Analysis Overview
SHA256
83cdd163c5454b70cb92b43e792c47b22740085a3c438db0ee341115c884ca31
Threat Level: Known bad
The file a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
Disables service(s)
Modifies visibility of file extensions in Explorer
Sets file execution options in registry
Blocks application from running via registry modification
Executes dropped EXE
UPX packed file
Loads dropped DLL
Drops file in System32 directory
Drops autorun.inf file
Launches sc.exe
Drops file in Windows directory
Drops file in Program Files directory
Unsigned PE
Suspicious use of AdjustPrivilegeToken
Runs net.exe
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Runs regedit.exe
Views/modifies file attributes
MITRE ATT&CK Matrix V13
Analysis: static1
Detonation Overview
Reported
2024-06-13 22:43
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 22:43
Reported
2024-06-13 22:45
Platform
win7-20240220-en
Max time kernel
147s
Max time network
125s
Command Line
Signatures
Disables service(s)
Modifies visibility of file extensions in Explorer
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" | C:\Windows\SysWOW64\regedit.exe | N/A |
Blocks application from running via registry modification
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "RfwMain.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "KAVStart.EXE" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rfwsrv.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "RavService.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "Rav.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "rfwcfg.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "KPFW32X.EXE" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "RavMon.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "KAVPFW.EXE" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "RavMoD.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "CCenter.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "RavStub.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "KPFW32.EXE" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KAV32.EXE" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
Sets file execution options in registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system\KavUpda.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| N/A | N/A | C:\Windows\system\KavUpda.exe | N/A |
Loads dropped DLL
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops autorun.inf file
| Description | Indicator | Process | Target |
| File opened for modification | F:\Autorun.inf | C:\Windows\system\KavUpda.exe | N/A |
| File opened for modification | C:\Autorun.inf | C:\Windows\system\KavUpda.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\Option.bat | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\Option.bat | C:\Windows\system\KavUpda.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\Option.bat | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\Option.bat | C:\Windows\system\KavUpda.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\Folderdir | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\7-Zip\7z.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\7-Zip\7zFM.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\DVD Maker\DVDMaker.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\chrome.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\chrome_proxy.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk1.7.0_80\bin\java.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\7-Zip\7zG.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\7-Zip\Uninstall.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
Drops file in Windows directory
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
Runs net.exe
Runs regedit.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\regedit.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Windows\system\KavUpda.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| N/A | N/A | C:\Windows\system\KavUpda.exe | N/A |
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118.exe"
C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\system32\Option.bat
C:\Windows\SysWOW64\net.exe
net.exe start schedule /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
C:\Windows\SysWOW64\At.exe
At.exe 10:46:15 PM C:\Windows\Help\HelpCat.exe
C:\Windows\SysWOW64\cmd.exe
cmd /c at 10:45:17 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\cmd.exe
cmd /c at 10:48:17 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\net.exe
net.exe stop wscsvc /y
C:\Windows\SysWOW64\net.exe
net.exe stop sharedaccess /y
