2afdb052c7b5a56cc3f08aec6bd0e1f804a5159632b90f4f2f78c37e58982869

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1689a54427678b399b657ba64b00a4e0_JaffaCakes118.exe
Size

160KB
MD5

1689a54427678b399b657ba64b00a4e0
SHA1

86f701b0d22fabef728209cde970ea3037d16d9f
SHA256

2afdb052c7b5a56cc3f08aec6bd0e1f804a5159632b90f4f2f78c37e58982869
SHA512

2bed0c46da035205e77ba75818fa2c5fb04018c4031c31518c087912d3cda454371e19a45b492aea982585e8e803f89fcb27f04d47a35b4d4e58ead385e3fc9a
SSDEEP

3072:+a8P4alsc4+pfxWN6uc0xBMMA9zyhNu0qCrv:+a8P4al5rujxBMScNCj

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 47 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2536	attrib.exe
2288	attrib.exe
1476	attrib.exe
1596	attrib.exe
1628	attrib.exe
1492	attrib.exe
2848	attrib.exe
804	attrib.exe
1136	attrib.exe
548	attrib.exe
2636	attrib.exe
3052	attrib.exe
2008	attrib.exe
2808	attrib.exe
1688	attrib.exe
2496	attrib.exe
2384	attrib.exe
1044	attrib.exe
2724	attrib.exe
1708	attrib.exe
2468	attrib.exe
2000	attrib.exe
1196	attrib.exe
1080	attrib.exe
2476	attrib.exe
2076	attrib.exe
552	attrib.exe
944	attrib.exe
1224	attrib.exe
1508	attrib.exe
624	attrib.exe
1120	attrib.exe
2752	attrib.exe
2040	attrib.exe
2996	attrib.exe
2560	attrib.exe
1844	attrib.exe
1304	attrib.exe
2188	attrib.exe
760	attrib.exe
2796	attrib.exe
1640	attrib.exe
336	attrib.exe
1292	attrib.exe
1832	attrib.exe
1632	attrib.exe
2160	attrib.exe

Deletes itself 1 IoCs

pid	Process
2140	cmd.exe

Executes dropped EXE 47 IoCs

pid	Process
2704	IEXPL0RE.exe
2720	IEXPL0RE.exe
2188	IEXPL0RE.exe
2852	IEXPL0RE.exe
2236	IEXPL0RE.exe
1440	IEXPL0RE.exe
820	IEXPL0RE.exe
568	IEXPL0RE.exe
2372	IEXPL0RE.exe
1852	IEXPL0RE.exe
2380	IEXPL0RE.exe
1052	IEXPL0RE.exe
2632	IEXPL0RE.exe
2928	IEXPL0RE.exe
2352	IEXPL0RE.exe
2952	IEXPL0RE.exe
344	IEXPL0RE.exe
624	IEXPL0RE.exe
1272	IEXPL0RE.exe
1900	IEXPL0RE.exe
568	IEXPL0RE.exe
1764	IEXPL0RE.exe
2916	IEXPL0RE.exe
2036	IEXPL0RE.exe
2376	IEXPL0RE.exe
2796	IEXPL0RE.exe
2276	IEXPL0RE.exe
2528	IEXPL0RE.exe
2800	IEXPL0RE.exe
2952	IEXPL0RE.exe
1928	IEXPL0RE.exe
2460	IEXPL0RE.exe
1752	IEXPL0RE.exe
2480	IEXPL0RE.exe
1624	IEXPL0RE.exe
772	IEXPL0RE.exe
2888	IEXPL0RE.exe
1232	IEXPL0RE.exe
2992	IEXPL0RE.exe
1424	IEXPL0RE.exe
2696	IEXPL0RE.exe
2264	IEXPL0RE.exe
2716	IEXPL0RE.exe
2956	IEXPL0RE.exe
2392	IEXPL0RE.exe
2396	IEXPL0RE.exe
2820	IEXPL0RE.exe

