4c9f343c4a2278d2ae59e374ee75c58109e1c4b8f6c3ebf481b496811ca1a7f8

Analysis

max time kernel
11s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08-07-2024 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
Size

100KB
MD5

2d9e9be24371572f16ffb9ed1d3bb777
SHA1

6f440788a0fd1927812c7d59a3cb4344d64d6777
SHA256

4c9f343c4a2278d2ae59e374ee75c58109e1c4b8f6c3ebf481b496811ca1a7f8
SHA512

9b11baf53d8420a41e03ec1c90e16970ac6affeb558a919ee30e7a68d809346c972862c813ed8fb67c89e9e1082558eaa099fc230ba0ab74816401e72ccf3cb6
SSDEEP

1536:Z331xdLa+ku3U+f+tzTdK0h+0l6enPRkvGQVgIE:ZnZL3ksjfKcNOLIE

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\ProgramData\\application data\\Microsoft\\Keyboard\\kbdsys.exe\""	winzip.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	winzip.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	winzip.exe

Executes dropped EXE 17 IoCs

pid	Process
3400	winzip.exe
4104	2.exe
1404	winnthlp1.exe
3424	winnthlp2.exe
4696	lsass.exe
3284	2.exe
1712	winnthlp1.exe
4668	winnthlp2.exe
3044	2.exe
1724	winnthlp1.exe
3628	winnthlp2.exe
2712	2.exe
3152	winnthlp1.exe
2800	winnthlp2.exe
464	2.exe
4488	winnthlp1.exe
4468	winnthlp2.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DirLocker = "C:\\ProgramData\\application data\\www.zilch·infinisoft.biz.de\\winzip.exe"	winzip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LSAShell = "C:\\Windows\\lsass.exe"	winzip.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSys = "C:\\Windows\\system.exe"	winzip.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	winzip.exe
File opened (read-only)	\??\P:	winzip.exe
File opened (read-only)	\??\U:	winzip.exe
File opened (read-only)	\??\W:	winzip.exe
File opened (read-only)	\??\Y:	winzip.exe
File opened (read-only)	\??\Z:	winzip.exe
File opened (read-only)	\??\E:	winzip.exe
File opened (read-only)	\??\H:	winzip.exe
File opened (read-only)	\??\K:	winzip.exe
File opened (read-only)	\??\N:	winzip.exe
File opened (read-only)	\??\Q:	winzip.exe
File opened (read-only)	\??\V:	winzip.exe
File opened (read-only)	\??\J:	winzip.exe
File opened (read-only)	\??\M:	winzip.exe
File opened (read-only)	\??\S:	winzip.exe
File opened (read-only)	\??\T:	winzip.exe
File opened (read-only)	\??\G:	winzip.exe
File opened (read-only)	\??\I:	winzip.exe
File opened (read-only)	\??\L:	winzip.exe
File opened (read-only)	\??\R:	winzip.exe
File opened (read-only)	\??\X:	winzip.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	winzip.exe
File opened for modification	F:\autorun.inf	winzip.exe
File created	F:\autorun.inf	winzip.exe
File opened for modification	C:\autorun.inf	winzip.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\fr-CA.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\hr-HR.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\winnthlp1\Do not open - secrets!.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\sr-Latn-RS.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\WCN	winnthlp2.exe
File created	C:\Windows\SysWOW64\el-GR.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\sysprep	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\es-ES.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\de-DE.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\winnthlp1.exe	2.exe
File opened for modification	C:\Windows\SysWOW64\DriverStore	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\winnthlp2.exe	2.exe
File opened for modification	C:\Windows\SysWOW64\AdvancedInstallers	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\Speech_OneCore.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\RasToast	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\slmgr	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\icsxml	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\it-IT	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\Ipmi	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\pt-BR	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\ro-RO.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\DriverStore.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\InstallShield.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\winrm.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicyUsers	winnthlp2.exe
File created	C:\Windows\SysWOW64\sv-SE.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\en-GB.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\Licenses.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\slmgr	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\pt-PT	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\ru-RU.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\wbem.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\icsxml.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\es.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\IME.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\InputMethod	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\Bthprops	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\nl-NL	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\drivers	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\sk-SK.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\da-DK.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\downlevel.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\es-MX.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\Msdtc	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\PerceptionSimulation	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\PerceptionSimulation	winnthlp2.exe
File created	C:\Windows\SysWOW64\sru.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\bg-BG.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\LogFiles.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\migwiz	winnthlp1.exe
File created	C:\Windows\SysWOW64\lv-LV.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\MUI.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\pt-BR.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\winnthlp1.exe	2.exe
