Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 01:14
Static task
static1
Behavioral task
behavioral1
Sample
01a4355298023c35423d92d98380730c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
01a4355298023c35423d92d98380730c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
01a4355298023c35423d92d98380730c_JaffaCakes118.exe
-
Size
13KB
-
MD5
01a4355298023c35423d92d98380730c
-
SHA1
489fd8014d23722871bf82739362657e69fb5642
-
SHA256
349225d232f24526c0b83d25f9e026c0da9b30868178989a790424717420a27d
-
SHA512
f1001149b5431905691267d1def21709229b60edf4e261199ffdc6dee93bea30a494d1f0b3baf6209efa0591f479a3261e6f5e3ecd9bdb537c5acfc8dfb96e4a
-
SSDEEP
384:RtHbNKJ4mD2B6FrXqFio/eUBBUWUXmxgYbRo0Pkte:Rt24O2B67o/ZUWcmRZMM
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2648 cmd.exe -
Executes dropped EXE 64 IoCs
pid Process 2264 kawdcaz.exe 2640 kawdcaz.exe 2612 kawdcaz.exe 2304 kawdcaz.exe 2868 kawdcaz.exe 1976 kawdcaz.exe 2680 kawdcaz.exe 776 kawdcaz.exe 2916 kawdcaz.exe 2128 kawdcaz.exe 1780 kawdcaz.exe 768 kawdcaz.exe 992 kawdcaz.exe 1988 kawdcaz.exe 1724 kawdcaz.exe 2336 kawdcaz.exe 2556 kawdcaz.exe 3008 kawdcaz.exe 2808 kawdcaz.exe 2992 kawdcaz.exe 1668 kawdcaz.exe 2832 kawdcaz.exe 1512 kawdcaz.exe 2308 kawdcaz.exe 880 kawdcaz.exe 632 kawdcaz.exe 2916 kawdcaz.exe 2888 kawdcaz.exe 1956 kawdcaz.exe 996 kawdcaz.exe 2020 kawdcaz.exe 2140 kawdcaz.exe 1824 kawdcaz.exe 1580 kawdcaz.exe 2572 kawdcaz.exe 2616 kawdcaz.exe 2516 kawdcaz.exe 2828 kawdcaz.exe 1984 kawdcaz.exe 664 kawdcaz.exe 2968 kawdcaz.exe 1964 kawdcaz.exe 3036 kawdcaz.exe 2276 kawdcaz.exe 1196 kawdcaz.exe 2284 kawdcaz.exe 1860 kawdcaz.exe 1956 kawdcaz.exe 1812 kawdcaz.exe 1632 kawdcaz.exe 564 kawdcaz.exe 1764 kawdcaz.exe 2728 kawdcaz.exe 2508 kawdcaz.exe 2440 kawdcaz.exe 1792 kawdcaz.exe 2860 kawdcaz.exe 2212 kawdcaz.exe 2548 kawdcaz.exe 1964 kawdcaz.exe 948 kawdcaz.exe 1100 kawdcaz.exe 1196 kawdcaz.exe 2100 kawdcaz.exe -
Loads dropped DLL 64 IoCs
pid Process 1816 cmd.exe 1816 cmd.exe 2664 cmd.exe 2664 cmd.exe 2464 cmd.exe 2464 cmd.exe 2996 cmd.exe 2996 cmd.exe 2832 cmd.exe 2832 cmd.exe 1784 cmd.exe 1784 cmd.exe 2788 cmd.exe 2788 cmd.exe 632 cmd.exe 632 cmd.exe 2064 cmd.exe 2064 cmd.exe 596 cmd.exe 596 cmd.exe 2076 cmd.exe 2076 cmd.exe 2400 cmd.exe 2400 cmd.exe 616 cmd.exe 616 cmd.exe 2956 cmd.exe 2956 cmd.exe 1932 cmd.exe 1932 cmd.exe 2668 cmd.exe 2668 cmd.exe 2616 cmd.exe 2616 cmd.exe 2516 cmd.exe 2516 cmd.exe 2796 cmd.exe 2796 cmd.exe 2984 cmd.exe 2984 cmd.exe 3068 cmd.exe 3068 cmd.exe 2968 cmd.exe 2968 cmd.exe 1964 cmd.exe 1964 cmd.exe 2096 cmd.exe 2096 cmd.exe 2760 cmd.exe 2760 cmd.exe 1796 cmd.exe 1796 cmd.exe 1272 cmd.exe 1272 cmd.exe 1860 cmd.exe 1860 cmd.exe 1636 cmd.exe 1636 cmd.exe 1812 cmd.exe 1812 cmd.exe 1632 cmd.exe 1632 cmd.exe 564 cmd.exe 564 cmd.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2088 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 2088 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 2264 kawdcaz.exe 2264 kawdcaz.exe 2640 kawdcaz.exe 2640 kawdcaz.exe 2612 kawdcaz.exe 2612 kawdcaz.exe 2304 kawdcaz.exe 2304 kawdcaz.exe 2868 kawdcaz.exe 2868 kawdcaz.exe 1976 kawdcaz.exe 1976 kawdcaz.exe 2680 kawdcaz.exe 2680 kawdcaz.exe 776 kawdcaz.exe 776 kawdcaz.exe 2916 kawdcaz.exe 2916 kawdcaz.exe 2128 kawdcaz.exe 2128 kawdcaz.exe 1780 kawdcaz.exe 1780 kawdcaz.exe 768 kawdcaz.exe 768 kawdcaz.exe 992 kawdcaz.exe 992 kawdcaz.exe 1988 kawdcaz.exe 1988 kawdcaz.exe 1724 kawdcaz.exe 1724 kawdcaz.exe 2336 kawdcaz.exe 2336 kawdcaz.exe 2556 kawdcaz.exe 2556 kawdcaz.exe 3008 kawdcaz.exe 3008 kawdcaz.exe 2808 kawdcaz.exe 2808 kawdcaz.exe 2992 kawdcaz.exe 2992 kawdcaz.exe 1668 kawdcaz.exe 1668 kawdcaz.exe 2832 kawdcaz.exe 2832 kawdcaz.exe 1512 kawdcaz.exe 1512 kawdcaz.exe 2308 kawdcaz.exe 2308 kawdcaz.exe 880 kawdcaz.exe 880 kawdcaz.exe 632 kawdcaz.exe 632 kawdcaz.exe 2916 kawdcaz.exe 2916 kawdcaz.exe 2888 kawdcaz.exe 2888 kawdcaz.exe 1956 kawdcaz.exe 1956 kawdcaz.exe 996 kawdcaz.exe 996 kawdcaz.exe 2020 kawdcaz.exe 2020 kawdcaz.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 1816 2088 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 28 PID 2088 wrote to memory of 1816 2088 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 28 PID 2088 wrote to memory of 1816 2088 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 28 PID 2088 wrote to memory of 1816 2088 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 28 PID 1816 wrote to memory of 2264 1816 cmd.exe 30 PID 1816 wrote to memory of 2264 1816 cmd.exe 30 PID 1816 wrote to memory of 2264 1816 cmd.exe 30 PID 1816 wrote to memory of 2264 1816 cmd.exe 30 PID 2264 wrote to memory of 2664 2264 kawdcaz.exe 31 PID 2264 wrote to memory of 2664 2264 kawdcaz.exe 31 PID 2264 wrote to memory of 2664 2264 kawdcaz.exe 31 PID 2264 wrote to memory of 2664 2264 kawdcaz.exe 31 PID 2664 wrote to memory of 2640 2664 cmd.exe 33 PID 2664 wrote to memory of 2640 2664 cmd.exe 33 PID 2664 wrote to memory of 2640 2664 cmd.exe 33 PID 2664 wrote to memory of 2640 2664 cmd.exe 33 PID 2088 wrote to memory of 2648 2088 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 34 PID 2088 wrote to memory of 2648 2088 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 34 PID 2088 wrote to memory of 2648 2088 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 34 PID 2088 wrote to memory of 2648 2088 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 34 PID 2640 wrote to memory of 2464 2640 kawdcaz.exe 36 PID 2640 wrote to memory of 2464 2640 kawdcaz.exe 36 PID 2640 wrote to memory of 2464 2640 kawdcaz.exe 36 PID 2640 wrote to memory of 2464 2640 kawdcaz.exe 36 PID 2464 wrote to memory of 2612 2464 cmd.exe 38 PID 2464 wrote to memory of 2612 2464 cmd.exe 38 PID 2464 wrote to memory of 2612 2464 cmd.exe 38 PID 2464 wrote to memory of 2612 2464 cmd.exe 38 PID 2264 wrote to memory of 2436 2264 kawdcaz.exe 39 PID 2264 wrote to memory of 2436 2264 kawdcaz.exe 39 PID 2264 wrote to memory of 2436 2264 kawdcaz.exe 39 PID 2264 wrote to memory of 2436 2264 kawdcaz.exe 39 PID 2612 wrote to memory of 2996 2612 kawdcaz.exe 41 PID 2612 wrote to memory of 2996 2612 kawdcaz.exe 41 PID 2612 wrote to memory of 2996 2612 kawdcaz.exe 41 PID 2612 wrote to memory of 2996 2612 kawdcaz.exe 41 PID 2996 wrote to memory of 2304 2996 cmd.exe 43 PID 2996 wrote to memory of 2304 2996 cmd.exe 43 PID 2996 wrote to memory of 2304 2996 cmd.exe 43 PID 2996 wrote to memory of 2304 2996 cmd.exe 43 PID 2640 wrote to memory of 1660 2640 kawdcaz.exe 44 PID 2640 wrote to memory of 1660 2640 kawdcaz.exe 44 PID 2640 wrote to memory of 1660 2640 kawdcaz.exe 44 PID 2640 wrote to memory of 1660 2640 kawdcaz.exe 44 PID 2304 wrote to memory of 2832 2304 kawdcaz.exe 46 PID 2304 wrote to memory of 2832 2304 kawdcaz.exe 46 PID 2304 wrote to memory of 2832 2304 kawdcaz.exe 46 PID 2304 wrote to memory of 2832 2304 kawdcaz.exe 46 PID 2832 wrote to memory of 2868 2832 cmd.exe 48 PID 2832 wrote to memory of 2868 2832 cmd.exe 48 PID 2832 wrote to memory of 2868 2832 cmd.exe 48 PID 2832 wrote to memory of 2868 2832 cmd.exe 48 PID 2612 wrote to memory of 2976 2612 kawdcaz.exe 49 PID 2612 wrote to memory of 2976 2612 kawdcaz.exe 49 PID 2612 wrote to memory of 2976 2612 kawdcaz.exe 49 PID 2612 wrote to memory of 2976 2612 kawdcaz.exe 49 PID 2868 wrote to memory of 1784 2868 kawdcaz.exe 51 PID 2868 wrote to memory of 1784 2868 kawdcaz.exe 51 PID 2868 wrote to memory of 1784 2868 kawdcaz.exe 51 PID 2868 wrote to memory of 1784 2868 kawdcaz.exe 51 PID 1784 wrote to memory of 1976 1784 cmd.exe 53 PID 1784 wrote to memory of 1976 1784 cmd.exe 53 PID 1784 wrote to memory of 1976 1784 cmd.exe 53 PID 1784 wrote to memory of 1976 1784 cmd.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\01a4355298023c35423d92d98380730c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\01a4355298023c35423d92d98380730c_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp232A.bat2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp2655.bat4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp2942.bat6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp2C4E.bat8⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp2F4A.bat10⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp3247.bat12⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1976 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp3524.bat14⤵
- Loads dropped DLL
PID:2788 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2680 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp3830.bat16⤵
- Loads dropped DLL
PID:632 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:776 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp3B0D.bat18⤵
- Loads dropped DLL
PID:2064 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2916 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp3E19.bat20⤵
- Loads dropped DLL
PID:596 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2128 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp4106.bat22⤵
- Loads dropped DLL
PID:2076 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1780 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp4412.bat24⤵
- Loads dropped DLL
PID:2400 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:768 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp470E.bat26⤵
- Loads dropped DLL
PID:616 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:992 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp4A0B.bat28⤵
- Loads dropped DLL
PID:2956 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1988 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp4CF8.bat30⤵
- Loads dropped DLL
PID:1932 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1724 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp5013.bat32⤵
- Loads dropped DLL
PID:2668 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2336 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp5300.bat34⤵
- Loads dropped DLL
PID:2616 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2556 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp55ED.bat36⤵
- Loads dropped DLL
PID:2516 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3008 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp58CA.bat38⤵
- Loads dropped DLL
PID:2796 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2808 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp5BB7.bat40⤵
- Loads dropped DLL
PID:2984 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2992 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp5E94.bat42⤵
- Loads dropped DLL
PID:3068 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1668 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp6190.bat44⤵
- Loads dropped DLL
PID:2968 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2832 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp646E.bat46⤵
- Loads dropped DLL
PID:1964 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1512 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp676A.bat48⤵
- Loads dropped DLL
PID:2096 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2308 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp6A47.bat50⤵
- Loads dropped DLL
PID:2760 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:880 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp6D44.bat52⤵
- Loads dropped DLL
PID:1796 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:632 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp7031.bat54⤵
- Loads dropped DLL
PID:1272 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2916 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp733D.bat56⤵
- Loads dropped DLL
PID:1860 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2888 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp7629.bat58⤵
- Loads dropped DLL
PID:1636 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1956 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp7916.bat60⤵
- Loads dropped DLL
PID:1812 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:996 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp7BF3.bat62⤵
- Loads dropped DLL
PID:1632 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2020 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp7EFF.bat64⤵
- Loads dropped DLL
PID:564 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"65⤵
- Executes dropped EXE
PID:2140 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp81EC.bat66⤵PID:1764
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1824 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp84D9.bat68⤵PID:1948
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"69⤵
- Executes dropped EXE
PID:1580 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp87B6.bat70⤵PID:2508
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"71⤵
- Executes dropped EXE
PID:2572 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp8AB3.bat72⤵PID:2804
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"73⤵
- Executes dropped EXE
PID:2616 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp8D90.bat74⤵PID:2692
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"75⤵
- Executes dropped EXE
PID:2516 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp908C.bat76⤵PID:3000
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"77⤵
- Executes dropped EXE
PID:2828 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp9369.bat78⤵PID:600
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"79⤵
- Executes dropped EXE
PID:1984 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp9666.bat80⤵PID:1700
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"81⤵
- Executes dropped EXE
PID:664 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp9962.bat82⤵PID:3028
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"83⤵
- Executes dropped EXE
PID:2968 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp9C5F.bat84⤵PID:676
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"85⤵
- Executes dropped EXE
PID:1964 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmp9F3C.bat86⤵PID:776
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"87⤵
- Executes dropped EXE
PID:3036 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpA238.bat88⤵PID:1084
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"89⤵
- Executes dropped EXE
PID:2276 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpA515.bat90⤵PID:1532
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"91⤵
- Executes dropped EXE
PID:1196 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpA812.bat92⤵PID:2064
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"93⤵
- Executes dropped EXE
PID:2284 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpAAFF.bat94⤵PID:1308
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1860 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpADFB.bat96⤵PID:1952
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"97⤵
- Executes dropped EXE
PID:1956 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpB0D8.bat98⤵PID:2300
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"99⤵
- Executes dropped EXE
PID:1812 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpB3D5.bat100⤵PID:2356
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"101⤵
- Executes dropped EXE
PID:1632 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpB6C1.bat102⤵PID:1592
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"103⤵
- Executes dropped EXE
PID:564 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpB9BE.bat104⤵PID:2668
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"105⤵
- Executes dropped EXE
PID:1764 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpBC9B.bat106⤵PID:2556
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2728 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpBF97.bat108⤵PID:1652
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"109⤵
- Executes dropped EXE
PID:2508 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpC275.bat110⤵PID:2816
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"111⤵
- Executes dropped EXE
PID:2440 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpC581.bat112⤵PID:2516
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"113⤵
- Executes dropped EXE
PID:1792 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpC85E.bat114⤵PID:2820
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"115⤵
- Executes dropped EXE
PID:2860 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpCB5A.bat116⤵PID:1912
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"117⤵
- Executes dropped EXE
PID:2212 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpCE47.bat118⤵PID:1108
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"119⤵
- Executes dropped EXE
PID:2548 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpD153.bat120⤵PID:960
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1964 -
C:\WINDOWS\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tmpD440.bat122⤵PID:1608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-