Loads dropped DLL 64 IoCs

pid	Process
2140	cmd.exe
2140	cmd.exe
2608	cmd.exe
2608	cmd.exe
2616	cmd.exe
2616	cmd.exe
348	cmd.exe
348	cmd.exe
1700	cmd.exe
1700	cmd.exe
1600	cmd.exe
1600	cmd.exe
2056	cmd.exe
2056	cmd.exe
1080	cmd.exe
1080	cmd.exe
1780	cmd.exe
1780	cmd.exe
684	cmd.exe
684	cmd.exe
844	cmd.exe
844	cmd.exe
2376	cmd.exe
2376	cmd.exe
2224	cmd.exe
2224	cmd.exe
2692	cmd.exe
2692	cmd.exe
2884	cmd.exe
2884	cmd.exe
2784	cmd.exe
2784	cmd.exe
2856	cmd.exe
2856	cmd.exe
1552	cmd.exe
1552	cmd.exe
1372	cmd.exe
1372	cmd.exe
2064	cmd.exe
2064	cmd.exe
668	cmd.exe
668	cmd.exe
764	cmd.exe
764	cmd.exe
1788	cmd.exe
1788	cmd.exe
1336	cmd.exe
1336	cmd.exe
284	cmd.exe
284	cmd.exe
1576	cmd.exe
1576	cmd.exe
2020	cmd.exe
2020	cmd.exe
2788	cmd.exe
2788	cmd.exe
2884	cmd.exe
2884	cmd.exe
2864	cmd.exe
2864	cmd.exe
1968	cmd.exe
1968	cmd.exe
2768	cmd.exe
2768	cmd.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	cmd.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File created	C:\Windows\SysWOW64\705.5475.bat	1689a54427678b399b657ba64b00a4e0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File created	C:\Windows\SysWOW64\IEXPL0RE.exe	cmd.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\IEXPL0RE.exe	attrib.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe
File created	C:\Windows\SysWOW64\705.5475.bat	IEXPL0RE.exe

Runs ping.exe 1 TTPs 48 IoCs

Remote System Discovery

T1018

pid	Process
2732	PING.EXE
2668	PING.EXE
1440	PING.EXE
2536	PING.EXE
2968	PING.EXE
2776	PING.EXE
2804	PING.EXE
1652	PING.EXE
624	PING.EXE
2424	PING.EXE
2936	PING.EXE
2068	PING.EXE
884	PING.EXE
2268	PING.EXE
2632	PING.EXE
2692	PING.EXE
2608	PING.EXE
264	PING.EXE
2000	PING.EXE
764	PING.EXE
2820	PING.EXE
1912	PING.EXE
2416	PING.EXE
2516	PING.EXE
1792	PING.EXE
2148	PING.EXE
1784	PING.EXE
2912	PING.EXE
304	PING.EXE
2812	PING.EXE
2760	PING.EXE
1936	PING.EXE
2212	PING.EXE
1616	PING.EXE
1072	PING.EXE
1656	PING.EXE
1728	PING.EXE
1464	PING.EXE
1704	PING.EXE
2476	PING.EXE
1488	PING.EXE
2140	PING.EXE
1968	PING.EXE
2484	PING.EXE
1532	PING.EXE
2012	PING.EXE
1944	PING.EXE
2812	PING.EXE

