Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 01:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01a4355298023c35423d92d98380730c_JaffaCakes118.exe
Resource
win7-20240221-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
01a4355298023c35423d92d98380730c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
4 signatures
150 seconds
General
-
Target
01a4355298023c35423d92d98380730c_JaffaCakes118.exe
-
Size
13KB
-
MD5
01a4355298023c35423d92d98380730c
-
SHA1
489fd8014d23722871bf82739362657e69fb5642
-
SHA256
349225d232f24526c0b83d25f9e026c0da9b30868178989a790424717420a27d
-
SHA512
f1001149b5431905691267d1def21709229b60edf4e261199ffdc6dee93bea30a494d1f0b3baf6209efa0591f479a3261e6f5e3ecd9bdb537c5acfc8dfb96e4a
-
SSDEEP
384:RtHbNKJ4mD2B6FrXqFio/eUBBUWUXmxgYbRo0Pkte:Rt24O2B67o/ZUWcmRZMM
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3516 kawdcaz.exe 4752 kawdcaz.exe 3964 kawdcaz.exe 4092 kawdcaz.exe 1568 kawdcaz.exe 5036 kawdcaz.exe 556 kawdcaz.exe 2444 kawdcaz.exe 1368 kawdcaz.exe 4456 kawdcaz.exe 808 kawdcaz.exe 4692 kawdcaz.exe 4768 kawdcaz.exe 3320 kawdcaz.exe 3496 kawdcaz.exe 1948 kawdcaz.exe 208 kawdcaz.exe 4504 kawdcaz.exe 4328 kawdcaz.exe 4116 kawdcaz.exe 3988 kawdcaz.exe 2464 kawdcaz.exe 3856 kawdcaz.exe 1800 kawdcaz.exe 1880 kawdcaz.exe 4464 kawdcaz.exe 1084 kawdcaz.exe 5048 kawdcaz.exe 4536 kawdcaz.exe 1720 kawdcaz.exe 2388 kawdcaz.exe 4504 kawdcaz.exe 2600 kawdcaz.exe 1032 kawdcaz.exe 3032 kawdcaz.exe 2012 kawdcaz.exe 2624 kawdcaz.exe 4780 kawdcaz.exe 2328 kawdcaz.exe 212 kawdcaz.exe 4148 kawdcaz.exe 4732 kawdcaz.exe 2672 kawdcaz.exe 912 kawdcaz.exe 872 kawdcaz.exe 1504 kawdcaz.exe 2480 kawdcaz.exe 4876 kawdcaz.exe 3092 kawdcaz.exe 2284 kawdcaz.exe 4620 kawdcaz.exe 4184 kawdcaz.exe 4272 kawdcaz.exe 4976 kawdcaz.exe 4056 kawdcaz.exe 4372 kawdcaz.exe 3588 kawdcaz.exe 4116 kawdcaz.exe 3988 kawdcaz.exe 4532 kawdcaz.exe 3892 kawdcaz.exe 5000 kawdcaz.exe 64 kawdcaz.exe 4320 kawdcaz.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File created C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe File opened for modification C:\WINDOWS\SysWOW64\kawdcaz.exe kawdcaz.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3320 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 3320 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 3320 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 3320 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 3516 kawdcaz.exe 3516 kawdcaz.exe 3516 kawdcaz.exe 3516 kawdcaz.exe 4752 kawdcaz.exe 4752 kawdcaz.exe 4752 kawdcaz.exe 4752 kawdcaz.exe 3964 kawdcaz.exe 3964 kawdcaz.exe 3964 kawdcaz.exe 3964 kawdcaz.exe 4092 kawdcaz.exe 4092 kawdcaz.exe 4092 kawdcaz.exe 4092 kawdcaz.exe 1568 kawdcaz.exe 1568 kawdcaz.exe 1568 kawdcaz.exe 1568 kawdcaz.exe 5036 kawdcaz.exe 5036 kawdcaz.exe 5036 kawdcaz.exe 5036 kawdcaz.exe 556 kawdcaz.exe 556 kawdcaz.exe 556 kawdcaz.exe 556 kawdcaz.exe 2444 kawdcaz.exe 2444 kawdcaz.exe 2444 kawdcaz.exe 2444 kawdcaz.exe 1368 kawdcaz.exe 1368 kawdcaz.exe 1368 kawdcaz.exe 1368 kawdcaz.exe 4456 kawdcaz.exe 4456 kawdcaz.exe 4456 kawdcaz.exe 4456 kawdcaz.exe 808 kawdcaz.exe 808 kawdcaz.exe 808 kawdcaz.exe 808 kawdcaz.exe 4692 kawdcaz.exe 4692 kawdcaz.exe 4692 kawdcaz.exe 4692 kawdcaz.exe 4768 kawdcaz.exe 4768 kawdcaz.exe 4768 kawdcaz.exe 4768 kawdcaz.exe 3320 kawdcaz.exe 3320 kawdcaz.exe 3320 kawdcaz.exe 3320 kawdcaz.exe 3496 kawdcaz.exe 3496 kawdcaz.exe 3496 kawdcaz.exe 3496 kawdcaz.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3320 wrote to memory of 3672 3320 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 84 PID 3320 wrote to memory of 3672 3320 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 84 PID 3320 wrote to memory of 3672 3320 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 84 PID 3672 wrote to memory of 3516 3672 cmd.exe 86 PID 3672 wrote to memory of 3516 3672 cmd.exe 86 PID 3672 wrote to memory of 3516 3672 cmd.exe 86 PID 3516 wrote to memory of 4712 3516 kawdcaz.exe 87 PID 3516 wrote to memory of 4712 3516 kawdcaz.exe 87 PID 3516 wrote to memory of 4712 3516 kawdcaz.exe 87 PID 4712 wrote to memory of 4752 4712 cmd.exe 89 PID 4712 wrote to memory of 4752 4712 cmd.exe 89 PID 4712 wrote to memory of 4752 4712 cmd.exe 89 PID 3320 wrote to memory of 2864 3320 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 90 PID 3320 wrote to memory of 2864 3320 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 90 PID 3320 wrote to memory of 2864 3320 01a4355298023c35423d92d98380730c_JaffaCakes118.exe 90 PID 4752 wrote to memory of 2504 4752 kawdcaz.exe 92 PID 4752 wrote to memory of 2504 4752 kawdcaz.exe 92 PID 4752 wrote to memory of 2504 4752 kawdcaz.exe 92 PID 2504 wrote to memory of 3964 2504 cmd.exe 94 PID 2504 wrote to memory of 3964 2504 cmd.exe 94 PID 2504 wrote to memory of 3964 2504 cmd.exe 94 PID 3516 wrote to memory of 2328 3516 kawdcaz.exe 95 PID 3516 wrote to memory of 2328 3516 kawdcaz.exe 95 PID 3516 wrote to memory of 2328 3516 kawdcaz.exe 95 PID 3964 wrote to memory of 3188 3964 kawdcaz.exe 97 PID 3964 wrote to memory of 3188 3964 kawdcaz.exe 97 PID 3964 wrote to memory of 3188 3964 kawdcaz.exe 97 PID 3188 wrote to memory of 4092 3188 cmd.exe 99 PID 3188 wrote to memory of 4092 3188 cmd.exe 99 PID 3188 wrote to memory of 4092 3188 cmd.exe 99 PID 4752 wrote to memory of 4432 4752 kawdcaz.exe 100 PID 4752 wrote to memory of 4432 4752 kawdcaz.exe 100 PID 4752 wrote to memory of 4432 4752 kawdcaz.exe 100 PID 4092 wrote to memory of 780 4092 kawdcaz.exe 102 PID 4092 wrote to memory of 780 4092 kawdcaz.exe 102 PID 4092 wrote to memory of 780 4092 kawdcaz.exe 102 PID 780 wrote to memory of 1568 780 cmd.exe 104 PID 780 wrote to memory of 1568 780 cmd.exe 104 PID 780 wrote to memory of 1568 780 cmd.exe 104 PID 3964 wrote to memory of 1448 3964 kawdcaz.exe 105 PID 3964 wrote to memory of 1448 3964 kawdcaz.exe 105 PID 3964 wrote to memory of 1448 3964 kawdcaz.exe 105 PID 1568 wrote to memory of 216 1568 kawdcaz.exe 107 PID 1568 wrote to memory of 216 1568 kawdcaz.exe 107 PID 1568 wrote to memory of 216 1568 kawdcaz.exe 107 PID 216 wrote to memory of 5036 216 cmd.exe 109 PID 216 wrote to memory of 5036 216 cmd.exe 109 PID 216 wrote to memory of 5036 216 cmd.exe 109 PID 4092 wrote to memory of 540 4092 kawdcaz.exe 110 PID 4092 wrote to memory of 540 4092 kawdcaz.exe 110 PID 4092 wrote to memory of 540 4092 kawdcaz.exe 110 PID 5036 wrote to memory of 1876 5036 kawdcaz.exe 112 PID 5036 wrote to memory of 1876 5036 kawdcaz.exe 112 PID 5036 wrote to memory of 1876 5036 kawdcaz.exe 112 PID 1876 wrote to memory of 556 1876 cmd.exe 114 PID 1876 wrote to memory of 556 1876 cmd.exe 114 PID 1876 wrote to memory of 556 1876 cmd.exe 114 PID 1568 wrote to memory of 3240 1568 kawdcaz.exe 115 PID 1568 wrote to memory of 3240 1568 kawdcaz.exe 115 PID 1568 wrote to memory of 3240 1568 kawdcaz.exe 115 PID 556 wrote to memory of 1272 556 kawdcaz.exe 117 PID 556 wrote to memory of 1272 556 kawdcaz.exe 117 PID 556 wrote to memory of 1272 556 kawdcaz.exe 117 PID 1272 wrote to memory of 2444 1272 cmd.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\01a4355298023c35423d92d98380730c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\01a4355298023c35423d92d98380730c_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp614A.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp6457.bat4⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp6765.bat6⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp6A91.bat8⤵
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp6D8F.bat10⤵
- Suspicious use of WriteProcessMemory
PID:780 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp709C.bat12⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp738A.bat14⤵
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp7678.bat16⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp7966.bat18⤵PID:5020
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp7C64.bat20⤵PID:4312
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp7F52.bat22⤵PID:916
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp825F.bat24⤵PID:3712
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp854D.bat26⤵PID:2276
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp883B.bat28⤵PID:2968
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp8B48.bat30⤵PID:3672
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp8E46.bat32⤵PID:3312
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"33⤵
- Executes dropped EXE
PID:1948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp9143.bat34⤵PID:3928
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"35⤵
- Executes dropped EXE
PID:208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp9460.bat36⤵PID:3188
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"37⤵
- Executes dropped EXE
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp976D.bat38⤵PID:2364
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"39⤵
- Executes dropped EXE
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp9A6B.bat40⤵PID:216
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"41⤵
- Executes dropped EXE
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp9D69.bat42⤵PID:2084
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"43⤵
- Executes dropped EXE
PID:3988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpA066.bat44⤵PID:1636
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"45⤵
- Executes dropped EXE
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpA364.bat46⤵PID:3808
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"47⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpA662.bat48⤵PID:2928
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"49⤵
- Executes dropped EXE
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpA95F.bat50⤵PID:3512
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpAC4D.bat52⤵PID:4280
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpAF3B.bat54⤵PID:2520
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"55⤵
- Executes dropped EXE
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpB248.bat56⤵PID:1968
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"57⤵
- Executes dropped EXE
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpB536.bat58⤵PID:3672
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"59⤵
- Executes dropped EXE
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpB834.bat60⤵PID:2408
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"61⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpBB32.bat62⤵PID:208
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"63⤵
- Executes dropped EXE
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpBE2F.bat64⤵PID:3852
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"65⤵
- Executes dropped EXE
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpC12D.bat66⤵PID:2032
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"67⤵
- Executes dropped EXE
PID:2600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpC41B.bat68⤵PID:4364
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpC709.bat70⤵PID:2936
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpCA16.bat72⤵PID:4456
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"73⤵
- Executes dropped EXE
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpCD23.bat74⤵PID:1956
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpD021.bat76⤵PID:3784
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"77⤵
- Executes dropped EXE
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpD32E.bat78⤵PID:4592
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"79⤵
- Executes dropped EXE
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpD61C.bat80⤵PID:1796
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"81⤵
- Executes dropped EXE
PID:212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpD92A.bat82⤵PID:3836
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpDC46.bat84⤵PID:332
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"85⤵
- Executes dropped EXE
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpDF63.bat86⤵PID:1760
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"87⤵
- Executes dropped EXE
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpE271.bat88⤵PID:5036
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"89⤵
- Executes dropped EXE
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpE58D.bat90⤵PID:4988
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"91⤵
- Executes dropped EXE
PID:872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpE89B.bat92⤵PID:4460
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"93⤵
- Executes dropped EXE
PID:1504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpEBA8.bat94⤵PID:764
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"95⤵
- Executes dropped EXE
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpEEB5.bat96⤵PID:3260
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"97⤵
- Executes dropped EXE
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpF1C2.bat98⤵PID:8
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"99⤵
- Executes dropped EXE
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpF4D0.bat100⤵PID:1508
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"101⤵
- Executes dropped EXE
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpF7DD.bat102⤵PID:3108
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"103⤵
- Executes dropped EXE
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpFADB.bat104⤵PID:980
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"105⤵
- Executes dropped EXE
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpFDC9.bat106⤵PID:3652
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"107⤵
- Executes dropped EXE
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpD6.bat108⤵PID:2520
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp3E3.bat110⤵PID:2300
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp6D1.bat112⤵PID:3992
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"113⤵
- Executes dropped EXE
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp9CF.bat114⤵PID:2536
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpCEC.bat116⤵PID:4084
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmpFDA.bat118⤵PID:4384
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp12E7.bat120⤵PID:2600
-
C:\WINDOWS\SysWOW64\kawdcaz.exe"C:\WINDOWS\system32\kawdcaz.exe"121⤵
- Executes dropped EXE
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp15F4.bat122⤵PID:4876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-