Malware Analysis Report

2024-11-16 13:20

Sample ID 240613-ggayqazfjp
Target a40cc5224fd7f9a2f4b1c4c98f5940e5_JaffaCakes118
SHA256 2481423874acd27df811d297554ea75fc9e612391fa35b727ecb7b661bc7995c
Tags
evasion execution trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2481423874acd27df811d297554ea75fc9e612391fa35b727ecb7b661bc7995c

Threat Level: Known bad

The file a40cc5224fd7f9a2f4b1c4c98f5940e5_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

evasion execution trojan

Modifies Windows Defender Real-time Protection settings

Stops running service(s)

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Drops file in System32 directory

Launches sc.exe

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 05:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 05:46

Reported

2024-06-13 05:48

Platform

win7-20240611-en

Max time kernel

119s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a40cc5224fd7f9a2f4b1c4c98f5940e5_JaffaCakes118.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\ProgramData\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\ProgramData\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Roaming\NetLibs14\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Roaming\NetLibs14\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Roaming\NetLibs14\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Roaming\NetLibs14\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\ProgramData\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\ProgramData\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\ProgramData\олрпроауавцфйывв.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Roaming\NetLibs14\олрпроауавцфйывв.exe N/A

Stops running service(s)

evasion execution

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 3067032655bdda01 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Users\Admin\AppData\Roaming\NetLibs14\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" C:\Users\Admin\AppData\Roaming\NetLibs14\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" C:\Users\Admin\AppData\Roaming\NetLibs14\олрпроауавцфйывв.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2216 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\a40cc5224fd7f9a2f4b1c4c98f5940e5_JaffaCakes118.exe C:\ProgramData\олрпроауавцфйывв.exe
PID 2216 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\a40cc5224fd7f9a2f4b1c4c98f5940e5_JaffaCakes118.exe C:\ProgramData\олрпроауавцфйывв.exe
PID 2216 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\a40cc5224fd7f9a2f4b1c4c98f5940e5_JaffaCakes118.exe C:\ProgramData\олрпроауавцфйывв.exe
PID 2216 wrote to memory of 1924 N/A C:\Users\Admin\AppData\Local\Temp\a40cc5224fd7f9a2f4b1c4c98f5940e5_JaffaCakes118.exe C:\ProgramData\олрпроауавцфйывв.exe
PID 1924 wrote to memory of 2684 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2684 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2684 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2684 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2588 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2588 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2588 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2588 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2624 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2624 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2624 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2624 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2708 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2708 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2708 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2708 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 2684 wrote to memory of 2716 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 2684 wrote to memory of 2716 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 2684 wrote to memory of 2716 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 2588 wrote to memory of 2736 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 2588 wrote to memory of 2736 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 2588 wrote to memory of 2736 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 1924 wrote to memory of 2692 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2692 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2692 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2692 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2908 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2908 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2908 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2908 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2628 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2628 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2628 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2628 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2872 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2872 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2872 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2872 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 2708 wrote to memory of 2076 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2708 wrote to memory of 2076 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2708 wrote to memory of 2076 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1924 wrote to memory of 2856 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2856 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2856 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2856 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 2908 wrote to memory of 2668 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2908 wrote to memory of 2668 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2908 wrote to memory of 2668 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2624 wrote to memory of 2536 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2624 wrote to memory of 2536 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2624 wrote to memory of 2536 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1924 wrote to memory of 2660 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2660 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2660 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2660 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2516 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2516 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2516 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2516 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1924 wrote to memory of 2568 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\a40cc5224fd7f9a2f4b1c4c98f5940e5_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a40cc5224fd7f9a2f4b1c4c98f5940e5_JaffaCakes118.exe"

C:\ProgramData\олрпроауавцфйывв.exe

"C:\ProgramData\олрпроауавцфйывв.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c sc stop WinDefend

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c sc delete WinDefend

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBehaviorMonitoring $true

C:\Windows\system32\sc.exe

sc stop WinDefend

C:\Windows\system32\sc.exe

sc delete WinDefend

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisablePrivacyMode $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableBehaviorMonitoring $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -SevereThreatDefaultAction 6

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -LowThreatDefaultAction 6

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -ModerateThreatDefaultAction 6

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableScriptScanning $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -SevereThreatDefaultAction 6