File opened for modification	C:\Windows\SysWOW64\icsxml.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\config	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\Bthprops.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\Com.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\cs-CZ.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\InstallShield.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\ras.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\sl-SI.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\slmgr.exe	winnthlp2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Reference Assemblies.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\MSBuild	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Mail.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Do not open - secrets!.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows NT	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows NT.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Services.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Media Player.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\MSBuild.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Java.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Defender.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Defender.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Photo Viewer.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Mail.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Mail	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft.NET.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Defender	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Internet Explorer.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Portable Devices.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Do not open - secrets!.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\System.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Do not open - secrets!.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows NT.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rescache	winnthlp1.exe
File created	C:\Windows\System32.exe	winnthlp1.exe
File opened for modification	C:\Windows\OCR	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64	winnthlp2.exe
File opened for modification	C:\Windows\WinSxS.exe	winnthlp2.exe
File opened for modification	C:\Windows\Boot.exe	winnthlp1.exe
File opened for modification	C:\Windows\shutdown.dll	winnthlp1.exe
File created	C:\Windows\servicing.exe	winnthlp2.exe
File opened for modification	C:\Windows\SystemResources.exe	winnthlp2.exe
File created	C:\Windows\DigitalLocker.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\uk-UA	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\servicing	winnthlp1.exe
File opened for modification	C:\Windows\OCR.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\Boot	winnthlp2.exe
File opened for modification	C:\Windows\servicing	winnthlp1.exe
File created	C:\Windows\WaaS.exe	winnthlp1.exe
File opened for modification	C:\Windows\DigitalLocker	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Windows\SoftwareDistribution.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS.exe	winnthlp2.exe
File opened for modification	C:\Windows\Provisioning	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\shutdown.dll	winnthlp2.exe
File created	C:\Windows\WinSxS.exe	winnthlp1.exe
File opened for modification	C:\Windows\Cursors.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\servicing	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Windows\Boot.exe	winnthlp1.exe
File opened for modification	C:\Windows\servicing	winnthlp2.exe
File opened for modification	C:\Windows\servicing.exe	winnthlp1.exe
File opened for modification	C:\Windows\fr-FR	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\security.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Windows\tracing.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\CSC.exe	winnthlp2.exe
File created	C:\Windows\CSC.exe	winnthlp1.exe
File opened for modification	C:\Windows\schemas.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\WaaS	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Windows\System32.exe	winnthlp1.exe
File opened for modification	C:\Windows\diagnostics.exe	winnthlp1.exe
File created	C:\Windows\servicing.exe	winnthlp2.exe
File created	C:\Windows\de-DE.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\debug.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File created	C:\Windows\ServiceProfiles.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS.exe	winnthlp1.exe
File opened for modification	C:\Windows\ServiceState.exe	winnthlp1.exe
File opened for modification	C:\Windows\servicing.exe	winnthlp1.exe
File opened for modification	C:\Windows\SystemResources	winnthlp1.exe
File opened for modification	C:\Windows\shutdown.dll	winnthlp1.exe
File opened for modification	C:\Windows\servicing	winnthlp2.exe
File opened for modification	C:\Windows\diagnostics.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\TAPI	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\shutdown.dll	winnthlp1.exe
File created	C:\Windows\diagnostics.exe	winnthlp1.exe
File opened for modification	C:\Windows\SystemResources.exe	winnthlp2.exe
File opened for modification	C:\Windows\addins	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\DigitalLocker.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\twain_32	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\rescache	winnthlp1.exe
File created	C:\Windows\ServiceState.exe	winnthlp1.exe
File created	C:\Windows\servicing.exe	winnthlp1.exe
File opened for modification	C:\Windows\system.exe	winnthlp1.exe
File created	C:\Windows\Microsoft.NET.exe	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64	winnthlp1.exe
File opened for modification	C:\Windows\CSC	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
File opened for modification	C:\Windows\Boot	winnthlp2.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = 0000000001000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = 0000000001000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0\NodeSlot = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe

Suspicious behavior: AddClipboardFormatListener 7 IoCs

pid	Process
3880	explorer.exe
5088	explorer.exe
468	explorer.exe
4060	explorer.exe
4068	explorer.exe
4052	explorer.exe
2716	explorer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1040	vssvc.exe
Token: SeRestorePrivilege	1040	vssvc.exe
Token: SeAuditPrivilege	1040	vssvc.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
4820	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
3400	winzip.exe
4104	2.exe
3880	explorer.exe
3880	explorer.exe
1404	winnthlp1.exe
3424	winnthlp2.exe
4696	lsass.exe
5088	explorer.exe
5088	explorer.exe
468	explorer.exe
468	explorer.exe
3284	2.exe
1712	winnthlp1.exe
4668	winnthlp2.exe
3044	2.exe
4060	explorer.exe
4060	explorer.exe
4068	explorer.exe
4068	explorer.exe
1724	winnthlp1.exe
3628	winnthlp2.exe
2712	2.exe
3152	winnthlp1.exe
4052	explorer.exe
4052	explorer.exe
2716	explorer.exe
2716	explorer.exe
2800	winnthlp2.exe
464	2.exe
2592	explorer.exe
2592	explorer.exe
972	explorer.exe
972	explorer.exe
4488	winnthlp1.exe
4468	winnthlp2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 3732	4820	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe	87
PID 4820 wrote to memory of 3732	4820	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe	87
PID 4820 wrote to memory of 3732	4820	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe	87
PID 4820 wrote to memory of 3400	4820	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe	89
PID 4820 wrote to memory of 3400	4820	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe	89
PID 4820 wrote to memory of 3400	4820	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe	89
PID 3400 wrote to memory of 4104	3400	winzip.exe	90
PID 3400 wrote to memory of 4104	3400	winzip.exe	90
PID 3400 wrote to memory of 4104	3400	winzip.exe	90
PID 4104 wrote to memory of 1404	4104	2.exe	91
PID 4104 wrote to memory of 1404	4104	2.exe	91
PID 4104 wrote to memory of 1404	4104	2.exe	91
PID 4104 wrote to memory of 3424	4104	2.exe	92
PID 4104 wrote to memory of 3424	4104	2.exe	92
PID 4104 wrote to memory of 3424	4104	2.exe	92
PID 4820 wrote to memory of 4696	4820	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe	94
PID 4820 wrote to memory of 4696	4820	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe	94
PID 4820 wrote to memory of 4696	4820	2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe	94
PID 1404 wrote to memory of 952	1404	winnthlp1.exe	131
PID 1404 wrote to memory of 952	1404	winnthlp1.exe	131
PID 1404 wrote to memory of 952	1404	winnthlp1.exe	131
PID 3424 wrote to memory of 2740	3424	winnthlp2.exe	96
PID 3424 wrote to memory of 2740	3424	winnthlp2.exe	96
PID 3424 wrote to memory of 2740	3424	winnthlp2.exe	96
PID 4696 wrote to memory of 3284	4696	lsass.exe	102
PID 4696 wrote to memory of 3284	4696	lsass.exe	102
PID 4696 wrote to memory of 3284	4696	lsass.exe	102
PID 3284 wrote to memory of 1712	3284	2.exe	214
PID 3284 wrote to memory of 1712	3284	2.exe	214
PID 3284 wrote to memory of 1712	3284	2.exe	214
PID 3284 wrote to memory of 4668	3284	2.exe	104
PID 3284 wrote to memory of 4668	3284	2.exe	104
PID 3284 wrote to memory of 4668	3284	2.exe	104
PID 1712 wrote to memory of 2696	1712	winnthlp1.exe	105
PID 1712 wrote to memory of 2696	1712	winnthlp1.exe	105
PID 1712 wrote to memory of 2696	1712	winnthlp1.exe	105
PID 4668 wrote to memory of 792	4668	winnthlp2.exe	106
PID 4668 wrote to memory of 792	4668	winnthlp2.exe	106
PID 4668 wrote to memory of 792	4668	winnthlp2.exe	106
PID 4696 wrote to memory of 3044	4696	lsass.exe	137
PID 4696 wrote to memory of 3044	4696	lsass.exe	137
PID 4696 wrote to memory of 3044	4696	lsass.exe	137
PID 3044 wrote to memory of 1724	3044	2.exe	111
PID 3044 wrote to memory of 1724	3044	2.exe	111
PID 3044 wrote to memory of 1724	3044	2.exe	111
PID 3044 wrote to memory of 3628	3044	2.exe	112
PID 3044 wrote to memory of 3628	3044	2.exe	112
PID 3044 wrote to memory of 3628	3044	2.exe	112
PID 1724 wrote to memory of 4984	1724	winnthlp1.exe	126
PID 1724 wrote to memory of 4984	1724	winnthlp1.exe	126
PID 1724 wrote to memory of 4984	1724	winnthlp1.exe	126
PID 3628 wrote to memory of 1280	3628	winnthlp2.exe	115
PID 3628 wrote to memory of 1280	3628	winnthlp2.exe	115
PID 3628 wrote to memory of 1280	3628	winnthlp2.exe	115
PID 4696 wrote to memory of 2712	4696	lsass.exe	118
PID 4696 wrote to memory of 2712	4696	lsass.exe	118
PID 4696 wrote to memory of 2712	4696	lsass.exe	118
PID 2712 wrote to memory of 3152	2712	2.exe	119
PID 2712 wrote to memory of 3152	2712	2.exe	119
PID 2712 wrote to memory of 3152	2712	2.exe	119
PID 2712 wrote to memory of 2800	2712	2.exe	120
PID 2712 wrote to memory of 2800	2712	2.exe	120
PID 2712 wrote to memory of 2800	2712	2.exe	120
PID 3152 wrote to memory of 4124	3152	winnthlp1.exe	141

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d9e9be24371572f16ffb9ed1d3bb777_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\explorer.exe
  explorer C:\Users\Admin\AppData\Local\Temp\2d9e9be24371572f16ffb9ed1d3bb777_jaffacakes118
  2⤵
  PID:3732
- C:\ProgramData\application data\www.zilch·infinisoft.biz.de\winzip.exe
  "C:\ProgramData\application data\www.zilch·infinisoft.biz.de\winzip.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops autorun.inf file
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Users\Admin\AppData\Local\Temp\u8iuvo-u4jj0o-qqb6hs-do3s55-wdnd7l\2.exe
    C:\Users\Admin\AppData\Local\Temp\u8iuvo-u4jj0o-qqb6hs-do3s55-wdnd7l\2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1404
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:952
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3424
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:2740
- - C:\Users\Admin\AppData\Local\Temp\u8c78r-1ynouk-rltt3u-ldw7a0-y2u84n\2.exe
    C:\Users\Admin\AppData\Local\Temp\u8c78r-1ynouk-rltt3u-ldw7a0-y2u84n\2.exe
    3⤵
    PID:3044
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:4664
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4124
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2776
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4672
- - C:\Users\Admin\AppData\Local\Temp\d7qecr-eygcqq-afw9hu-y7d4g5-s5s9dc\2.exe
    C:\Users\Admin\AppData\Local\Temp\d7qecr-eygcqq-afw9hu-y7d4g5-s5s9dc\2.exe
    3⤵
    PID:1668
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:3180
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:384
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:1512
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4400
- - C:\Users\Admin\AppData\Local\Temp\5l27ej-d62yab-d23meb-9pvavg-wnnwks\2.exe
    C:\Users\Admin\AppData\Local\Temp\5l27ej-d62yab-d23meb-9pvavg-wnnwks\2.exe
    3⤵
    PID:1572
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:4324
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:1232
- - C:\Users\Admin\AppData\Local\Temp\umt453-w77bu2-2xisgv-skowq6-mcrbwb\2.exe
    C:\Users\Admin\AppData\Local\Temp\umt453-w77bu2-2xisgv-skowq6-mcrbwb\2.exe
    3⤵
    PID:5204
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5244
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5736
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5328
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5832
- - C:\Users\Admin\AppData\Local\Temp\pojlro-y37lxf-yuxjce-4pjro8-ti0mnk\2.exe
    C:\Users\Admin\AppData\Local\Temp\pojlro-y37lxf-yuxjce-4pjro8-ti0mnk\2.exe
    3⤵
    PID:2180
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:1232
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5660
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5252
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5880
- - C:\Users\Admin\AppData\Local\Temp\e59833-hlcp21-ykirjj-o2c42t-t3a34o\2.exe
    C:\Users\Admin\AppData\Local\Temp\e59833-hlcp21-ykirjj-o2c42t-t3a34o\2.exe
    3⤵
    PID:5356
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5336
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:6060
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5220
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:1200
- - C:\Users\Admin\AppData\Local\Temp\qrf5z1-9fzq0i-lfj8a7-s5uqw0-hs0u5a\2.exe
    C:\Users\Admin\AppData\Local\Temp\qrf5z1-9fzq0i-lfj8a7-s5uqw0-hs0u5a\2.exe
    3⤵
    PID:3132
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5324
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5352
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5220
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5344
- - C:\Users\Admin\AppData\Local\Temp\cdat1v-p28uvi-7w36m0-8ns41z-eifcdt\2.exe
    C:\Users\Admin\AppData\Local\Temp\cdat1v-p28uvi-7w36m0-8ns41z-eifcdt\2.exe
    3⤵
    PID:5232
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:684
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5880
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:1812
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:532
- - C:\Users\Admin\AppData\Local\Temp\bsv29u-va3wka-75co4y-fpce1q-fmd35q\2.exe
    C:\Users\Admin\AppData\Local\Temp\bsv29u-va3wka-75co4y-fpce1q-fmd35q\2.exe
    3⤵
    PID:2064
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6012
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4884
- - C:\Users\Admin\AppData\Local\Temp\akayyv-yi3kn7-h6m5po-jr0cdn-qhbt0g\2.exe
    C:\Users\Admin\AppData\Local\Temp\akayyv-yi3kn7-h6m5po-jr0cdn-qhbt0g\2.exe
    3⤵
    PID:2880
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5952
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3176
- - C:\Users\Admin\AppData\Local\Temp\h5vmpv-cwy1v1-plv2po-7fqdh5-86gbv5\2.exe
    C:\Users\Admin\AppData\Local\Temp\h5vmpv-cwy1v1-plv2po-7fqdh5-86gbv5\2.exe
    3⤵
    PID:6532
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6600
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:6872
- - C:\Users\Admin\AppData\Local\Temp\u25zu5-ivmutg-cs0zpm-om9r9a-w79i52\2.exe
    C:\Users\Admin\AppData\Local\Temp\u25zu5-ivmutg-cs0zpm-om9r9a-w79i52\2.exe
    3⤵
    PID:6656
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6192
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:6532
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6276
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6432
- - C:\Users\Admin\AppData\Local\Temp\mmgedj-i882un-wsucya-pvk8kh-qgyg9f\2.exe
    C:\Users\Admin\AppData\Local\Temp\mmgedj-i882un-wsucya-pvk8kh-qgyg9f\2.exe
    3⤵
    PID:6172
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:1196
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:7132
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6272
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6220
- - C:\Users\Admin\AppData\Local\Temp\pw4ffm-ej9jow-9bcxv2-m0aypp-4u59g6\2.exe
    C:\Users\Admin\AppData\Local\Temp\pw4ffm-ej9jow-9bcxv2-m0aypp-4u59g6\2.exe
    3⤵
    PID:6884
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6536
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4172
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6384
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6936
- - C:\Users\Admin\AppData\Local\Temp\vcp9zz-18bhbt-p0sca4-aj16mk-me9y58\2.exe
    C:\Users\Admin\AppData\Local\Temp\vcp9zz-18bhbt-p0sca4-aj16mk-me9y58\2.exe
    3⤵
    PID:5924
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:3144
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:6560
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6856
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:900
- - C:\Users\Admin\AppData\Local\Temp\5z603y-vh0dm8-1iyco2-f2knsp-yq47u5\2.exe
    C:\Users\Admin\AppData\Local\Temp\5z603y-vh0dm8-1iyco2-f2knsp-yq47u5\2.exe
    3⤵
    PID:6248
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6436
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4708
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6920
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4824
- - C:\Users\Admin\AppData\Local\Temp\uqea5g-1gpsr9-r0b6em-lsellr-yhbmfe\2.exe
    C:\Users\Admin\AppData\Local\Temp\uqea5g-1gpsr9-r0b6em-lsellr-yhbmfe\2.exe
    3⤵
    PID:4992
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5112
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6216
- - C:\Users\Admin\AppData\Local\Temp\q0jdcw-rr8bqw-xnvj2q-c163gb-6yk8dh\2.exe
    C:\Users\Admin\AppData\Local\Temp\q0jdcw-rr8bqw-xnvj2q-c163gb-6yk8dh\2.exe
    3⤵
    PID:2840
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:3944
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5096
- - C:\Users\Admin\AppData\Local\Temp\f2w59w-nmwv5p-nixkap-i5p8rt-63htf6\2.exe
    C:\Users\Admin\AppData\Local\Temp\f2w59w-nmwv5p-nixkap-i5p8rt-63htf6\2.exe
    3⤵
    PID:7600
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7664
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:7960
- - C:\Users\Admin\AppData\Local\Temp\9a0uyv-bve1nt-ilqi9m-hn2y3n-bf5cat\2.exe
    C:\Users\Admin\AppData\Local\Temp\9a0uyv-bve1nt-ilqi9m-hn2y3n-bf5cat\2.exe
    3⤵
    PID:7480
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7524
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:8064
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7376
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:7476
- - C:\Users\Admin\AppData\Local\Temp\a088j3-su3jal-tlshpk-p29ego-evq9f0\2.exe
    C:\Users\Admin\AppData\Local\Temp\a088j3-su3jal-tlshpk-p29ego-evq9f0\2.exe
    3⤵
    PID:6468
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7936
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:8092
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7900
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:7456
- - C:\Users\Admin\AppData\Local\Temp\518jox-8haznv-pgg14d-pchq8d-kz9epi\2.exe
    C:\Users\Admin\AppData\Local\Temp\518jox-8haznv-pgg14d-pchq8d-kz9epi\2.exe
    3⤵
    PID:6872
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8136
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:848
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7968
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:7348
- - C:\Users\Admin\AppData\Local\Temp\2elcc0-vhb8y7-x2pfn5-3s0x9y-tg61j9\2.exe
    C:\Users\Admin\AppData\Local\Temp\2elcc0-vhb8y7-x2pfn5-3s0x9y-tg61j9\2.exe
    3⤵
    PID:7908
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6732
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:8136
- - C:\Users\Admin\AppData\Local\Temp\5iyixc-i8vkrz-11qvih-1sgtwg-7o218a\2.exe
    C:\Users\Admin\AppData\Local\Temp\5iyixc-i8vkrz-11qvih-1sgtwg-7o218a\2.exe
    3⤵
    PID:7948
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7456
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:848
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8000
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5876
- - C:\Users\Admin\AppData\Local\Temp\9eqcup-txy665-5r7yqt-dc7pml-d88dql\2.exe
    C:\Users\Admin\AppData\Local\Temp\9eqcup-txy665-5r7yqt-dc7pml-d88dql\2.exe
    3⤵
    PID:2480
- - C:\Users\Admin\AppData\Local\Temp\5do8vz-sbgukb-c00ems-n0kxvh-uqweha\2.exe
    C:\Users\Admin\AppData\Local\Temp\5do8vz-sbgukb-c00ems-n0kxvh-uqweha\2.exe
    3⤵
    PID:7180
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:4424
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:8260
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5096
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:8712
- - C:\Users\Admin\AppData\Local\Temp\lg0u1y-g84883-tx192q-brwkt8-chli77\2.exe
    C:\Users\Admin\AppData\Local\Temp\lg0u1y-g84883-tx192q-brwkt8-chli77\2.exe
    3⤵
    PID:8964
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:9004
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:8412
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:9064
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:8764
- - C:\Users\Admin\AppData\Local\Temp\uua312-jnry0e-ck53wk-ofevg8-wzeld0\2.exe
    C:\Users\Admin\AppData\Local\Temp\uua312-jnry0e-ck53wk-ofevg8-wzeld0\2.exe
    3⤵
    PID:8844
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8400
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:8956
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8644
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:8420
- - C:\Users\Admin\AppData\Local\Temp\c438w0-7qvve4-vonh2h-ed714x-gyl9tw\2.exe
    C:\Users\Admin\AppData\Local\Temp\c438w0-7qvve4-vonh2h-ed714x-gyl9tw\2.exe
    3⤵
    PID:8640
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8896
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:8696
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:9132
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:8144
- - C:\Users\Admin\AppData\Local\Temp\e57lmu-3tcpv4-ykg32a-lojfhn-t38fne\2.exe
    C:\Users\Admin\AppData\Local\Temp\e57lmu-3tcpv4-ykg32a-lojfhn-t38fne\2.exe
    3⤵
    PID:9420
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:9476
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:9888
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:9528
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:8964
- - C:\Users\Admin\AppData\Local\Temp\q55bj6-w1sjv0-kt9euc-ernjqi-h6q0pg\2.exe
    C:\Users\Admin\AppData\Local\Temp\q55bj6-w1sjv0-kt9euc-ernjqi-h6q0pg\2.exe
    3⤵
    PID:8820
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8640
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:9876
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:9536
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:8464
- - C:\Users\Admin\AppData\Local\Temp\v7iy9h-lpdbsr-qqbaum-49xly8-nyh50p\2.exe
    C:\Users\Admin\AppData\Local\Temp\v7iy9h-lpdbsr-qqbaum-49xly8-nyh50p\2.exe
    3⤵
    PID:9428
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:9436
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:9156
- C:\Windows\lsass.exe
  C:\Windows\lsass.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Users\Admin\AppData\Local\Temp\0yj0ok-0vkosk-whcc9p-jf4yy1-33oizi\2.exe
    C:\Users\Admin\AppData\Local\Temp\0yj0ok-0vkosk-whcc9p-jf4yy1-33oizi\2.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1712
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:2696
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4668
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:792
- - C:\Users\Admin\AppData\Local\Temp\2a1ghw-90cy3q-yoi2d0-tflgk6-64jhdt\2.exe
    C:\Users\Admin\AppData\Local\Temp\2a1ghw-90cy3q-yoi2d0-tflgk6-64jhdt\2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1724
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4984
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3628
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:1280
- - C:\Users\Admin\AppData\Local\Temp\kc34xq-l3s2bp-hk9z3t-6cqt24-0a4zyb\2.exe
    C:\Users\Admin\AppData\Local\Temp\kc34xq-l3s2bp-hk9z3t-6cqt24-0a4zyb\2.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3152
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4124
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2800
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:3720
- - C:\Users\Admin\AppData\Local\Temp\v9wi8q-3tw95i-2pwx9i-ycolqm-lag6fz\2.exe
    C:\Users\Admin\AppData\Local\Temp\v9wi8q-3tw95i-2pwx9i-ycolqm-lag6fz\2.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:464
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4488
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:1004
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4468
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4412
- - C:\Users\Admin\AppData\Local\Temp\qzjb9l-skxiyj-za90kd-oye4tn-jpii0t\2.exe
    C:\Users\Admin\AppData\Local\Temp\qzjb9l-skxiyj-za90kd-oye4tn-jpii0t\2.exe
    3⤵
    PID:3440
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:3348
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4324
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:232
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:1204
- - C:\Users\Admin\AppData\Local\Temp\u676a9-3lv6h0-4cl3vz-a77c7t-y0o765\2.exe
    C:\Users\Admin\AppData\Local\Temp\u676a9-3lv6h0-4cl3vz-a77c7t-y0o765\2.exe
    3⤵
    PID:3944
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2276
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:2992
- - C:\Users\Admin\AppData\Local\Temp\6acjqp-9qezpm-qpk165-g7ffpe-m8der9\2.exe
    C:\Users\Admin\AppData\Local\Temp\6acjqp-9qezpm-qpk165-g7ffpe-m8der9\2.exe
    3⤵
    PID:5280
- - C:\Users\Admin\AppData\Local\Temp\oq3dr6-7fmytn-if6g2c-p5iyp5-fsn2yg\2.exe
    C:\Users\Admin\AppData\Local\Temp\oq3dr6-7fmytn-if6g2c-p5iyp5-fsn2yg\2.exe
    3⤵
    PID:5820
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5868
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:1264
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5540
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:1364
- - C:\Users\Admin\AppData\Local\Temp\bom3ht-odj4bg-67eg2y-7y4dhx-dtqmsr\2.exe
    C:\Users\Admin\AppData\Local\Temp\bom3ht-odj4bg-67eg2y-7y4dhx-dtqmsr\2.exe
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\2csiez-mv0cpf-yp9493-6a9v5v-66ajav\2.exe
    C:\Users\Admin\AppData\Local\Temp\2csiez-mv0cpf-yp9493-6a9v5v-66ajav\2.exe
    3⤵
    PID:5544
- - C:\Users\Admin\AppData\Local\Temp\zykmht-nwd866-6lws7m-86a0wl-fwmhie\2.exe
    C:\Users\Admin\AppData\Local\Temp\zykmht-nwd866-6lws7m-86a0wl-fwmhie\2.exe
    3⤵
    PID:5752
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5884
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:6000
- - C:\Users\Admin\AppData\Local\Temp\gyci0u-bpfx70-oedy1m-6889s4-7zx773\2.exe
    C:\Users\Admin\AppData\Local\Temp\gyci0u-bpfx70-oedy1m-6889s4-7zx773\2.exe
    3⤵
    PID:5888
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5312
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5904
- - C:\Users\Admin\AppData\Local\Temp\f1z8wo-3ug2vz-xrv8s5-9l4zbt-h64q8l\2.exe
    C:\Users\Admin\AppData\Local\Temp\f1z8wo-3ug2vz-xrv8s5-9l4zbt-h64q8l\2.exe
    3⤵
    PID:6588
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6656
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6952
- - C:\Users\Admin\AppData\Local\Temp\w97ais-svzyzx-6fl83j-yib4qq-03pbeo\2.exe
    C:\Users\Admin\AppData\Local\Temp\w97ais-svzyzx-6fl83j-yib4qq-03pbeo\2.exe
    3⤵
    PID:5452
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6196
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:6500
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6308
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6892
- - C:\Users\Admin\AppData\Local\Temp\hymzf9-7lr4pj-1duivp-f2sjpc-xwnuht\2.exe
    C:\Users\Admin\AppData\Local\Temp\hymzf9-7lr4pj-1duivp-f2sjpc-xwnuht\2.exe
    3⤵
    PID:5412
- - C:\Users\Admin\AppData\Local\Temp\f8fy5s-l326hm-awj1gx-ufrvsd-690mb1\2.exe
    C:\Users\Admin\AppData\Local\Temp\f8fy5s-l326hm-awj1gx-ufrvsd-690mb1\2.exe
    3⤵
    PID:6504
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6508
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:7056
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6304
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:7132
- - C:\Users\Admin\AppData\Local\Temp\0e3tyl-qwx6hu-vxv5jp-9ghgnb-s410os\2.exe
    C:\Users\Admin\AppData\Local\Temp\0e3tyl-qwx6hu-vxv5jp-9ghgnb-s410os\2.exe
    3⤵
    PID:6816
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:512
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:6936
- - C:\Users\Admin\AppData\Local\Temp\mdo22v-t3zkop-iq5oxz-di8245-q753ys\2.exe
    C:\Users\Admin\AppData\Local\Temp\mdo22v-t3zkop-iq5oxz-di8245-q753ys\2.exe
    3⤵
    PID:5004
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4528
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:7356
- - C:\Users\Admin\AppData\Local\Temp\81yk8o-9soino-fnarzi-u1lad3-nz0fa9\2.exe
    C:\Users\Admin\AppData\Local\Temp\81yk8o-9soino-fnarzi-u1lad3-nz0fa9\2.exe
    3⤵
    PID:7636
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7720
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:7188
- - C:\Users\Admin\AppData\Local\Temp\0g9g26-8097yy-8xaw2y-4j2kj3-rhu58f\2.exe
    C:\Users\Admin\AppData\Local\Temp\0g9g26-8097yy-8xaw2y-4j2kj3-rhu58f\2.exe
    3⤵
    PID:4824
- - C:\Users\Admin\AppData\Local\Temp\c8j4lg-euxb9e-kk8tv7-jlk8p8-ednnwd\2.exe
    C:\Users\Admin\AppData\Local\Temp\c8j4lg-euxb9e-kk8tv7-jlk8p8-ednnwd\2.exe
    3⤵
    PID:8176
- - C:\Users\Admin\AppData\Local\Temp\1ssy45-jmn9vn-kdd7am-htt41q-5maz01\2.exe
    C:\Users\Admin\AppData\Local\Temp\1ssy45-jmn9vn-kdd7am-htt41q-5maz01\2.exe
    3⤵
    PID:8084
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6740
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5100
- - C:\Users\Admin\AppData\Local\Temp\45xfz0-6kzwyx-ok6yfg-og6mjg-j2ya0k\2.exe
    C:\Users\Admin\AppData\Local\Temp\45xfz0-6kzwyx-ok6yfg-og6mjg-j2ya0k\2.exe
    3⤵
    PID:7996
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7948
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4960
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4424
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:7756
- - C:\Users\Admin\AppData\Local\Temp\8876tm-0bx2gt-2wb94r-9mmrrk-yasv0v\2.exe
    C:\Users\Admin\AppData\Local\Temp\8876tm-0bx2gt-2wb94r-9mmrrk-yasv0v\2.exe
    3⤵
    PID:8980
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:9124
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:8816
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7480
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:8876
- - C:\Users\Admin\AppData\Local\Temp\e1olyi-rqmms5-ajgxjm-aa6vyl-g6s4af\2.exe
    C:\Users\Admin\AppData\Local\Temp\e1olyi-rqmms5-ajgxjm-aa6vyl-g6s4af\2.exe
    3⤵
    PID:8548
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8476
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:8384
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8528
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:8876
- - C:\Users\Admin\AppData\Local\Temp\usxkpk-fb6e10-r5e6lo-zqewhg-ymfllg\2.exe
    C:\Users\Admin\AppData\Local\Temp\usxkpk-fb6e10-r5e6lo-zqewhg-ymfllg\2.exe
    3⤵
    PID:8548
- - C:\Users\Admin\AppData\Local\Temp\x1naok-k0gwdw-4ozgfd-fojzo1-mevgav\2.exe
    C:\Users\Admin\AppData\Local\Temp\x1naok-k0gwdw-4ozgfd-fojzo1-mevgav\2.exe
    3⤵
    PID:8404
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7540
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:1768
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:8392
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:8232
- - C:\Users\Admin\AppData\Local\Temp\0vmcjd-vnqqqj-8cnrk6-q6i3bn-rx71qn\2.exe
    C:\Users\Admin\AppData\Local\Temp\0vmcjd-vnqqqj-8cnrk6-q6i3bn-rx71qn\2.exe
    3⤵
    PID:9408
- - C:\Users\Admin\AppData\Local\Temp\b14izj-ztldyv-trziu1-5l8aep-d681ah\2.exe
    C:\Users\Admin\AppData\Local\Temp\b14izj-ztldyv-trziu1-5l8aep-d681ah\2.exe
    3⤵
    PID:8528

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3880

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4536

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:468

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5088

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1040

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4060

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4068

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4052

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2716

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2592

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}
1⤵
PID:4984

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:972

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:952

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3352

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2924

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:864

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5076

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1168

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1940

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3348

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2256

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3612

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5128

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6028

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2780

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6104

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5852

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5760

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5456

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5812

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5748

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:936

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5968

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:368

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5740

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:208

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1512

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5056

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6368

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7164

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6008

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6904

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6876

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7104

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5768

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6004

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:828

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6232

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6848

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5448

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2468

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1432

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3416

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5616

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6820

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3344

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4884

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4404

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7544

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8148

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7416

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7668

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7588

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6532

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7636

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7732

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6120

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4064

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6488

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7204

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4324

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7608

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8184

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8308

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8904

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8672

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8736

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9104

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6336

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8856

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9112

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:448

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6324

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9176

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8644

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8132

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9352

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9964

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9260

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9928

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:9904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3119179382.exe

Filesize
100KB

MD5
2d9e9be24371572f16ffb9ed1d3bb777

SHA1
6f440788a0fd1927812c7d59a3cb4344d64d6777

SHA256
4c9f343c4a2278d2ae59e374ee75c58109e1c4b8f6c3ebf481b496811ca1a7f8

SHA512
9b11baf53d8420a41e03ec1c90e16970ac6affeb558a919ee30e7a68d809346c972862c813ed8fb67c89e9e1082558eaa099fc230ba0ab74816401e72ccf3cb6

Download Submit
C:\Windows\shutdown.dll

Filesize
31B

MD5
b70ed9a5e09ad0e4c2e55df4bbded575

SHA1
34170a65f8a2d9f2273f69fa4115e46197e1db53

SHA256
1b0f2beca8a0a79f689143a712f55f1721fcc3f540e9696d53204cd6db003ba3

SHA512
c4a6bdbe44cc414534465b6d128708e337f73bfc23c79dfc877c27e569cabb0ca90b8d04c15cc6edc91abce112df11c164ba37df1f40b1fc70eed69cd0130b17

Download Submit
C:\Windows\shutdown.dll

Filesize
31B

MD5
c23961df4551bec45cfa91f9b0793cfc

SHA1
b3cb3cf9b13184df073b5262e7b3514f49cad29f

SHA256
4cdf2dad937a1754b576d6af111d9c9291900e7597607adcb7074b1c58eb04ef

SHA512
ac3bdb0aa81e641443ad4c5b8844564e31997a400cddf0bad5a8e35d216691571d3b9179dfe66d91e9f2c0c6cb1beebbc6a5e9c17e17aeaf969e59812ab704b4

Download Submit
F:\autorun.inf

Filesize
253B

MD5
b775a5a4faab19e5c95c75e3461b2725

SHA1
744ad2a2d65b0fd4f83cd46ba8097cae27fda264

SHA256
826327d415e365d8e8eb6f4ef70b8098e2a54fde194a7bc149b7322fd4d8fc2f

SHA512
587efb9c1469df6e08ea0aa9e58b3a70db3a5481fdf4cb225785b5a597443621eaebe678998cabaa3b8c795a4250af7efb1b884826a3bb6f188a6ddd64ecb735

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads