Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 07:46
Static task
static1
Behavioral task
behavioral1
Sample
90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe
-
Size
608KB
-
MD5
90ff1ce257c698c8c715aee56c0b18ab
-
SHA1
b54eb34c4feb7af0cb91d9c3f035ca51610aa0d0
-
SHA256
64fc2662d49022906629fc5fce5990e04d2cd12fe2f98eff320ee6551367fe26
-
SHA512
71d7ecd3ec4d8628818e85520dff960002d9764133c76c4e504de6dcb8c6681a54d184416e6be156d6d788c9a2bccfffa9fc56e3990f71686fc1716de8e5d9d0
-
SSDEEP
6144:UZfec9EbXDk6RkCBEKWnmy+g46nmy+g4SuHOGB/nmy+g46nmy+g4E/lGE2E4:UZWtI6RkCBoVmOGB/V5/lt4
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
regedit.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" regedit.exe -
Blocks application from running via registry modification 17 IoCs
Adds application to list of disallowed applications.
Processes:
regedit.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "RavStub.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "KPFW32.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KAV32.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "RfwMain.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rfwsrv.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "KPFW32X.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "KAVStart.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "RavMoD.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "CCenter.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "RavMon.exe" regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" regedit.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "rfwcfg.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "RavService.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "Rav.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "KAVPFW.EXE" regedit.exe -
Sets file execution options in registry 2 TTPs 20 IoCs
Processes:
regedit.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe -
Executes dropped EXE 2 IoCs
Processes:
KavUpda.exe90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118~4.exepid process 1868 KavUpda.exe 1364 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118~4.exe -
Loads dropped DLL 4 IoCs
Processes:
90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exepid process 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
KavUpda.exedescription ioc process File opened for modification F:\Autorun.inf KavUpda.exe File opened for modification C:\Autorun.inf KavUpda.exe -
Drops file in System32 directory 2 IoCs
Processes:
90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exeKavUpda.exedescription ioc process File created C:\Windows\SysWOW64\Option.bat 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Option.bat KavUpda.exe -
Drops file in Windows directory 9 IoCs
Processes:
KavUpda.exe90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\system\KavUpda.exe KavUpda.exe File opened for modification C:\Windows\regedt32.sys KavUpda.exe File created C:\Windows\Help\HelpCat.exe 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe File opened for modification C:\Windows\Help\HelpCat.exe 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe File created C:\Windows\Sysinf.bat 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe File created C:\Windows\regedt32.sys 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe File opened for modification C:\Windows\Sysinf.bat KavUpda.exe File created C:\Windows\regedt32.sys KavUpda.exe File opened for modification C:\Windows\system\KavUpda.exe 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe -
Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 2896 sc.exe 2764 sc.exe 2636 sc.exe 2788 sc.exe 2812 sc.exe 2240 sc.exe 3012 sc.exe 632 sc.exe -
Runs net.exe
-
Runs regedit.exe 1 IoCs
Processes:
regedit.exepid process 1216 regedit.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
KavUpda.exedescription pid process Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe Token: 33 1868 KavUpda.exe Token: SeIncBasePriorityPrivilege 1868 KavUpda.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exeKavUpda.exepid process 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe 1868 KavUpda.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exenet.execmd.execmd.exenet.exenet.exenet.exedescription pid process target process PID 1892 wrote to memory of 2288 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe cmd.exe PID 1892 wrote to memory of 2288 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe cmd.exe PID 1892 wrote to memory of 2288 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe cmd.exe PID 1892 wrote to memory of 2288 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe cmd.exe PID 1892 wrote to memory of 2300 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2300 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2300 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2300 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 2300 wrote to memory of 2668 2300 net.exe net1.exe PID 2300 wrote to memory of 2668 2300 net.exe net1.exe PID 2300 wrote to memory of 2668 2300 net.exe net1.exe PID 2300 wrote to memory of 2668 2300 net.exe net1.exe PID 1892 wrote to memory of 2652 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe At.exe PID 1892 wrote to memory of 2652 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe At.exe PID 1892 wrote to memory of 2652 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe At.exe PID 1892 wrote to memory of 2652 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe At.exe PID 1892 wrote to memory of 2468 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe cmd.exe PID 1892 wrote to memory of 2468 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe cmd.exe PID 1892 wrote to memory of 2468 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe cmd.exe PID 1892 wrote to memory of 2468 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe cmd.exe PID 1892 wrote to memory of 2620 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe cmd.exe PID 1892 wrote to memory of 2620 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe cmd.exe PID 1892 wrote to memory of 2620 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe cmd.exe PID 1892 wrote to memory of 2620 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe cmd.exe PID 1892 wrote to memory of 2496 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2496 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2496 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2496 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 2468 wrote to memory of 2624 2468 cmd.exe at.exe PID 2468 wrote to memory of 2624 2468 cmd.exe at.exe PID 2468 wrote to memory of 2624 2468 cmd.exe at.exe PID 2468 wrote to memory of 2624 2468 cmd.exe at.exe PID 1892 wrote to memory of 2484 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2484 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2484 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2484 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2112 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2112 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2112 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2112 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2480 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2480 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2480 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2480 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2360 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2360 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2360 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 1892 wrote to memory of 2360 1892 90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe net.exe PID 2620 wrote to memory of 872 2620 cmd.exe at.exe PID 2620 wrote to memory of 872 2620 cmd.exe at.exe PID 2620 wrote to memory of 872 2620 cmd.exe at.exe PID 2620 wrote to memory of 872 2620 cmd.exe at.exe PID 2112 wrote to memory of 348 2112 net.exe net1.exe PID 2112 wrote to memory of 348 2112 net.exe net1.exe PID 2112 wrote to memory of 348 2112 net.exe net1.exe PID 2112 wrote to memory of 348 2112 net.exe net1.exe PID 2484 wrote to memory of 2304 2484 net.exe net1.exe PID 2484 wrote to memory of 2304 2484 net.exe net1.exe PID 2484 wrote to memory of 2304 2484 net.exe net1.exe PID 2484 wrote to memory of 2304 2484 net.exe net1.exe PID 2496 wrote to memory of 2948 2496 net.exe net1.exe PID 2496 wrote to memory of 2948 2496 net.exe net1.exe PID 2496 wrote to memory of 2948 2496 net.exe net1.exe PID 2496 wrote to memory of 2948 2496 net.exe net1.exe -
Views/modifies file attributes 1 TTPs 16 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 356 attrib.exe 2672 attrib.exe 2036 attrib.exe 2880 attrib.exe 552 attrib.exe 2728 attrib.exe 2284 attrib.exe 3052 attrib.exe 2704 attrib.exe 2380 attrib.exe 2480 attrib.exe 1516 attrib.exe 2200 attrib.exe 1588 attrib.exe 2884 attrib.exe 2192 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\Option.bat2⤵PID:2288
-
-
C:\Windows\SysWOW64\net.exenet.exe start schedule /y2⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule /y3⤵PID:2668
-
-
-
C:\Windows\SysWOW64\At.exeAt.exe 7:49:07 AM C:\Windows\Help\HelpCat.exe2⤵PID:2652
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 7:48:09 AM C:\Windows\Sysinf.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\at.exeat 7:48:09 AM C:\Windows\Sysinf.bat3⤵PID:2624
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 7:51:09 AM C:\Windows\Sysinf.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\at.exeat 7:51:09 AM C:\Windows\Sysinf.bat3⤵PID:872
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y2⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y3⤵PID:2948
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y2⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y3⤵PID:2304
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y2⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y3⤵PID:348
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y2⤵PID:2480
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y3⤵PID:2448
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y2⤵PID:2360
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y3⤵PID:856
-
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled2⤵
- Launches sc.exe
PID:2764
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled2⤵
- Launches sc.exe
PID:2636
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled2⤵
- Launches sc.exe
PID:2788
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled2⤵
- Launches sc.exe
PID:2812
-
-
C:\Windows\SysWOW64\regedit.exeregedit.exe /s C:\Windows\regedt32.sys2⤵
- Modifies visibility of file extensions in Explorer
- Blocks application from running via registry modification
- Sets file execution options in registry
- Runs regedit.exe
PID:1216
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f2⤵PID:1832
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f2⤵PID:1956
-
-
C:\Windows\system\KavUpda.exeC:\Windows\system\KavUpda.exe2⤵
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1868 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\system32\Option.bat3⤵PID:1856
-
-
C:\Windows\SysWOW64\net.exenet.exe start schedule /y3⤵PID:2944
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule /y4⤵PID:1516
-
-
-
C:\Windows\SysWOW64\At.exeAt.exe 7:49:10 AM C:\Windows\Help\HelpCat.exe3⤵PID:1688
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 7:48:12 AM C:\Windows\Sysinf.bat3⤵PID:2228
-
C:\Windows\SysWOW64\at.exeat 7:48:12 AM C:\Windows\Sysinf.bat4⤵PID:1724
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 7:51:12 AM C:\Windows\Sysinf.bat3⤵PID:2296
-
C:\Windows\SysWOW64\at.exeat 7:51:12 AM C:\Windows\Sysinf.bat4⤵PID:584
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y3⤵PID:2088
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y4⤵PID:2372
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y3⤵PID:2264
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y4⤵PID:2216
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y3⤵PID:2200
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y4⤵PID:2644
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y3⤵PID:1048
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y4⤵PID:328
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y3⤵PID:540
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y4⤵PID:1780
-
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled3⤵
- Launches sc.exe
PID:2896
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:632
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled3⤵
- Launches sc.exe
PID:3012
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled3⤵
- Launches sc.exe
PID:2240
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f3⤵PID:1468
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f3⤵PID:1232
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:380
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:2884
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1768
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:552
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:356
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2392
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:1528
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:2672
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1532
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2664
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:2380
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2704
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:3020
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:2480
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2304
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2636
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:2728
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:1936
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2748
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:2192
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2652
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2928
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:1516
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:1016
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2556
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:2036
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:852
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2648
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:2200
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:956
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:1312
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:1588
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2404
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2992
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:2284
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:816
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:1080
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:2880
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1724
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2904
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:552
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:1068
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:1380
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:3052
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1524
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2940
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:2704
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2352
-
-
-
C:\Users\Admin\AppData\Local\Temp\90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118~4.exe90ff1ce257c698c8c715aee56c0b18ab_JaffaCakes118~4.exe2⤵
- Executes dropped EXE
PID:1364
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {AEBDFD6B-BEE2-4F3B-9E9F-C2B03519BF0F} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:1484
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD53f7fbd2eb34892646e93fd5e6e343512
SHA1265ac1061b54f62350fb7a5f57e566454d013a66
SHA256e75e8d9bfc7a2876d908305186c3656e9de2a4af7f6927ccc6d8c812645abbc7
SHA51253d40eb2f05a23464fbf06193868e7cb30cf0df3da53586a75123fb2c37b29cdddda287ce134809d16a559d87fb20aee0e8add22d396fcb7a55f9a753739b140
-
Filesize
460B
MD57db3d565d6ddbe65a8b0e093910e7dcd
SHA1d4804e6180c6e74ba79d3343f2f2ccb15e502f12
SHA256a2778cb87fd88c7508ffd506a8ff8d58d0ffc02156f846956e5e99c6cb3d2f3f
SHA5120b3d1d0f44feba9dd78903ff77fdeaea834d930990a86641fb2e4ce04da280d33f6bee0ae0b1320e4070cbe20824062e45b52e5cad797c5985d8e31dce1ef82b
-
Filesize
2KB
MD5e7d7ec66bd61fac3843c98650b0c68f6
SHA1a15ae06e1be51038863650746368a71024539bac
SHA2566475d5ecc14fea090774be55723d2d52b7ec7670527a7dbd61edf28c77944cb8
SHA512ac9e9893f5a0af03957731445f63279085f164e9a968d706a99d13012e4459314a7ccc32dc48f62379d69e21a0953c13543c9ded38b5ad5fbc346aa442af1ae6
-
Filesize
577KB
MD518a6c405f38ea61d5452014dc57e6e10
SHA1eded10e0f3bfbe34b9d0512e6e2173f0f9e6482b
SHA25632793cabdbb1910a05d9f680c026a27b494e2209f968c276b72b785828e56ebf
SHA5124fea85565c264990a7d95f0d59ecc85d71153b20441d51688ee4b29a3f059988edb7337ac8c8c67e637b318c21cc3d4d05ab07f0d595c36ce44dcfe83a3ed08b
-
Filesize
237B
MD594bcd02c5afd5918b4446345e7a5ded9
SHA179839238e84be225132e1382fae6333dfc4906a1
SHA2565d9f41e4f886926dae2ed8a57807708110d3c6964ab462be21462bff0088d9a1
SHA512149f6bd49fc3b62fa5f41666bfb3a58060514eec1b61c6aa1ac4c75417c840b028e701eb5533460eb00e2fee8543379564bc47d7477264771d81b99a0caab500
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
30KB
MD5a48b1c06219a01a60cd8d4d45440bde9
SHA134af23607ad5afa9e61b6a96cec811e6bdc50b4a
SHA2565c3736e37168dae7e431a31d5c4e0d351271d37804787ee3b8fa6e46413ba880
SHA5128f6b29be451582e47743009d95637f540dea4d7c93e685687e8b8f130a1cf535a4030722367fd4ac49639c19ce35c779c0cfef315eea038d9a4434474c7690f4