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableBlockAtFirstSeen $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisablePrivacyMode $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -LowThreatDefaultAction 6

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableScriptScanning $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -ModerateThreatDefaultAction 6

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\taskeng.exe

taskeng.exe {A60FD5BA-2F36-43F8-B40B-449D2CB2C5BC} S-1-5-18:NT AUTHORITY\System:Service:

C:\Users\Admin\AppData\Roaming\NetLibs14\олрпроауавцфйывв.exe

C:\Users\Admin\AppData\Roaming\NetLibs14\олрпроауавцфйывв.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c sc stop WinDefend

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c sc delete WinDefend

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\system32\sc.exe

sc stop WinDefend

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBehaviorMonitoring $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisablePrivacyMode $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -SevereThreatDefaultAction 6

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -LowThreatDefaultAction 6

C:\Windows\system32\sc.exe

sc delete WinDefend

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -ModerateThreatDefaultAction 6

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableScriptScanning $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableBehaviorMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableBlockAtFirstSeen $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -ModerateThreatDefaultAction 6

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableScriptScanning $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -LowThreatDefaultAction 6

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisablePrivacyMode $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -SevereThreatDefaultAction 6

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

Network

N/A

Files

\ProgramData\олрпроауавцфйывв.exe

MD5 a40cc5224fd7f9a2f4b1c4c98f5940e5
SHA1 9aa33352bbc6c25176d38ef5d97d5da770293e8f
SHA256 2481423874acd27df811d297554ea75fc9e612391fa35b727ecb7b661bc7995c
SHA512 f235cf9d1721d16d63d4720b3b8ce4395a950f9e78e7b7c927b8feb28ee1d3d45efd49e08df607d36de62c02ead2d103d8c3f39204dca65008790b2a314d4b77

memory/1924-11-0x00000000003C0000-0x00000000003EC000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 00b6a4009ddaf70609738137456905e2
SHA1 dae80db9dc66ccec325cf0f73a292d36246501cf
SHA256 2549cb075db11d32ef9f73f19134ec2c1f7b9ec5b46299a82e28becdb8e68fa7
SHA512 0f78ced0bf7ad7f61b32be24e0b0d15b032996d96d4feee4b7f6b66be4d6195fb41b58593dffe39d7fb81995b43e0fd3579f248ec2a8acb7d92d54537dc2def4

memory/2668-27-0x00000000024A0000-0x00000000024A8000-memory.dmp

memory/2668-22-0x000000001B170000-0x000000001B452000-memory.dmp

memory/1924-63-0x0000000010000000-0x0000000010007000-memory.dmp

memory/1924-70-0x00000000003C0000-0x00000000003EC000-memory.dmp

memory/1652-68-0x0000000010000000-0x000000001001E000-memory.dmp

memory/1652-67-0x0000000010000000-0x000000001001E000-memory.dmp

memory/2996-75-0x0000000019B80000-0x0000000019E62000-memory.dmp

memory/2996-76-0x0000000000DC0000-0x0000000000DC8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 05:46

Reported

2024-06-13 05:48

Platform

win10v2004-20240508-en

Max time kernel

112s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a40cc5224fd7f9a2f4b1c4c98f5940e5_JaffaCakes118.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\ProgramData\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\ProgramData\олрпроауавцфйывв.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Roaming\NetLibs14\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Roaming\NetLibs14\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\ProgramData\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\ProgramData\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\ProgramData\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Roaming\NetLibs14\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Roaming\NetLibs14\олрпроауавцфйывв.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Roaming\NetLibs14\олрпроауавцфйывв.exe N/A

Stops running service(s)

evasion execution

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a40cc5224fd7f9a2f4b1c4c98f5940e5_JaffaCakes118.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\ProgramData\олрпроауавцфйывв.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5052 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\a40cc5224fd7f9a2f4b1c4c98f5940e5_JaffaCakes118.exe C:\ProgramData\олрпроауавцфйывв.exe
PID 5052 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\a40cc5224fd7f9a2f4b1c4c98f5940e5_JaffaCakes118.exe C:\ProgramData\олрпроауавцфйывв.exe
PID 5052 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\a40cc5224fd7f9a2f4b1c4c98f5940e5_JaffaCakes118.exe C:\ProgramData\олрпроауавцфйывв.exe
PID 3268 wrote to memory of 1992 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 1992 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 4416 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 4416 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 5116 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 5116 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 4000 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 4000 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 1368 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 1368 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 2688 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 2688 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 1584 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 1584 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 3500 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 3500 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 3228 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 3228 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 2824 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 2824 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 1416 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 1416 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 1764 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 3268 wrote to memory of 1764 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\System32\cmd.exe
PID 1992 wrote to memory of 4616 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 1992 wrote to memory of 4616 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 5116 wrote to memory of 2996 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5116 wrote to memory of 2996 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4416 wrote to memory of 3960 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 4416 wrote to memory of 3960 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 1416 wrote to memory of 5012 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1416 wrote to memory of 5012 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4000 wrote to memory of 452 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4000 wrote to memory of 452 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3500 wrote to memory of 1440 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3500 wrote to memory of 1440 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1368 wrote to memory of 348 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1368 wrote to memory of 348 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1584 wrote to memory of 2640 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1584 wrote to memory of 2640 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2824 wrote to memory of 4388 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2824 wrote to memory of 4388 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1764 wrote to memory of 4668 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1764 wrote to memory of 4668 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3228 wrote to memory of 1748 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3228 wrote to memory of 1748 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2948 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2688 wrote to memory of 2948 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3268 wrote to memory of 3716 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\system32\svchost.exe
PID 3268 wrote to memory of 3716 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\system32\svchost.exe
PID 3268 wrote to memory of 3716 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\system32\svchost.exe
PID 3268 wrote to memory of 3716 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\system32\svchost.exe
PID 3268 wrote to memory of 3716 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\system32\svchost.exe
PID 3268 wrote to memory of 3716 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\system32\svchost.exe
PID 3268 wrote to memory of 3716 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\system32\svchost.exe
PID 3268 wrote to memory of 3716 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\system32\svchost.exe
PID 3268 wrote to memory of 3716 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\system32\svchost.exe
PID 3268 wrote to memory of 3716 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\system32\svchost.exe
PID 3268 wrote to memory of 3716 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\system32\svchost.exe
PID 3268 wrote to memory of 3716 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\system32\svchost.exe
PID 3268 wrote to memory of 3716 N/A C:\ProgramData\олрпроауавцфйывв.exe C:\Windows\system32\svchost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\a40cc5224fd7f9a2f4b1c4c98f5940e5_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a40cc5224fd7f9a2f4b1c4c98f5940e5_JaffaCakes118.exe"

C:\ProgramData\олрпроауавцфйывв.exe

"C:\ProgramData\олрпроауавцфйывв.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c sc stop WinDefend

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c sc delete WinDefend

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBehaviorMonitoring $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisablePrivacyMode $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -SevereThreatDefaultAction 6

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -LowThreatDefaultAction 6

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -ModerateThreatDefaultAction 6

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableScriptScanning $true

C:\Windows\system32\sc.exe

sc stop WinDefend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\system32\sc.exe

sc delete WinDefend

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -ModerateThreatDefaultAction 6

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableBehaviorMonitoring $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisablePrivacyMode $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableBlockAtFirstSeen $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -LowThreatDefaultAction 6

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableScriptScanning $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -SevereThreatDefaultAction 6

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Users\Admin\AppData\Roaming\NetLibs14\олрпроауавцфйывв.exe

C:\Users\Admin\AppData\Roaming\NetLibs14\олрпроауавцфйывв.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c sc stop WinDefend

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c sc delete WinDefend

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBehaviorMonitoring $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true

C:\Windows\system32\sc.exe

sc stop WinDefend

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\system32\sc.exe

sc delete WinDefend

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisablePrivacyMode $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableRealtimeMonitoring $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableBehaviorMonitoring $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -SevereThreatDefaultAction 6

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -LowThreatDefaultAction 6

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIOAVProtection $true

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -ModerateThreatDefaultAction 6

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableScriptScanning $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableBlockAtFirstSeen $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisablePrivacyMode $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -SevereThreatDefaultAction 6

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -LowThreatDefaultAction 6

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -ModerateThreatDefaultAction 6

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableScriptScanning $true

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 107.181.175.122:443 tcp
US 107.181.175.122:443 tcp