Suspicious use of SetWindowsHookEx 48 IoCs

pid	Process
1424	1689a54427678b399b657ba64b00a4e0_JaffaCakes118.exe
2704	IEXPL0RE.exe
2720	IEXPL0RE.exe
2188	IEXPL0RE.exe
2852	IEXPL0RE.exe
2236	IEXPL0RE.exe
1440	IEXPL0RE.exe
820	IEXPL0RE.exe
568	IEXPL0RE.exe
2372	IEXPL0RE.exe
1852	IEXPL0RE.exe
2380	IEXPL0RE.exe
1052	IEXPL0RE.exe
2632	IEXPL0RE.exe
2928	IEXPL0RE.exe
2352	IEXPL0RE.exe
2952	IEXPL0RE.exe
344	IEXPL0RE.exe
624	IEXPL0RE.exe
1272	IEXPL0RE.exe
1900	IEXPL0RE.exe
568	IEXPL0RE.exe
1764	IEXPL0RE.exe
2916	IEXPL0RE.exe
2036	IEXPL0RE.exe
2376	IEXPL0RE.exe
2796	IEXPL0RE.exe
2276	IEXPL0RE.exe
2528	IEXPL0RE.exe
2800	IEXPL0RE.exe
2952	IEXPL0RE.exe
1928	IEXPL0RE.exe
2460	IEXPL0RE.exe
1752	IEXPL0RE.exe
2480	IEXPL0RE.exe
1624	IEXPL0RE.exe
772	IEXPL0RE.exe
2888	IEXPL0RE.exe
1232	IEXPL0RE.exe
2992	IEXPL0RE.exe
1424	IEXPL0RE.exe
2696	IEXPL0RE.exe
2264	IEXPL0RE.exe
2716	IEXPL0RE.exe
2956	IEXPL0RE.exe
2392	IEXPL0RE.exe
2396	IEXPL0RE.exe
2820	IEXPL0RE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 2140	1424	1689a54427678b399b657ba64b00a4e0_JaffaCakes118.exe	28
PID 1424 wrote to memory of 2140	1424	1689a54427678b399b657ba64b00a4e0_JaffaCakes118.exe	28
PID 1424 wrote to memory of 2140	1424	1689a54427678b399b657ba64b00a4e0_JaffaCakes118.exe	28
PID 1424 wrote to memory of 2140	1424	1689a54427678b399b657ba64b00a4e0_JaffaCakes118.exe	28
PID 2140 wrote to memory of 1704	2140	cmd.exe	30
PID 2140 wrote to memory of 1704	2140	cmd.exe	30
PID 2140 wrote to memory of 1704	2140	cmd.exe	30
PID 2140 wrote to memory of 1704	2140	cmd.exe	30
PID 2140 wrote to memory of 3052	2140	cmd.exe	31
PID 2140 wrote to memory of 3052	2140	cmd.exe	31
PID 2140 wrote to memory of 3052	2140	cmd.exe	31
PID 2140 wrote to memory of 3052	2140	cmd.exe	31
PID 2140 wrote to memory of 2704	2140	cmd.exe	32
PID 2140 wrote to memory of 2704	2140	cmd.exe	32
PID 2140 wrote to memory of 2704	2140	cmd.exe	32
PID 2140 wrote to memory of 2704	2140	cmd.exe	32
PID 2704 wrote to memory of 2608	2704	IEXPL0RE.exe	33
PID 2704 wrote to memory of 2608	2704	IEXPL0RE.exe	33
PID 2704 wrote to memory of 2608	2704	IEXPL0RE.exe	33
PID 2704 wrote to memory of 2608	2704	IEXPL0RE.exe	33
PID 2608 wrote to memory of 2760	2608	cmd.exe	35
PID 2608 wrote to memory of 2760	2608	cmd.exe	35
PID 2608 wrote to memory of 2760	2608	cmd.exe	35
PID 2608 wrote to memory of 2760	2608	cmd.exe	35
PID 2608 wrote to memory of 2536	2608	cmd.exe	36
PID 2608 wrote to memory of 2536	2608	cmd.exe	36
PID 2608 wrote to memory of 2536	2608	cmd.exe	36
PID 2608 wrote to memory of 2536	2608	cmd.exe	36
PID 2608 wrote to memory of 2720	2608	cmd.exe	37
PID 2608 wrote to memory of 2720	2608	cmd.exe	37
PID 2608 wrote to memory of 2720	2608	cmd.exe	37
PID 2608 wrote to memory of 2720	2608	cmd.exe	37
PID 2720 wrote to memory of 2616	2720	IEXPL0RE.exe	38
PID 2720 wrote to memory of 2616	2720	IEXPL0RE.exe	38
PID 2720 wrote to memory of 2616	2720	IEXPL0RE.exe	38
PID 2720 wrote to memory of 2616	2720	IEXPL0RE.exe	38
PID 2616 wrote to memory of 2516	2616	cmd.exe	40
PID 2616 wrote to memory of 2516	2616	cmd.exe	40
PID 2616 wrote to memory of 2516	2616	cmd.exe	40
PID 2616 wrote to memory of 2516	2616	cmd.exe	40
PID 2616 wrote to memory of 2288	2616	cmd.exe	41
PID 2616 wrote to memory of 2288	2616	cmd.exe	41
PID 2616 wrote to memory of 2288	2616	cmd.exe	41
PID 2616 wrote to memory of 2288	2616	cmd.exe	41
PID 2616 wrote to memory of 2188	2616	cmd.exe	42
PID 2616 wrote to memory of 2188	2616	cmd.exe	42
PID 2616 wrote to memory of 2188	2616	cmd.exe	42
PID 2616 wrote to memory of 2188	2616	cmd.exe	42
PID 2188 wrote to memory of 348	2188	IEXPL0RE.exe	43
PID 2188 wrote to memory of 348	2188	IEXPL0RE.exe	43
PID 2188 wrote to memory of 348	2188	IEXPL0RE.exe	43
PID 2188 wrote to memory of 348	2188	IEXPL0RE.exe	43
PID 348 wrote to memory of 2804	348	cmd.exe	45
PID 348 wrote to memory of 2804	348	cmd.exe	45
PID 348 wrote to memory of 2804	348	cmd.exe	45
PID 348 wrote to memory of 2804	348	cmd.exe	45
PID 348 wrote to memory of 2808	348	cmd.exe	46
PID 348 wrote to memory of 2808	348	cmd.exe	46
PID 348 wrote to memory of 2808	348	cmd.exe	46
PID 348 wrote to memory of 2808	348	cmd.exe	46
PID 348 wrote to memory of 2852	348	cmd.exe	47
PID 348 wrote to memory of 2852	348	cmd.exe	47
PID 348 wrote to memory of 2852	348	cmd.exe	47
PID 348 wrote to memory of 2852	348	cmd.exe	47

Views/modifies file attributes 1 TTPs 47 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
944	attrib.exe
1708	attrib.exe
2796	attrib.exe
2496	attrib.exe
1044	attrib.exe
1640	attrib.exe
804	attrib.exe
1292	attrib.exe
1476	attrib.exe
2468	attrib.exe
1628	attrib.exe
2476	attrib.exe
2724	attrib.exe
2160	attrib.exe
1596	attrib.exe
2076	attrib.exe
552	attrib.exe
336	attrib.exe
2288	attrib.exe
2808	attrib.exe
760	attrib.exe
1688	attrib.exe
1136	attrib.exe
548	attrib.exe
2636	attrib.exe
1120	attrib.exe
1844	attrib.exe
2000	attrib.exe
1632	attrib.exe
1508	attrib.exe
2536	attrib.exe
624	attrib.exe
1196	attrib.exe
2752	attrib.exe
1080	attrib.exe
2008	attrib.exe
2560	attrib.exe
1492	attrib.exe
2848	attrib.exe
1832	attrib.exe
2040	attrib.exe
1304	attrib.exe
2188	attrib.exe
3052	attrib.exe
2996	attrib.exe
2384	attrib.exe
1224	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1689a54427678b399b657ba64b00a4e0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1689a54427678b399b657ba64b00a4e0_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\705.5475.bat
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1704
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:3052
- - C:\Windows\SysWOW64\IEXPL0RE.exe
    "C:\Windows\system32\IEXPL0RE.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\system32\705.5475.bat
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2608
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        5⤵
        Runs ping.exe
        
        PID:2760
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2536
    - - C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2720
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        6⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        7⤵
        Runs ping.exe
        
        PID:2516
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        7⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2288
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        8⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:348
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        9⤵
        Runs ping.exe
        
        PID:2804
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        9⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2808
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2852
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        10⤵
        Loads dropped DLL
        
        PID:1700
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        11⤵
        Runs ping.exe
        
        PID:1944
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        11⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:760
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2236
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        12⤵
        Loads dropped DLL
        