C:\Windows\SysWOW64\net.exe
net.exe stop wuauserv /y
C:\Windows\SysWOW64\net.exe
net.exe stop srservice /y
C:\Windows\SysWOW64\net.exe
net.exe stop 360timeprot /y
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config srservice start= disabled
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config SharedAccess start= disabled
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config wscsvc start= disabled
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config srservice start= disabled
C:\Windows\SysWOW64\regedit.exe
regedit.exe /s C:\Windows\regedt32.sys
C:\Windows\SysWOW64\at.exe
at 10:45:17 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
C:\Windows\SysWOW64\at.exe
at 10:48:17 PM C:\Windows\Sysinf.bat
C:\Windows\system\KavUpda.exe
C:\Windows\system\KavUpda.exe
C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\system32\Option.bat
C:\Windows\SysWOW64\net.exe
net.exe start schedule /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
C:\Windows\SysWOW64\At.exe
At.exe 10:46:19 PM C:\Windows\Help\HelpCat.exe
C:\Windows\SysWOW64\cmd.exe
cmd /c at 10:45:21 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\cmd.exe
cmd /c at 10:48:21 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\net.exe
net.exe stop wscsvc /y
C:\Windows\SysWOW64\net.exe
net.exe stop sharedaccess /y
C:\Windows\SysWOW64\net.exe
net.exe stop wuauserv /y
C:\Windows\SysWOW64\net.exe
net.exe stop srservice /y
C:\Windows\SysWOW64\at.exe
at 10:45:21 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\net.exe
net.exe stop 360timeprot /y
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config srservice start= disabled
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config SharedAccess start= disabled
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config wscsvc start= disabled
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
C:\Windows\SysWOW64\at.exe
at 10:48:21 PM C:\Windows\Sysinf.bat
C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe
a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config srservice start= disabled
C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\system32\Option.bat
C:\Windows\SysWOW64\net.exe
net.exe start schedule /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir F:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\At.exe
At.exe 10:46:21 PM C:\Windows\Help\HelpCat.exe
C:\Windows\SysWOW64\cmd.exe
cmd /c at 10:45:23 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\cmd.exe
cmd /c at 10:48:23 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\net.exe
net.exe stop wscsvc /y
C:\Windows\SysWOW64\net.exe
net.exe stop sharedaccess /y
C:\Windows\SysWOW64\net.exe
net.exe stop wuauserv /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
C:\Windows\SysWOW64\at.exe
at 10:48:23 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\at.exe
at 10:45:23 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
C:\Windows\SysWOW64\net.exe
net.exe stop srservice /y
C:\Windows\SysWOW64\net.exe
net.exe stop 360timeprot /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config srservice start= disabled
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config SharedAccess start= disabled
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config wscsvc start= disabled
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config srservice start= disabled
C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
C:\Windows\system\KavUpda.exe
C:\Windows\system\KavUpda.exe
C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\system32\Option.bat
C:\Windows\SysWOW64\net.exe
net.exe start schedule /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir C:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\At.exe
At.exe 10:46:24 PM C:\Windows\Help\HelpCat.exe
C:\Windows\SysWOW64\cmd.exe
cmd /c at 10:45:26 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\cmd.exe
cmd /c at 10:48:26 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\net.exe
net.exe stop wscsvc /y
C:\Windows\SysWOW64\net.exe
net.exe stop wscsvc /y
C:\Windows\SysWOW64\net.exe
net.exe stop sharedaccess /y
C:\Windows\SysWOW64\net.exe
net.exe stop sharedaccess /y
C:\Windows\SysWOW64\net.exe
net.exe stop wuauserv /y
C:\Windows\SysWOW64\net.exe
net.exe stop srservice /y
C:\Windows\SysWOW64\net.exe
net.exe stop wuauserv /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
C:\Windows\SysWOW64\net.exe
net.exe stop 360timeprot /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
C:\Windows\SysWOW64\at.exe
at 10:48:26 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\at.exe
at 10:45:26 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
C:\Windows\SysWOW64\net.exe
net.exe stop srservice /y
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config srservice start= disabled
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config SharedAccess start= disabled
C:\Windows\SysWOW64\net.exe
net.exe stop 360timeprot /y
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config wscsvc start= disabled
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config srservice start= disabled
C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir F:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir C:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir F:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir C:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir F:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir C:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir F:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir C:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir F:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir C:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir F:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir C:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir F:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir C:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
Network
Files
memory/3032-0-0x0000000000400000-0x0000000000436000-memory.dmp
C:\Windows\SysWOW64\Option.bat
| MD5 | 3f7fbd2eb34892646e93fd5e6e343512 |
| SHA1 | 265ac1061b54f62350fb7a5f57e566454d013a66 |
| SHA256 | e75e8d9bfc7a2876d908305186c3656e9de2a4af7f6927ccc6d8c812645abbc7 |
| SHA512 | 53d40eb2f05a23464fbf06193868e7cb30cf0df3da53586a75123fb2c37b29cdddda287ce134809d16a559d87fb20aee0e8add22d396fcb7a55f9a753739b140 |
C:\Windows\system\KavUpda.exe
| MD5 | 23e324b273f61c83be81277aba01decb |
| SHA1 | 88e727866e88353a9dfb44b78cfc7d8b3a010781 |
| SHA256 | 4b7689dbe1a8edbd7c69107cbce0b4252419981af56e69c8f71ea6aabadbedc1 |
| SHA512 | 9521db606fb1d79daf00dd04a59c1ff5bdf06d3c38b2b7f9346597fd918a629f4c17680d4f3dd02650759c93570d6944847fd72e73e5226d0f45f29869a4b8e0 |
C:\Windows\regedt32.sys
| MD5 | e7d7ec66bd61fac3843c98650b0c68f6 |
| SHA1 | a15ae06e1be51038863650746368a71024539bac |
| SHA256 | 6475d5ecc14fea090774be55723d2d52b7ec7670527a7dbd61edf28c77944cb8 |
| SHA512 | ac9e9893f5a0af03957731445f63279085f164e9a968d706a99d13012e4459314a7ccc32dc48f62379d69e21a0953c13543c9ded38b5ad5fbc346aa442af1ae6 |
C:\Windows\Sysinf.bat
| MD5 | 7db3d565d6ddbe65a8b0e093910e7dcd |
| SHA1 | d4804e6180c6e74ba79d3343f2f2ccb15e502f12 |
| SHA256 | a2778cb87fd88c7508ffd506a8ff8d58d0ffc02156f846956e5e99c6cb3d2f3f |
| SHA512 | 0b3d1d0f44feba9dd78903ff77fdeaea834d930990a86641fb2e4ce04da280d33f6bee0ae0b1320e4070cbe20824062e45b52e5cad797c5985d8e31dce1ef82b |
C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe
| MD5 | c3dd5c1842430315800e4751c137c68e |
| SHA1 | 33ba6c851637eedab9fce714066b6305a6208dac |
| SHA256 | a2b08cb0470296174d249eb19ab1700991b1b3ca4fb25f3418d7f385fa3dd66a |
| SHA512 | ab970e1440a3fdbf1690fbf767155e2ab4e8d0a7a7a3eb360da122d2ef70dd76efb54650afd14c98db0d0f43e47652f4a1c04d5cb50799b1f31644c6de412098 |
memory/2132-58-0x0000000000400000-0x0000000000440000-memory.dmp
\??\PIPE\atsvc
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/3032-52-0x0000000000440000-0x0000000000480000-memory.dmp
memory/3032-51-0x0000000000440000-0x0000000000480000-memory.dmp
F:\Autorun.inf
| MD5 | 94bcd02c5afd5918b4446345e7a5ded9 |
| SHA1 | 79839238e84be225132e1382fae6333dfc4906a1 |
| SHA256 | 5d9f41e4f886926dae2ed8a57807708110d3c6964ab462be21462bff0088d9a1 |
| SHA512 | 149f6bd49fc3b62fa5f41666bfb3a58060514eec1b61c6aa1ac4c75417c840b028e701eb5533460eb00e2fee8543379564bc47d7477264771d81b99a0caab500 |
\??\c:\ntldr~6
| MD5 | 7b7244eca4786dc526de6aa3bf1ba20e |
| SHA1 | bf4a4fd0efe84e2ef13d46e372ae0d0ef0bf9e3f |
| SHA256 | 45d365fc813e55b599257dcd23cbfbf4fffccdfa641d7f02bf260ee3ae14ca4e |
| SHA512 | 5e998ccd293927b76a4b7395e43c07dbf5e8dc26d8d61eb577029a28b3280b5c069820cf69123081f542f47f625c00ac807f9d80a73a6d8a7c241a4a78658dce |
memory/2132-122-0x0000000000400000-0x0000000000440000-memory.dmp
memory/3032-139-0x0000000000440000-0x0000000000480000-memory.dmp
memory/3032-138-0x0000000000440000-0x0000000000480000-memory.dmp
memory/2132-137-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2132-155-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2132-182-0x0000000000400000-0x0000000000440000-memory.dmp
memory/2132-185-0x0000000000400000-0x0000000000440000-memory.dmp
\??\c:\ntldr~8
| MD5 | e6e2af6beb4cb19ff95746736c903155 |
| SHA1 | b78209a1ed3f0dd1f57c427118e6149faca4f72b |
| SHA256 | e54b1b88e72307c48e8999d8d0f69212d40d5a82763288da6ac52c191735a89a |
| SHA512 | b864a2ef33cc71378880a761f2eb06bae766c550cf44ac0915059360f1680a950d80486e0dc893b8e6b88192bab86fc56e15634f01540fd5ee82948d0bff6949 |
memory/2132-198-0x0000000000400000-0x0000000000440000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-13 22:43
Reported
2024-06-13 22:45
Platform
win10v2004-20240508-en
Max time kernel
149s
Max time network
51s
Command Line
Signatures
Disables service(s)
Modifies visibility of file extensions in Explorer
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" | C:\Windows\SysWOW64\regedit.exe | N/A |
Blocks application from running via registry modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rfwsrv.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "KPFW32X.EXE" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "RfwMain.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "Rav.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "KPFW32.EXE" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "KAVPFW.EXE" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KAV32.EXE" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "RavService.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "rfwcfg.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "KAVStart.EXE" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "RavMoD.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "CCenter.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "RavMon.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "RavStub.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
Sets file execution options in registry
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe\Debugger = "D:\\RECYCLER\\????8.exe" | C:\Windows\SysWOW64\regedit.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe | C:\Windows\SysWOW64\regedit.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system\KavUpda.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| N/A | N/A | C:\Windows\system\KavUpda.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops autorun.inf file
| Description | Indicator | Process | Target |
| File opened for modification | F:\Autorun.inf | C:\Windows\system\KavUpda.exe | N/A |
| File opened for modification | C:\Autorun.inf | C:\Windows\system\KavUpda.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\Option.bat | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\Option.bat | C:\Windows\system\KavUpda.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\Option.bat | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\Option.bat | C:\Windows\system\KavUpda.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\javah.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\jcmd.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\jhat.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\javapackager.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\jinfo.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\7-Zip\7zFM.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\7-Zip\7zG.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\javac.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\java.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\javaws.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\jconsole.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\chrome.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\javadoc.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\jdeps.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\jar.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\javaw.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\jjs.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\7-Zip\7z.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\dotnet\dotnet.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\7-Zip\Uninstall.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Google\Chrome\Application\chrome_proxy.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\extcheck.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\idlj.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\javap.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| File opened for modification | C:\Program Files\Java\jdk-1.8\bin\jdb.exe | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
Drops file in Windows directory
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
Runs net.exe
Runs regedit.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\regedit.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Windows\system\KavUpda.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe | N/A |
| N/A | N/A | C:\Windows\system\KavUpda.exe | N/A |
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
C:\Windows\SysWOW64\net.exe
net.exe start schedule /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
C:\Windows\SysWOW64\At.exe
At.exe 10:46:12 PM C:\Windows\Help\HelpCat.exe
C:\Windows\SysWOW64\cmd.exe
cmd /c at 10:45:14 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\cmd.exe
cmd /c at 10:48:14 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\net.exe
net.exe stop wscsvc /y
C:\Windows\SysWOW64\net.exe
net.exe stop sharedaccess /y
C:\Windows\SysWOW64\net.exe
net.exe stop wuauserv /y
C:\Windows\SysWOW64\net.exe
net.exe stop srservice /y
C:\Windows\SysWOW64\net.exe
net.exe stop 360timeprot /y
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config srservice start= disabled
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config SharedAccess start= disabled
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config wscsvc start= disabled
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config srservice start= disabled
C:\Windows\SysWOW64\regedit.exe
regedit.exe /s C:\Windows\regedt32.sys
C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
C:\Windows\SysWOW64\at.exe
at 10:48:14 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
C:\Windows\SysWOW64\at.exe
at 10:45:14 PM C:\Windows\Sysinf.bat
C:\Windows\system\KavUpda.exe
C:\Windows\system\KavUpda.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
C:\Windows\SysWOW64\net.exe
net.exe start schedule /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
C:\Windows\SysWOW64\At.exe
At.exe 10:46:15 PM C:\Windows\Help\HelpCat.exe
C:\Windows\SysWOW64\cmd.exe
cmd /c at 10:45:17 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\cmd.exe
cmd /c at 10:48:17 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\net.exe
net.exe stop wscsvc /y
C:\Windows\SysWOW64\net.exe
net.exe stop sharedaccess /y
C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe
a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe
C:\Windows\SysWOW64\net.exe
net.exe stop wuauserv /y
C:\Windows\SysWOW64\net.exe
net.exe stop srservice /y
C:\Windows\SysWOW64\net.exe
net.exe stop 360timeprot /y
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config srservice start= disabled
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config SharedAccess start= disabled
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config wscsvc start= disabled
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
C:\Windows\SysWOW64\net.exe
net.exe start schedule /y
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config srservice start= disabled
C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir F:\Autorun.inf /s /q
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
C:\Windows\SysWOW64\at.exe
at 10:48:17 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\at.exe
at 10:45:17 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\At.exe
At.exe 10:46:17 PM C:\Windows\Help\HelpCat.exe
C:\Windows\SysWOW64\cmd.exe
cmd /c at 10:45:19 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\cmd.exe
cmd /c at 10:48:19 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\net.exe
net.exe stop wscsvc /y
C:\Windows\SysWOW64\net.exe
net.exe stop sharedaccess /y
C:\Windows\SysWOW64\net.exe
net.exe stop wuauserv /y
C:\Windows\SysWOW64\net.exe
net.exe stop srservice /y
C:\Windows\SysWOW64\net.exe
net.exe stop 360timeprot /y
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config srservice start= disabled
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config SharedAccess start= disabled
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config wscsvc start= disabled
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config srservice start= disabled
C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
C:\Windows\SysWOW64\at.exe
at 10:45:19 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\at.exe
at 10:48:19 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
C:\Windows\system\KavUpda.exe
C:\Windows\system\KavUpda.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
C:\Windows\SysWOW64\net.exe
net.exe start schedule /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir C:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\At.exe
At.exe 10:46:20 PM C:\Windows\Help\HelpCat.exe
C:\Windows\SysWOW64\cmd.exe
cmd /c at 10:45:23 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\cmd.exe
cmd /c at 10:48:23 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\net.exe
net.exe stop wscsvc /y
C:\Windows\SysWOW64\net.exe
net.exe stop wscsvc /y
C:\Windows\SysWOW64\net.exe
net.exe stop sharedaccess /y
C:\Windows\SysWOW64\net.exe
net.exe stop sharedaccess /y
C:\Windows\SysWOW64\net.exe
net.exe stop wuauserv /y
C:\Windows\SysWOW64\net.exe
net.exe stop wuauserv /y
C:\Windows\SysWOW64\net.exe
net.exe stop srservice /y
C:\Windows\SysWOW64\net.exe
net.exe stop srservice /y
C:\Windows\SysWOW64\net.exe
net.exe stop 360timeprot /y
C:\Windows\SysWOW64\net.exe
net.exe stop 360timeprot /y
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config srservice start= disabled
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config SharedAccess start= disabled
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config wscsvc start= disabled
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe config srservice start= disabled
C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
C:\Windows\SysWOW64\reg.exe
C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
C:\Windows\SysWOW64\at.exe
at 10:45:23 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
C:\Windows\SysWOW64\at.exe
at 10:48:23 PM C:\Windows\Sysinf.bat
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir F:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir C:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir F:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir C:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir F:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir C:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir F:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir C:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir F:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir C:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir F:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir C:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir F:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
C:\Windows\SysWOW64\cmd.exe
cmd /c rmdir C:\Autorun.inf /s /q
C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
Network
Files
memory/1240-0-0x0000000000400000-0x0000000000436000-memory.dmp
C:\Windows\SysWOW64\Option.bat
| MD5 | 3f7fbd2eb34892646e93fd5e6e343512 |
| SHA1 | 265ac1061b54f62350fb7a5f57e566454d013a66 |
| SHA256 | e75e8d9bfc7a2876d908305186c3656e9de2a4af7f6927ccc6d8c812645abbc7 |
| SHA512 | 53d40eb2f05a23464fbf06193868e7cb30cf0df3da53586a75123fb2c37b29cdddda287ce134809d16a559d87fb20aee0e8add22d396fcb7a55f9a753739b140 |
C:\Windows\System\KavUpda.exe
| MD5 | 23e324b273f61c83be81277aba01decb |
| SHA1 | 88e727866e88353a9dfb44b78cfc7d8b3a010781 |
| SHA256 | 4b7689dbe1a8edbd7c69107cbce0b4252419981af56e69c8f71ea6aabadbedc1 |
| SHA512 | 9521db606fb1d79daf00dd04a59c1ff5bdf06d3c38b2b7f9346597fd918a629f4c17680d4f3dd02650759c93570d6944847fd72e73e5226d0f45f29869a4b8e0 |
C:\Windows\regedt32.sys
| MD5 | e7d7ec66bd61fac3843c98650b0c68f6 |
| SHA1 | a15ae06e1be51038863650746368a71024539bac |
| SHA256 | 6475d5ecc14fea090774be55723d2d52b7ec7670527a7dbd61edf28c77944cb8 |
| SHA512 | ac9e9893f5a0af03957731445f63279085f164e9a968d706a99d13012e4459314a7ccc32dc48f62379d69e21a0953c13543c9ded38b5ad5fbc346aa442af1ae6 |
C:\Windows\Sysinf.bat
| MD5 | 7db3d565d6ddbe65a8b0e093910e7dcd |
| SHA1 | d4804e6180c6e74ba79d3343f2f2ccb15e502f12 |
| SHA256 | a2778cb87fd88c7508ffd506a8ff8d58d0ffc02156f846956e5e99c6cb3d2f3f |
| SHA512 | 0b3d1d0f44feba9dd78903ff77fdeaea834d930990a86641fb2e4ce04da280d33f6bee0ae0b1320e4070cbe20824062e45b52e5cad797c5985d8e31dce1ef82b |
C:\Users\Admin\AppData\Local\Temp\a6f25f9b0e3927a2b801aa1a2b1bf0e4_JaffaCakes118~4.exe
| MD5 | c3dd5c1842430315800e4751c137c68e |
| SHA1 | 33ba6c851637eedab9fce714066b6305a6208dac |
| SHA256 | a2b08cb0470296174d249eb19ab1700991b1b3ca4fb25f3418d7f385fa3dd66a |
| SHA512 | ab970e1440a3fdbf1690fbf767155e2ab4e8d0a7a7a3eb360da122d2ef70dd76efb54650afd14c98db0d0f43e47652f4a1c04d5cb50799b1f31644c6de412098 |
memory/1844-33-0x0000000000400000-0x0000000000440000-memory.dmp
F:\Autorun.inf
| MD5 | 94bcd02c5afd5918b4446345e7a5ded9 |
| SHA1 | 79839238e84be225132e1382fae6333dfc4906a1 |
| SHA256 | 5d9f41e4f886926dae2ed8a57807708110d3c6964ab462be21462bff0088d9a1 |
| SHA512 | 149f6bd49fc3b62fa5f41666bfb3a58060514eec1b61c6aa1ac4c75417c840b028e701eb5533460eb00e2fee8543379564bc47d7477264771d81b99a0caab500 |
memory/1844-89-0x0000000000400000-0x0000000000440000-memory.dmp
memory/1844-368-0x0000000000400000-0x0000000000440000-memory.dmp