Files

C:\ProgramData\олрпроауавцфйывв.exe

MD5 a40cc5224fd7f9a2f4b1c4c98f5940e5
SHA1 9aa33352bbc6c25176d38ef5d97d5da770293e8f
SHA256 2481423874acd27df811d297554ea75fc9e612391fa35b727ecb7b661bc7995c
SHA512 f235cf9d1721d16d63d4720b3b8ce4395a950f9e78e7b7c927b8feb28ee1d3d45efd49e08df607d36de62c02ead2d103d8c3f39204dca65008790b2a314d4b77

memory/3268-12-0x00000000021A0000-0x00000000021CC000-memory.dmp

memory/2996-13-0x000001ACFE760000-0x000001ACFE782000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u2apxfnz.gvc.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 217d9191dfd67252cef23229676c9eda
SHA1 80d940b01c28e3933b9d68b3e567adc2bac1289f
SHA256 e64811c3e57476bb644539824034cabe2cabcb88941122193e2af328f5eb2133
SHA512 86767aa3c0eec425b7c6dbfd70a4a334fb5b1227c05fb06fbb3845e7b6974008386276f441c8e66e2bf9b0ae0a76133c4e5602211788cd702eaeadd12c5ff757

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bd5940f08d0be56e65e5f2aaf47c538e
SHA1 d7e31b87866e5e383ab5499da64aba50f03e8443
SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512 c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 36455a414cafd0223559de96dcb7fdbe
SHA1 813061b6e47fe6677e76fe42ac61e9e0dac2e5a9
SHA256 d2ab867913c74f4a79b436bb581a410419fd922a48555a1bd805e8422c2f509e
SHA512 c44ecb966c129385418a8ccff5aa84e838de75e18510eff440d457bce30780a4bd5206936ae45cf605ab4251ba096017baf007e13ac666ffa7be0a44ea5ae571

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 81c7fe02d29592e5ae2ce1e8e279add9
SHA1 daa2a8d6e1c994b2bc4a302bbc66c1bd7f5cda3f
SHA256 464e66ca7a5e6f88a5aeb341071e33f35a2b716179e890ed034e7125b73992ff
SHA512 c7c61b7dfa2cb98da502d7608280f2b03482553674dfd572356b5df47eb19e9b7193fee12a06cd801c4dcdbe871b45f19ea44ef045e163be4a12420b05686853

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3a6bad9528f8e23fb5c77fbd81fa28e8
SHA1 f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512 846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

memory/3268-125-0x0000000010000000-0x0000000010007000-memory.dmp

memory/3716-131-0x0000000010000000-0x000000001001E000-memory.dmp

memory/3268-134-0x00000000021A0000-0x00000000021CC000-memory.dmp

memory/3268-132-0x0000000002FD0000-0x000000000308E000-memory.dmp

memory/3268-133-0x0000000003090000-0x0000000003359000-memory.dmp

memory/4904-239-0x00000204A56D0000-0x00000204A56EC000-memory.dmp

memory/4904-240-0x00000204A7A90000-0x00000204A7B45000-memory.dmp

memory/4904-259-0x00000204A56F0000-0x00000204A56FA000-memory.dmp

memory/4904-278-0x00000204A7CB0000-0x00000204A7CCC000-memory.dmp

memory/4664-324-0x00000220DA870000-0x00000220DA87A000-memory.dmp

memory/4904-325-0x00000204A7CD0000-0x00000204A7CEA000-memory.dmp

memory/4904-326-0x00000204A7C90000-0x00000204A7C98000-memory.dmp

memory/4664-327-0x00000220DA8B0000-0x00000220DA8B6000-memory.dmp

memory/4904-328-0x00000204A7CF0000-0x00000204A7CFA000-memory.dmp

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 b42c70c1dbf0d1d477ec86902db9e986
SHA1 1d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA256 8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
SHA512 57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

memory/3148-340-0x0000000010000000-0x000000001001E000-memory.dmp

memory/4808-344-0x0000000001D30000-0x0000000001FF9000-memory.dmp

memory/4808-343-0x0000000001C70000-0x0000000001D2E000-memory.dmp

memory/3148-360-0x0000000010000000-0x000000001001E000-memory.dmp