        PID:1600
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        13⤵
        Runs ping.exe
        
        PID:2476
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        13⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:624
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:1440
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        14⤵
        Loads dropped DLL
        
        PID:2056
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        15⤵
        Runs ping.exe
        
        PID:1792
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        15⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1688
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:820
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        16⤵
        Loads dropped DLL
        
        PID:1080
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        17⤵
        Runs ping.exe
        
        PID:264
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        17⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1476
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        18⤵
        Loads dropped DLL
        
        PID:1780
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        19⤵
        Runs ping.exe
        
        PID:764
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        19⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2468
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2372
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        20⤵
        Loads dropped DLL
        
        PID:684
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        21⤵
        Runs ping.exe
        
        PID:1652
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        21⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1596
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:1852
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        22⤵
        Loads dropped DLL
        
        PID:844
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        23⤵
        Runs ping.exe
        
        PID:2212
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        23⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2008
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2380
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        24⤵
        Loads dropped DLL
        
        PID:2376
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        25⤵
        Runs ping.exe
        
        PID:884
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        25⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2996
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:1052
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        26⤵
        Loads dropped DLL
        
        PID:2224
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        27⤵
        Runs ping.exe
        
        PID:2000
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        27⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2796
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2632
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        28⤵
        Loads dropped DLL
        
        PID:2692
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        29⤵
        Runs ping.exe
        
        PID:2732
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        29⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1120
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2928
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        30⤵
        Loads dropped DLL
        
        PID:2884
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        31⤵
        Runs ping.exe
        
        PID:2668
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        31⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2496
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2352
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        32⤵
        Loads dropped DLL
        
        PID:2784
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        33⤵
        Runs ping.exe
        
        PID:2812
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        33⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2560
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2952
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        34⤵
        Loads dropped DLL
        
        PID:2856
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        35⤵
        Runs ping.exe
        
        PID:1968
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        35⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1628
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:344
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        36⤵
        Loads dropped DLL
        
        PID:1552
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        37⤵
        Runs ping.exe
        
        PID:1616
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        37⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2476
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        38⤵
        Loads dropped DLL
        
        PID:1372
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        39⤵
        Runs ping.exe
        
        PID:1440
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        39⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2076
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:1272
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        40⤵
        Loads dropped DLL
        
        PID:2064
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        41⤵
        Runs ping.exe
        
        PID:2484
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        41⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:552
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:1900
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        42⤵
        Loads dropped DLL
        
        PID:668
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        43⤵
        Runs ping.exe
        
        PID:2268
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        43⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1844
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        44⤵
        Loads dropped DLL
        
        PID:764
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        45⤵
        Runs ping.exe
        
        PID:1072
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        45⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2384
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1764
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        46⤵
        Loads dropped DLL
        
        PID:1788
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        47⤵
        Runs ping.exe
        
        PID:1532
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        47⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1044
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2916
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        48⤵
        Loads dropped DLL
        
        PID:1336
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        49⤵
        Runs ping.exe
        
        PID:1936
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        49⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:944
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2036
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        50⤵
        Loads dropped DLL
        
        PID:284
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        51⤵
        Runs ping.exe
        
        PID:1656
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        51⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1492
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2376
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        52⤵
        Loads dropped DLL
        
        PID:1576
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        53⤵
        Runs ping.exe
        
        PID:2424
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        53⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2000
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        54⤵
        Loads dropped DLL
        
        PID:2020
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        55⤵
        Runs ping.exe
        
        PID:2632
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        55⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1196
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2276
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        56⤵
        Loads dropped DLL
        
        PID:2788
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        57⤵
        Runs ping.exe
        
        PID:2536
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        57⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2752
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2528
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        58⤵
        Loads dropped DLL
        
        PID:2884
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        59⤵
        Runs ping.exe
        
        PID:2968
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        59⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1640
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2800
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        60⤵
        Loads dropped DLL
        
        PID:2864
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        61⤵
        Runs ping.exe
        
        PID:1784
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        61⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2848
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2952
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        62⤵
        Loads dropped DLL
        
        PID:1968
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        63⤵
        Runs ping.exe
        
        PID:2936
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        63⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:804
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:1928
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        64⤵
        Loads dropped DLL
        
        PID:2768
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        65⤵
        Runs ping.exe
        
        PID:1728
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        65⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:336
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2460
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        66⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        67⤵
        Runs ping.exe
        
        PID:2820
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        67⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1292
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        67⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1752
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        68⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        69⤵
        Runs ping.exe
        
        PID:2912
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        69⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1224
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        69⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2480
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        70⤵
        
        PID:984
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        71⤵
        Runs ping.exe
        
        PID:1464
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        71⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1080
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        71⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        72⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        73⤵
        Runs ping.exe
        
        PID:1912
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        73⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1832
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        73⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:772
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        74⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        75⤵
        Runs ping.exe
        
        PID:304
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        75⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2040
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        75⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2888
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        76⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        77⤵
        Runs ping.exe
        
        PID:2148
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        77⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1136
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        77⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:1232
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        78⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        79⤵
        Runs ping.exe
        
        PID:1488
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        79⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1304
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        79⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2992
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        80⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        81⤵
        Runs ping.exe
        
        PID:2012
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        81⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2724
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        81⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1424
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        82⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        83⤵
        Runs ping.exe
        
        PID:2140
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        83⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:548
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        83⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2696
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        84⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        85⤵
        Runs ping.exe
        
        PID:2692
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        85⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2636
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        85⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2264
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        86⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        87⤵
        Runs ping.exe
        
        PID:2608
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        87⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2188
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        87⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        88⤵
        
        PID:296
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        89⤵
        Runs ping.exe
        
        PID:2812
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        89⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1708
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        89⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2956
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        90⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        91⤵
        Runs ping.exe
        
        PID:2416
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        91⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1632
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        91⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2392
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        92⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        93⤵
        Runs ping.exe
        
        PID:2776
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        93⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2160
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        93⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2396
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        94⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        95⤵
        Runs ping.exe
        
        PID:624
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\Windows\system32\IEXPL0RE.exe"
        95⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1508
        
        C:\Windows\SysWOW64\IEXPL0RE.exe
        
        "C:\Windows\system32\IEXPL0RE.exe"
        95⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:2820
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\system32\705.5475.bat
        96⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        97⤵
        Runs ping.exe
        
        PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\705.5475.bat

Filesize
340B

MD5
1581043c31a2e6d8a50eb62285e1d4bc

SHA1
510a0b174249d1da45047c4fe91efade903d56da

SHA256
edd8e608a5edd7b56fbde707128b87c7fa0b04d9f8f38defc07d38022ef44721

SHA512
08cb361fe8d3e1d25338c8ed181d03a176b0c9bf8ed1a909c337b55c2b6142723bb64d0f221ae56f48f0d3201e82e0420dea2492a134df2e6daccf80f9c32ee6

Download Submit
C:\Windows\SysWOW64\705.5475.bat

Filesize
236B

MD5
75f2ef66c2d769d2775f09638b443e49

SHA1
cd8f3caac6802a6cb70784ec948771e4cff42c1a

SHA256
41628e165e03a53f057fd1e88524ee47e43c9dc52b51d65db39cfc759d59a9af

SHA512
2c9df606e851133dbec4f408b3b811297fc76117836644d9abf0cb338bea69de1bc926e679dff4886bd459235e073c49e3b968281145e0b33a26e755d8993078

Download Submit
C:\Windows\SysWOW64\IEXPL0RE.exe

Filesize
160KB

MD5
1689a54427678b399b657ba64b00a4e0

SHA1
86f701b0d22fabef728209cde970ea3037d16d9f

SHA256
2afdb052c7b5a56cc3f08aec6bd0e1f804a5159632b90f4f2f78c37e58982869

SHA512
2bed0c46da035205e77ba75818fa2c5fb04018c4031c31518c087912d3cda454371e19a45b492aea982585e8e803f89fcb27f04d47a35b4d4e58ead385e3fc9a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads