registry modification
                                  • Sets file execution options in registry
                                  • Runs regedit.exe
                                  PID:1628
                                • C:\Windows\SysWOW64\reg.exe
                                  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
                                  2⤵
                                    PID:2284
                                  • C:\Windows\SysWOW64\reg.exe
                                    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
                                    2⤵
                                      PID:808
                                    • C:\Windows\system\KavUpda.exe
                                      C:\Windows\system\KavUpda.exe
                                      2⤵
                                      • Executes dropped EXE
                                      • Drops autorun.inf file
                                      • Drops file in System32 directory
                                      • Drops file in Windows directory
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1840
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c C:\Windows\system32\Option.bat
                                        3⤵
                                          PID:2176
                                        • C:\Windows\SysWOW64\net.exe
                                          net.exe start schedule /y
                                          3⤵
                                            PID:1464
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 start schedule /y
                                              4⤵
                                                PID:1508
                                            • C:\Windows\SysWOW64\At.exe
                                              At.exe 11:16:25 PM C:\Windows\Help\HelpCat.exe
                                              3⤵
                                                PID:1444
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd /c at 11:15:27 PM C:\Windows\Sysinf.bat
                                                3⤵
                                                  PID:1484
                                                  • C:\Windows\SysWOW64\at.exe
                                                    at 11:15:27 PM C:\Windows\Sysinf.bat
                                                    4⤵
                                                      PID:1040
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd /c at 11:18:27 PM C:\Windows\Sysinf.bat
                                                    3⤵
                                                      PID:1236
                                                      • C:\Windows\SysWOW64\at.exe
                                                        at 11:18:27 PM C:\Windows\Sysinf.bat
                                                        4⤵
                                                          PID:1404
                                                      • C:\Windows\SysWOW64\net.exe
                                                        net.exe stop wscsvc /y
                                                        3⤵
                                                          PID:2112
                                                          • C:\Windows\SysWOW64\net1.exe
                                                            C:\Windows\system32\net1 stop wscsvc /y
                                                            4⤵
                                                              PID:296
                                                          • C:\Windows\SysWOW64\net.exe
                                                            net.exe stop sharedaccess /y
                                                            3⤵
                                                              PID:1956
                                                              • C:\Windows\SysWOW64\net1.exe
                                                                C:\Windows\system32\net1 stop sharedaccess /y
                                                                4⤵
                                                                  PID:576
                                                              • C:\Windows\SysWOW64\net.exe
                                                                net.exe stop wuauserv /y
                                                                3⤵
                                                                  PID:540
                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                    C:\Windows\system32\net1 stop wuauserv /y
                                                                    4⤵
                                                                      PID:1252
                                                                  • C:\Windows\SysWOW64\net.exe
                                                                    net.exe stop srservice /y
                                                                    3⤵
                                                                      PID:2732
                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                        C:\Windows\system32\net1 stop srservice /y
                                                                        4⤵
                                                                          PID:2764
                                                                      • C:\Windows\SysWOW64\net.exe
                                                                        net.exe stop 360timeprot /y
                                                                        3⤵
                                                                          PID:1804
                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                            C:\Windows\system32\net1 stop 360timeprot /y
                                                                            4⤵
                                                                              PID:2348
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            C:\Windows\system32\sc.exe config srservice start= disabled
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:700
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            C:\Windows\system32\sc.exe config SharedAccess start= disabled
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:836
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            C:\Windows\system32\sc.exe config wscsvc start= disabled
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:2896
                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                            C:\Windows\system32\sc.exe config srservice start= disabled
                                                                            3⤵
                                                                            • Launches sc.exe
                                                                            PID:2012
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
                                                                            3⤵
                                                                              PID:1676
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
                                                                              3⤵
                                                                                PID:1672
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                3⤵
                                                                                  PID:2084
                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                    attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                    4⤵
                                                                                    • Views/modifies file attributes
                                                                                    PID:1964
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  cmd /c rmdir F:\Autorun.inf /s /q
                                                                                  3⤵
                                                                                    PID:2992
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                    3⤵
                                                                                      PID:2524
                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                        attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                        4⤵
                                                                                        • Views/modifies file attributes
                                                                                        PID:2432
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      cmd /c rmdir C:\Autorun.inf /s /q
                                                                                      3⤵
                                                                                        PID:2580
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                        3⤵
                                                                                          PID:2784
                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                            attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                            4⤵
                                                                                            • Views/modifies file attributes
                                                                                            PID:1656
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          cmd /c rmdir F:\Autorun.inf /s /q
                                                                                          3⤵
                                                                                            PID:2296
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                            3⤵
                                                                                              PID:808
                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                4⤵
                                                                                                • Views/modifies file attributes
                                                                                                PID:768
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              cmd /c rmdir C:\Autorun.inf /s /q
                                                                                              3⤵
                                                                                                PID:1592
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                3⤵
                                                                                                  PID:2660
                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                    attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                    4⤵
                                                                                                    • Views/modifies file attributes
                                                                                                    PID:1552
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  cmd /c rmdir F:\Autorun.inf /s /q
                                                                                                  3⤵
                                                                                                    PID:2548
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                    3⤵
                                                                                                      PID:3028
                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                        attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                        4⤵
                                                                                                        • Views/modifies file attributes
                                                                                                        PID:772
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd /c rmdir C:\Autorun.inf /s /q
                                                                                                      3⤵
                                                                                                        PID:1084
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                        3⤵
                                                                                                          PID:652
                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                            attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                            4⤵
                                                                                                            • Views/modifies file attributes
                                                                                                            PID:540
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          cmd /c rmdir F:\Autorun.inf /s /q
                                                                                                          3⤵
                                                                                                            PID:588
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                            3⤵
                                                                                                              PID:1824
                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                                4⤵
                                                                                                                • Views/modifies file attributes
                                                                                                                PID:1684
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              cmd /c rmdir C:\Autorun.inf /s /q
                                                                                                              3⤵
                                                                                                                PID:336
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                                3⤵
                                                                                                                  PID:836
                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                    attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                                    4⤵
                                                                                                                    • Views/modifies file attributes
                                                                                                                    PID:2848
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  cmd /c rmdir F:\Autorun.inf /s /q
                                                                                                                  3⤵
                                                                                                                    PID:2960
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                                    3⤵
                                                                                                                      PID:3008
                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                        attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                                        4⤵
                                                                                                                        • Views/modifies file attributes
                                                                                                                        PID:1496
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      cmd /c rmdir C:\Autorun.inf /s /q
                                                                                                                      3⤵
                                                                                                                        PID:2984
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                                        3⤵
                                                                                                                          PID:2340
                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                            attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                                            4⤵
                                                                                                                            • Views/modifies file attributes
                                                                                                                            PID:2604
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /c rmdir F:\Autorun.inf /s /q
                                                                                                                          3⤵
                                                                                                                            PID:1428
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                                            3⤵
                                                                                                                              PID:2492
                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                                                4⤵
                                                                                                                                • Views/modifies file attributes
                                                                                                                                PID:2320
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /c rmdir C:\Autorun.inf /s /q
                                                                                                                              3⤵
                                                                                                                                PID:2612
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                                                3⤵
                                                                                                                                  PID:908
                                                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                    attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                                                    4⤵
                                                                                                                                    • Views/modifies file attributes
                                                                                                                                    PID:764
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  cmd /c rmdir F:\Autorun.inf /s /q
                                                                                                                                  3⤵
                                                                                                                                    PID:2192
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                                                    3⤵
                                                                                                                                      PID:768
                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                        attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                                                        4⤵
                                                                                                                                        • Views/modifies file attributes
                                                                                                                                        PID:1352
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      cmd /c rmdir C:\Autorun.inf /s /q
                                                                                                                                      3⤵
                                                                                                                                        PID:1648
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                                                        3⤵
                                                                                                                                          PID:688
                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                            attrib -s -h -r F:\Autorun.inf\*.* /s /d
                                                                                                                                            4⤵
                                                                                                                                            • Views/modifies file attributes
                                                                                                                                            PID:1948
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          cmd /c rmdir F:\Autorun.inf /s /q
                                                                                                                                          3⤵
                                                                                                                                            PID:628
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                                                            3⤵
                                                                                                                                              PID:2424
                                                                                                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                attrib -s -h -r C:\Autorun.inf\*.* /s /d
                                                                                                                                                4⤵
                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                PID:780
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              cmd /c rmdir C:\Autorun.inf /s /q
                                                                                                                                              3⤵
                                                                                                                                                PID:1464
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\92efebc3959ec91a110f70bec4cac72a_JaffaCakes118~4.exe
                                                                                                                                              92efebc3959ec91a110f70bec4cac72a_JaffaCakes118~4.exe
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2480
                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                              net.exe stop wscsvc /y
                                                                                                                                              2⤵
                                                                                                                                                PID:1700
                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                  C:\Windows\system32\net1 stop wscsvc /y
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2468
                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                  net.exe stop sharedaccess /y
                                                                                                                                                  2⤵
                                                                                                                                                    PID:332
                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                      C:\Windows\system32\net1 stop sharedaccess /y
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2004
                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                      net.exe stop wuauserv /y
                                                                                                                                                      2⤵
                                                                                                                                                        PID:924
                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                          C:\Windows\system32\net1 stop wuauserv /y
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2868
                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                          net.exe stop srservice /y
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1456
                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                              C:\Windows\system32\net1 stop srservice /y
                                                                                                                                                              3⤵
                                                                                                                                                                PID:1496
                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                              net.exe stop 360timeprot /y
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3052
                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                  C:\Windows\system32\net1 stop 360timeprot /y
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1524

                                                                                                                                                              Network

                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                              Replay Monitor

                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                              Downloads

                                                                                                                                                              • C:\Windows\SysWOW64\Option.bat

                                                                                                                                                                Filesize

                                                                                                                                                                82B

                                                                                                                                                                MD5

                                                                                                                                                                3f7fbd2eb34892646e93fd5e6e343512

                                                                                                                                                                SHA1

                                                                                                                                                                265ac1061b54f62350fb7a5f57e566454d013a66

                                                                                                                                                                SHA256

                                                                                                                                                                e75e8d9bfc7a2876d908305186c3656e9de2a4af7f6927ccc6d8c812645abbc7

                                                                                                                                                                SHA512

                                                                                                                                                                53d40eb2f05a23464fbf06193868e7cb30cf0df3da53586a75123fb2c37b29cdddda287ce134809d16a559d87fb20aee0e8add22d396fcb7a55f9a753739b140

                                                                                                                                                              • C:\Windows\Sysinf.bat

                                                                                                                                                                Filesize

                                                                                                                                                                460B

                                                                                                                                                                MD5

                                                                                                                                                                7db3d565d6ddbe65a8b0e093910e7dcd

                                                                                                                                                                SHA1

                                                                                                                                                                d4804e6180c6e74ba79d3343f2f2ccb15e502f12

                                                                                                                                                                SHA256

                                                                                                                                                                a2778cb87fd88c7508ffd506a8ff8d58d0ffc02156f846956e5e99c6cb3d2f3f

                                                                                                                                                                SHA512

                                                                                                                                                                0b3d1d0f44feba9dd78903ff77fdeaea834d930990a86641fb2e4ce04da280d33f6bee0ae0b1320e4070cbe20824062e45b52e5cad797c5985d8e31dce1ef82b

                                                                                                                                                              • C:\Windows\regedt32.sys

                                                                                                                                                                Filesize

                                                                                                                                                                2KB

                                                                                                                                                                MD5

                                                                                                                                                                e7d7ec66bd61fac3843c98650b0c68f6

                                                                                                                                                                SHA1

                                                                                                                                                                a15ae06e1be51038863650746368a71024539bac

                                                                                                                                                                SHA256

                                                                                                                                                                6475d5ecc14fea090774be55723d2d52b7ec7670527a7dbd61edf28c77944cb8

                                                                                                                                                                SHA512

                                                                                                                                                                ac9e9893f5a0af03957731445f63279085f164e9a968d706a99d13012e4459314a7ccc32dc48f62379d69e21a0953c13543c9ded38b5ad5fbc346aa442af1ae6

                                                                                                                                                              • C:\Windows\system\KavUpda.exe

                                                                                                                                                                Filesize

                                                                                                                                                                4.5MB

                                                                                                                                                                MD5

                                                                                                                                                                6c60f0e7a8f5461efe9b327b2e890d50

                                                                                                                                                                SHA1

                                                                                                                                                                f2837e342430d188e482ba2bf12d803d571b5a30

                                                                                                                                                                SHA256

                                                                                                                                                                2be36f2dc8cdd1a3deaa70597132111378c228e987928e3fd612c8eb8f22c5fd

                                                                                                                                                                SHA512

                                                                                                                                                                b85c696e7e46661f123712488ba4e58105b67bb791657c46b5845b4ffd64dcb6eb114042ebf40eabb46e3548cf84cab862dd35da57875ae8b9e864feb6e79cd4

                                                                                                                                                              • F:\Autorun.inf

                                                                                                                                                                Filesize

                                                                                                                                                                237B

                                                                                                                                                                MD5

                                                                                                                                                                94bcd02c5afd5918b4446345e7a5ded9

                                                                                                                                                                SHA1

                                                                                                                                                                79839238e84be225132e1382fae6333dfc4906a1

                                                                                                                                                                SHA256

                                                                                                                                                                5d9f41e4f886926dae2ed8a57807708110d3c6964ab462be21462bff0088d9a1

                                                                                                                                                                SHA512

                                                                                                                                                                149f6bd49fc3b62fa5f41666bfb3a58060514eec1b61c6aa1ac4c75417c840b028e701eb5533460eb00e2fee8543379564bc47d7477264771d81b99a0caab500

                                                                                                                                                              • \??\PIPE\atsvc

                                                                                                                                                                MD5

                                                                                                                                                                d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                SHA1

                                                                                                                                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                SHA256

                                                                                                                                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                SHA512

                                                                                                                                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\92efebc3959ec91a110f70bec4cac72a_JaffaCakes118~4.exe

                                                                                                                                                                Filesize

                                                                                                                                                                38KB

                                                                                                                                                                MD5

                                                                                                                                                                75bb0b1cd7f505db8d50642814e392ca

                                                                                                                                                                SHA1

                                                                                                                                                                ff89f1b3ff721f5f49db2385e5b3e73520e9653c

                                                                                                                                                                SHA256

                                                                                                                                                                c2fc526636655d10f4bb3d5e0fe09c6dfcaae53e007fb7c2941ef48a41a4a9cd

                                                                                                                                                                SHA512

                                                                                                                                                                f351241edb58fff3668bc3a4baf0523a8b23b080f671f935f7165333ba29358383583217aa8c04547d7ac1435b5ce99cd35613a8ff1bee07096524d7b76b8469

                                                                                                                                                              • memory/1992-0-0x0000000000400000-0x0000000000436000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                216KB